EU AI Act Article 12: record-keeping requirements for AI agents

Article 12 of the EU AI Act requires that high-risk AI systems include automatic logging capabilities. For AI agents, this means recording every significant decision and action the agent takes, stored in a way that enables post-hoc analysis and compliance verification.

What must be logged

The Act requires logging of events that are relevant to:

• Identifying situations that may result in risks
• Facilitating post-market monitoring
• Monitoring the operation of the system

For AI agents, this translates to:

• Every tool call the agent attempts
• The policy decision for each tool call (allow, block, escalate)
• The reason for each decision (which rule matched)
• Content scan results (threats detected or cleared)
• Approval workflow events (requested, approved, denied, timed out)
• Session metadata (user, agent identity, timestamps)

Retention requirements

Logs must be retained for a period appropriate to the intended purpose of the high-risk AI system. The minimum is six months, but many deployments will need longer retention based on their domain requirements.

Tamper resistance

Article 12 implicitly requires that logs be reliable. If logs can be modified after the fact, they cannot serve their intended purpose of enabling investigation and compliance verification.

Hash-chained receipts satisfy this requirement. Each receipt includes a cryptographic hash of the previous receipt, creating a chain that breaks if any entry is modified, deleted, or reordered.

Implementation with Authensor

Authensor generates a receipt for every policy decision automatically:

const guard = createGuard({
  policy,
  receipts: {
    store: 'postgresql',
    connectionString: process.env.DATABASE_URL,
    retention: '24months',  // Retention period
  }
});

Each receipt contains:

{
  "id": "rec_abc123",
  "timestamp": "2026-01-15T10:30:00Z",
  "tool": "email.send",
  "args": { "to": "user@example.com" },
  "action": "escalate",
  "reason": "External emails require approval",
  "threats": [],
  "principal": { "user": "user_456", "agent": "agent_support" },
  "hash": "sha256:a1b2c3...",
  "previousHash": "sha256:d4e5f6..."
}

Verification

The control plane API provides a chain verification endpoint:

curl https://control-plane/api/receipts/verify?session_id=sess_abc123

This returns whether the chain is intact and identifies any breaks. Run verification periodically as part of your compliance monitoring.

Audit readiness

When a regulator or auditor requests records, you need to produce them quickly. Structure your receipt storage for efficient querying by session, by agent, by time range, and by decision type. The control plane API supports all of these query patterns out of the box.