Reliability and control · Layer 6
Logging
Automatically recording what an AI does, who asked it, with what data and with what result, so you can prove it later.
A way to picture itAn aircraft’s black box: nobody looks at it on an ordinary day, but without it you can neither explain an incident nor show that everything went to plan.
A retail bank uses an AI that helps its advisers assess personal loan applications. Every recommendation is logged with the model version, the data used, the adviser who decided and any departure from the recommendation. When a customer challenges a refusal, the bank can reconstruct within minutes what the AI proposed and what the adviser decided. Logs are kept for a period agreed with the data protection officer, then deleted.
High-risk systems must technically allow events to be recorded automatically throughout their lifetime, to ensure traceability (EU · AI Act, art. 12). Deployers keep the logs under their control for an appropriate period of at least six months, unless other EU or national law provides otherwise (EU · AI Act, art. 26), from 2 December 2027 for Annex III systems. Logs often contain personal data: they are themselves subject to minimisation and limited retention, while supporting security and proof of compliance (EU · GDPR, art. 5 and 32). As a general rule, the CNIL recommends keeping logs for six months to one year (France · CNIL).
“What exactly do you log (request, model version, documents retrieved, tools called, approval), for how long, and how do we access our logs, including when the contract ends?”
For a high-risk system, at least six months on the deployer’s side, unless other rules apply (EU · AI Act, art. 26). Beyond that, the period must be justified by the purpose: as a general rule, the CNIL recommends six months to one year (France · CNIL).
Not necessarily. You need what allows a decision to be reconstructed; full content, often rich in personal data, must be justified case by case and protected accordingly.
Both, each for what they control: for a high-risk system, the AI Act requires both provider and deployer to keep the logs under their control (EU · AI Act, art. 19 and 26). The contract should specify what is logged, where, for how long and how you access it.
Educational explainer, not legal advice. Up to date as of 29 October 2026.