Most organisations deploying AI have logs. The harder operational question is whether those records can reconstruct what happened, which controls were active, and whether the evidence can be trusted when a consequential decision is reviewed months later.
Article 12 of the EU AI Act establishes automatic recording requirements for specified high-risk AI systems. The objective is traceability of the system's functioning and, where applicable, monitoring of operations and post-market monitoring. The Act sets the regulatory outcome, but it does not prescribe SHA-256, RFC3161 timestamps, hash chaining, or another particular cryptographic implementation.
That distinction matters. An organisation can meet an applicable logging obligation using an architecture that is appropriate to its system and risk profile. Cryptographic integrity is an implementation choice that may provide additional assurance, not a universal Article 12 requirement.
Application logs, observability platforms, and database audit tables can provide valuable records. They can also make reconstruction difficult when events are spread across systems, context is incomplete, retention is inconsistent, or records are controlled by the same infrastructure being examined.
That is an operational evidence problem rather than a claim that conventional logs are legally invalid. The practical test is whether the organisation can produce a coherent record of the relevant event, its context, the applicable controls, and the provenance of the evidence.
For organisations that need stronger verification characteristics, an evidence layer can provide four useful properties:
KairoNull's Umbra Trust Protocol uses SHA-256 hash chaining for its evidence records. Each record is bound to the preceding record, so an alteration to a chained record changes the expected hash relationship.
If a chained record is modified, its calculated hash no longer matches the expected relationship. The result is a detectable integrity failure. This supports verification of the evidence itself; it does not by itself establish that the underlying AI decision was correct.
Where RFC3161 timestamping is configured, a trusted timestamp authority can provide external evidence that a particular digest existed at or before a stated time. This complements hash chaining: the chain addresses relationships between records, while timestamping can provide an external time-bound reference.
Neither mechanism should be represented as an automatic regulatory guarantee. Their value is that they strengthen the evidence and verification layer for organisations that need those properties.
Article 19 contains specific retention requirements for automatically generated logs for the high-risk systems to which the relevant provisions apply. Organisations should assess those requirements alongside their system classification, applicable sector rules, contractual obligations, and internal retention policy.
For that reason, the useful implementation question is not simply whether a vendor says "compliant." It is whether the deployed architecture captures the required events, retains them for the applicable period, and lets the organisation demonstrate how the records were generated and preserved.
If you already have an AI governance or observability platform, ask:
The answers tell you what evidence capability you actually have. They also help distinguish a regulatory requirement from an architectural choice made to provide stronger assurance.
KairoNull provides AI evidence infrastructure for organisations operating consequential AI systems. The Umbra Trust Protocol captures runtime decision context, links evidence to control state, and provides cryptographic integrity and verification capabilities where configured.
Learn how KairoNull works →