EU AI Act Timeline: Logging and Evidence Preparation

Use the deadline to plan a bounded evidence review. It does not establish that every AI workflow has the same classification, obligations or application date.

Check the current application timeline

The European Commission's overview reports Annex III high-risk rules applying from 2 December 2027 and high-risk rules for AI embedded in regulated products from 2 August 2028. Determine the particular system's classification and transitional treatment before using a date as a compliance conclusion. Do not classify all financial-services or insurance algorithms together.

What Article 12 addresses

Article 12 addresses automatic event-recording capability over the lifetime of a high-risk AI system and traceability appropriate to its intended purpose. Its text does not prescribe SHA-256, RFC 3161 or a specific ledger product. Whether exports run on a schedule is a different question from whether relevant events are recorded automatically.

Do not invent a historical logging obligation

An unavailable historical record limits reconstruction. Its absence does not, by itself, establish a breach of Article 12 before that provision applies to the system. Other legal or contractual obligations may apply independently. Assess them explicitly rather than treating the later AI Act application date as a retrospective requirement.

Make an evidence plan that can be tested

1. Select a workflow and owner. Define the consequential action, relevant systems and review question.
2. Attempt one reconstruction. Join the request, released recommendation, policy check, approval and execution using the available records.
3. Identify specific gaps. Separate a control that did not operate from a control whose operation cannot currently be evidenced.
4. Agree proportionate capture and retention. Determine the applicable obligations and purpose. This article does not prescribe eighteen months or another blanket period.
5. Verify the result. Check that new records actually arrive, refer to the same action and can be exported for review. Document integrity limits and missing sources.

Why begin before the application date?

A small reconstruction exercise exposes integration and ownership gaps while there is time to address them. Begin with an answerable buyer question, such as whether the team can explain who approved an account recovery. Avoid a broad promise that collecting logs alone establishes compliance.