EU AI Act Art. 19: automatically generated logs kept by the provider
Keep the automatically generated logs under the provider's control for a period appropriate to the intended purpose, at least six months unless other law provides otherwise
AIGE-OBL-EUAIA-ART19. Drawn from chapter 08.
Text alternative
- Clause: EU AI Act, Art. 19.
- Duty holder: Provider.
- Applies from: 2027-12-02, Deferred.
- Artefact: Log-retention policy as code.
- Layers: Layer 04, Layer 05.
- Evidence record: Evidence record v1.
- Record schema: Evidence record.
- The same topic in 12 other frameworks; the crosswalk section below links each clause.
Data table: the dates
| Date | Step | Detail |
|---|---|---|
| 2027-12-02 | Deferred | Annex III |
| 2028-08-02 | High-risk (Annex I) | Applies to Annex I embedded (product safety-component) systems |
| 2030-08-02 | Later step | Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2)) |
- Id
AIGE-OBL-EUAIA-ART19- Instrument
- EU AI Act (post-Omnibus) law
- Compared side by side
- ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act
- Clause
- Art. 19
- Duty holder
- Provider
- Authority
- National MSA
- Applies from
- Deferred · Annex III
- Later dates
-
- Applies to Annex I embedded (product safety-component) systems
- Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))
- System class
- High-risk (Annex III) · High-risk (Annex I)
The artefact that evidences it
Log-retention policy as code (at least six months, set by intended purpose); tamper-evident log store.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Open controls | AIGE-CTL-ASSURE-008 Evidence Retention as Code | Direct |
| Same crosswalk topic | AI Verify 3.4.1, 9.8.1, 5.10.1 | Core clause |
| Same crosswalk topic | CSA AICM LOG-09, LOG-12 | Core clause |
| Same crosswalk topic | EU AI Act Art. 12, Art. 26(6), Art. 26 | Core clause |
| Same crosswalk topic | GAO AI Accountability 4.3 | Core clause |
| Same crosswalk topic | ISO 42001 A.6, A.6.2.8 | Core clause |
| Same crosswalk topic | Korea AI Act Art. 34(1)(5) | Core clause |
| Same crosswalk topic | OECD AI Principles OECD 1.5(b) | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 App. 2 II.6, TC260 5.3.6 | Core clause |
| Same crosswalk topic | prEN 18229-1 prEN 18229-1 | Core clause |
| Same crosswalk topic | China AI Labelling Label Art. 5 | Related clause |
| Same crosswalk topic | NIST AI RMF MANAGE 4, MEASURE 3 | Related clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.3.3 | Related clause |
Patterns that build it
No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Logging and traceability
- EU AI Act Art. 12 Record-keeping (core)
- ISO 42001 A.6 AI system life cycle (core)
- TC260 Framework 3.0 TC260 App. 2 II.6 Continuous monitoring and auditing (core)
- TC260 Framework 3.0 TC260 5.3.6 Logs kept and audited (core)
- EU AI Act Art. 26(6) Deployers keep the automatically generated logs (core)
- ISO 42001 A.6.2.8 AI system recording of event logs (core) (clause not verified)
- CSA AICM LOG-09 Log Records (core)
- Korea AI Act Art. 34(1)(5) Documents showing the measures taken (core)
- OECD AI Principles OECD 1.5(b) Traceability of datasets, processes and decisions (core)
- prEN 18229-1 prEN 18229-1 AI trustworthiness framework, Part 1: logging (draft; supports Art. 12) (core) (clause not verified)
- GAO AI Accountability 4.3 Traceability: document results of monitoring activities and any corrective actions taken (core)
- AI Verify 3.4.1 Reproducibility: log all inputs and inference outputs of the model and keep them for a reasonable time for review (core)
- AI Verify 9.8.1 Accountability: process or governance-by-design technology for auditability: versioned code, models and data, and an audit trail of deployments and inputs/outputs (core)
- EU AI Act Art. 26 Obligations of deployers of high-risk AI systems
- NIST AI RMF MANAGE 4 MANAGE 4: Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored
- NIST AI RMF MEASURE 3 MEASURE 3: Mechanisms for tracking identified AI risks over time are in place
- China AI Labelling Label Art. 5 Implicit metadata labels
- CSA AICM LOG-12 Transaction/Activity Logging
- Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test
- AI Verify 5.10.1 Security: monitor and log inputs to the AI system (queries, prompts, requests)
Open controls that evidence it
Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.
-
AIGE-CTL-ASSURE-008Evidence Retention as Code (Assurance and evidence profile)
Source
Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-euaia-art19.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). EU AI Act Art. 19: automatically generated logs kept by the provider (AIGE-OBL-EUAIA-ART19). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art19. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{EU AI Act Art. 19: automatically generated logs kept by the provider (AIGE-OBL-EUAIA-ART19)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art19},
note = {Version 0.5.0}
}