EU AI Act audit logs: what Article 12 requires and how to comply
The EU AI Act requires high-risk AI systems to automatically record events over their lifetime so their operation is traceable (Article 12, applying from August 2026). The hard part is not storing logs — it is making them trustworthy.
Why your own logs are not enough
A log file the operator can edit is not evidence after an incident. Regulators, auditors and insurers want non-repudiable records — ones the operator could not have altered. "Trust me, the model decided X" is the opposite of an audit trail.
Tamper-evident by construction
Sign each decision record (input hash, output, model id, timestamp) and chain each entry to the hash of the previous one. Edit one byte or remove an entry and the chain no longer verifies. Anyone can later demand the signed history and check it independently — no trust in the operator required.
Why post-quantum, and the honest limit
These records may need to hold up for years, so sign with Dilithium-2 (FIPS 204) — a classical signature becomes forgeable once quantum computers arrive. Honest scope: this proves authenticity, ordering and integrity of what was logged; it does not prove the model reasoned correctly, and it is resistant to known attacks per NIST, not unbreakable.
Try it yourself — live, free, verifiable in 30 seconds:
Try ProofMind free →