Article 19

Automatically generated logs

1.   Providers of high-risk AI systems shall keep the logs referred to in Article 12(1), automatically generated by their high-risk AI systems, to the extent such logs are under their control. Without prejudice to applicable Union or national law, the logs shall be kept for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in the applicable Union or national law, in particular in Union law on the protection of personal data.

2.   Providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the logs automatically generated by their high-risk AI systems as part of the documentation kept under the relevant financial services law.

Frequently Asked Questions

Providers of high-risk AI systems must automatically keep logs recording how their systems operate if those logs are within their control. These logs help monitor the AI’s behavior, ensure accountability, and must be stored for a suitable period, generally at least six months, taking into account applicable national and European Union laws, especially those protecting personal data.
Logs from high-risk AI systems must typically be stored for at least six months. However, the exact length may vary depending on specific laws and regulations relevant to the AI system’s purpose, and special requirements might apply when personal data protection laws or other specific national regulations are involved.
Yes, financial institutions have specific obligations under European Union financial services laws concerning their internal documents and procedures. They must include logs generated by their high-risk AI systems in their existing documentation practices, ensuring compliance with financial service standards and transparency about automated AI-based processes within their institutions.
Yes, national laws can influence how long logs need to be stored, potentially establishing longer or shorter retention periods compared to the general rule of six months. Providers must pay attention not only to European Union guidelines but also to specific national laws and regulations, which can modify logging obligations and requirements.

AI literacy

Book Demo

We will get back to you via email as soon as possible.