EU AI Act log-keeping for small teams: what do Articles 12, 19, and 26 actually require?
Article 12 requires high-risk AI systems to keep records that allow their operation to be traced. Review the receipt and actual deliverable before accepting a handover.
Scope: a plain-language summary of the articles for record planning, not legal advice. Whether a system is high-risk, and which duties apply to your role, needs advice for your situation.
The roles decide everything. Providers build or place high-risk systems on the market; deployers use them. Article 12 sits on the system: high-risk systems must be designed to record events across their lifetime so operation can be traced. Article 19 sits on the provider: the automatically generated logs under the provider's control are kept for a period appropriate to the purpose, at least six months where the Act's terms apply. Article 26 sits on the deployer: keep the logs under your control, use them to monitor for risk, and keep them for the period the article sets, again with six months as the Act's floor in the cases it names.
Timing, stated carefully because it changed: the EU's Digital Omnibus moved the application of the Annex III high-risk duties to 2 December 2027, while Article 50 transparency duties begin in August 2026. The record-keeping value of this page does not depend on either date: a small team that keeps step-level, checkable records of agent work, who ran it, what it produced, what a human approved, holds most of what Articles 12, 19, and 26 ask any role to be able to show, whenever they are asked.
The practical gap for deployers is that vendor logs live with the vendor, in the vendor's format, for the vendor's retention period. A deployer-side record, your own receipts and handovers, kept under your control for your chosen period, is the piece Article 26 assumes you have. Build it because the record earns its keep on any date, and the phased duties leave the time to build it well.
Checklist: deployer log-keeping for a small team
1. Inventory: list the AI systems and agents your team uses on real work, one line each, with the role you play for each (deployer, or provider if you ship systems). 2. Per job, keep: instruction, steps with saved results, producer labels, source states, and the human decision where one was made. 3. Retention: set a period per record class, six months as the Act's floor where it applies, longer where contracts require. 4. Control: keep the records in storage your team controls, exportable without the vendor. 5. Review: sample the logs monthly for anomalies, and record the review itself. 6. Revisit roles and dates annually, or when your use changes.
Worked example
Sample: a six-person consultancy uses agents for client research (deployer role). Their Article 26 posture is the checklist above: job records with steps and approvals, kept in their own export, reviewed monthly. When a client audits a project, the same records answer, which is the pattern on the sibling page about client audits. (Sample scenario; the article analysis is the general summary in the scope line.)
Frequently asked questions
We only use AI tools, we do not build them. Do Articles 12 and 19 apply to us?
Articles 12 and 19 bind the system's design and the provider. Your duties as a deployer sit mainly in Article 26: keep the logs under your control, monitor operation, and be able to show them. That is why the deployer-side record matters: you cannot keep what only the vendor holds.
Does the December 2027 deferral mean we can ignore log-keeping until then?
The deferral moves the Annex III application date; it does not make records retroactively creatable. Records for work done in 2026 exist only if the work was recorded in 2026, and clients, insurers, and auditors ask for them on their own schedules, not the Act's.
What about the Article 50 transparency duties from August 2026?
Article 50 covers disclosure duties, for example telling people they are interacting with AI and marking certain generated content. It is a separate duty from log-keeping; the sibling page on Article 50 disclosure records covers what to keep for it.
By Brennan Zambo, founder of Zambo.
Last verified: 2026-10-17.
Try a handover
A handover gives your client one proof link with verifiable receipts to review, then Accept or Flag.
try it: say 'use zambo to hand this over to <client>' in your ai