Arts. 12/19: record-keeping that withstands scrutiny
Last updated: · Leutrim Miftaraj
High-risk systems must record events automatically (Art. 12); deployers must retain the logs (Art. 19). The open question is never whether, but quality: are the records complete, unaltered and attributable?
Completeness
Every verification (with primary code and latency), every escalation with its decision, every status change, every revocation — the chain is created automatically in operation, not as after-the-fact logging.
Tamper evidence
Append-only by database trigger: update and delete are blocked, every entry binds the predecessor's hash. The question «was the log adjusted afterwards?» is answered by mathematics, not by the IT department.
Export per system, agent and period
The retention duty needs retrievability: the evidence export delivers filtered, integrity-protected extracts with a root hash — verifiable by an authority, internal audit or the counterparty.
Key takeaway
Logs anyone can change are notes. Record-keeping fit for Art. 12 is a chain with mathematics behind it.
Try it yourself
Issue your first agent mandate and check your first decision with its receipt — free, in a few minutes.