Governance guide · reviewed 30 September 2026

EU AI Act record keeping: start with the decision trail.

For teams preparing AI governance, the useful question is what can be reconstructed from an event, its context and the review that followed. The law applies differently by role and use case; this guide is a product-relevant reading map, not a compliance determination.

What the Act asks for

Article 12 of the EU AI Act requires high-risk AI systems to technically allow automatic logging over their lifetime, at a level appropriate to their intended purpose. The logs must support traceability, post-market monitoring and operational monitoring. The detailed obligations depend on whether an organisation is a provider or deployer and on the system’s classification.

Article 26 addresses deployers of high-risk systems, including appropriate human oversight, monitoring and retention of automatically generated logs under their control. Article 19 addresses provider log retention. An evidence tool may help organise records, but it cannot decide classification, supply missing source events or satisfy every obligation on its own.

When the high-risk rules apply

The European Commission’s current implementation guidance says the high-risk rules for Annex III systems apply from 2 December 2027, and those for AI embedded in regulated physical products from 2 August 2028, following the AI Omnibus. Other AI Act provisions have different dates. Check the Commission’s timeline before relying on a deadline.

A practical evidence checklist

  1. Classify the system and your role. Record the intended use, who provides and deploys it, and which legal duties may apply.
  2. Define the event. Identify the decision, time, system version, responsible actor and policy or approval context to capture.
  3. Keep the source record. Retain required logs and documents in governed storage with access, retention and privacy controls.
  4. Track the review. Show what a human checked, what was missing and which action followed.
  5. Test the evidence path. Export a sample and confirm that an authorised reviewer can reconstruct the event and identify gaps.

Where Orvessian fits today

Orvessian’s private testnet pilot accepts selected structured governance records and connects them to recording-service signatures, private batch proofs and public Base Sepolia anchors. The synthetic demo shows the investigation workflow. These checks can help detect changes to disclosed records; they do not establish complete capture, source truth, correct decisions or legal compliance. Production availability remains in development.

Explore the governance workflow, the verification boundaries and the dated readiness summary.

Primary sources