Article 12
Record-keeping
In plain terms
High-risk systems must automatically log events over their lifetime to ensure traceability.
High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system.
In order to ensure a level of traceability of the functioning of a high-risk AI system that is appropriate to the intended purpose of the system, logging capabilities shall enable the recording of events relevant for:
(a) identifying situations that may result in the high-risk AI system presenting a risk within the meaning of Article 79(1) or in a substantial modification;
(b) facilitating the post-market monitoring referred to in Article 72; and
(c) monitoring the operation of high-risk AI systems referred to in Article 26(5).
- For high-risk AI systems referred to in point 1 (a), of Annex III, the logging capabilities shall provide, at a minimum:
(a) recording of the period of each use of the system (start date and time and end date and time of each use);
(b) the reference database against which input data has been checked by the system;
(c) the input data for which the search has led to a match;
(d) the identification of the natural persons involved in the verification of the results, as referred to in Article 14(5).
Related recitals
Make Article 12 auditable
Matproof maps this article to 3 concrete requirements and 1 reusable control — map once, reuse across NIS2, DORA and ISO 27001.
Controls
Requirements covered
- • Automatic Logging Capabilities
- • Traceability of System Functioning
- • Biometric System Specific Logging