# If my business runs an AI agent or AI system in the EU, does the EU AI Act say I have to keep its logs, and for how long?

**Short answer:** Only if the system is high-risk under the Act, and not yet. For high-risk AI systems, the provider must build in automatic logging (Article 12) and keep the logs under its control for at least six months (Article 19), and a business that uses the system (the deployer) must keep the logs under its control for a period appropriate to the system's purpose, of at least six months (Article 26(6)), unless EU or national law, especially data protection law, says otherwise. After the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since July 27, 2026), those duties apply from December 2, 2027 for stand-alone high-risk systems listed in Annex III, such as AI used in hiring and managing staff, creditworthiness checks or access to essential services, and from August 2, 2028 for AI built into regulated products. A typical customer-service, coding or back-office agent isn't high-risk, and the Act sets no log retention period for it. Six months is a floor, not a target: keep logs long enough to answer complaints, audits and disputes, but no longer than data protection law allows, and keep them where the people being logged can't quietly delete them.

## Checklist
1. Work out whether each AI system or agent is high-risk. Check Annex III (for example recruitment and selection, decisions on promotion or termination, task allocation and performance monitoring, creditworthiness and credit scoring, life and health insurance pricing, access to essential public services, education and exam scoring) and whether it's a safety component of a product covered by Annex I.
2. Work out your role. A deployer is anyone using an AI system under its own authority in a professional activity. Building the system or putting your name on it makes you a provider, with more duties.
3. If the system is high-risk, find out from the provider what it logs automatically and where those logs live. Article 26(6) covers logs "to the extent such logs are under their control", so check your contract and your provider's admin console for retention settings and export.
4. Set a written retention period for those logs: at least six months, and longer where the system's purpose or your own legal exposure calls for it (for example, the time limits for employment claims or credit complaints in your country).
5. Check the period against data protection law. Logs that name or identify people are personal data, and the GDPR's storage limitation principle says to keep them no longer than necessary. Record why your period is necessary.
6. Protect the logs from quiet deletion or editing before the period ends. Write-once storage, separate admin rights, or a hash checkpoint of each log batch held outside the team that runs the agent all make a missing or changed entry show.
7. For agents that aren't high-risk, set a retention period anyway, based on what you'd need to investigate an incident or dispute, and apply the same data protection check.
8. Put a review in the diary before December 2, 2027. Commission guidance, standards and national rules may add detail before the high-risk duties apply.

## What does the EU AI Act require about keeping logs of high-risk AI systems?
- Article 12 says high-risk AI systems must technically allow automatic recording of events (logs) over the system's lifetime, recording what's needed to identify situations that may present a risk or a substantial modification, to support the provider's post-market monitoring, and to let deployers monitor operation under Article 26(5). For remote biometric identification systems it lists extra fields, such as each period of use, the reference database checked, the input data that led to a match, and the people who verified the result.
- Article 19 makes the provider keep the automatically generated logs under its control for a period appropriate to the system's intended purpose, of at least six months, unless EU or national law, in particular on personal data, provides otherwise. Article 26(6) puts the same minimum on the deployer for logs under the deployer's control.
- Financial institutions that are already subject to internal governance rules under EU financial services law keep the logs as part of the documentation those rules require.

## When do the EU AI Act's high-risk logging duties start after the Digital Omnibus?
- The Act's high-risk rules were originally due to apply from August 2, 2026. The Digital Omnibus on AI, agreed in May 2026, adopted by the Council on June 29 and published in the Official Journal on July 24, 2026, moved them to fixed dates: December 2, 2027 for systems that are high-risk under Article 6(2) and Annex III, and August 2, 2028 for systems that are high-risk under Article 6(1) and Annex I.
- A high-risk system already placed on the market or put into service before those dates is covered only if its design changes significantly afterwards, except that providers and deployers of high-risk systems used by public authorities must comply by August 2, 2030.

## Is six months long enough to keep AI system logs under the EU AI Act?
- The Act says "of at least six months" and "appropriate to the intended purpose". If you use AI to screen job applicants, the logs are the evidence you'd need if a rejected candidate complains, and that complaint can come later than six months.
- At the same time, logs are rarely free of personal data, and the Act itself defers to data protection law. Pick a period you can justify in both directions, write the reason down, and delete or anonymise on schedule.
- Keeping logs only helps if they're intact when someone asks. If the people who run the agent can also delete its logs, an auditor can't tell a gap from a clean record. Separate the rights, or commit a hash of each batch somewhere they can't change.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "My hiring-screening agent's log is hash-chained and signed. Commit the current head (entry 20480) so nobody can delete or trim entries during our retention period without it showing."

```json
{
  "tool": "recorder_checkpoint",
  "arguments": {
    "checkpoint": {
      "agent": "<RS number>",
      "seq": 20480,
      "head": "<sha256('rec:' + canonical(entry 20480))>",
      "at": "2026-11-10T11:00:00Z"
    },
    "signature": "<agent key's Ed25519 signature over canonical(checkpoint)>"
  }
}
```
- Needs an API key and an agent whose key is proven. It's in the trust toolset (connect to /mcp?toolset=trust). Only the head hash and the count become public; the log itself stays with you.
- verify_recorder is free and needs no key: disclose a run of consecutive {entry, signature} pairs ending at a checkpointed seq, and it reports any bad signature, gap in seq or broken link, and when that head was committed.
- Deleting entries at the end of your retention period is still possible on your own systems. The checkpoint shows the log existed in that form by that time; it doesn't stop you meeting a data protection deletion duty.

_Rightshold doesn't decide whether your AI system is high-risk, store your logs, set retention periods or delete data for you. A checkpoint proves a log head existed by a certain time, not that the entries were complete or true. Dates are as published in the Official Journal as of November 2026; guidance and national rules may add detail. Not legal or compliance advice._

## Sources
- [Regulation (EU) 2024/1689 (AI Act): Articles 3, 6, 12, 19, 26 and Annex III](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202601744)
- [European Parliament Legislative Train: Digital Omnibus on AI (timeline and fixed dates)](https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai)
- [AI Act Explorer: Digital Omnibus on AI (amended Articles 111 and 113)](https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/)
- [Regulation (EU) 2016/679 (GDPR), Article 5(1)(e) storage limitation](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related
- [How to make an AI agent's audit log append-only so even an admin can't silently delete entries](https://www.rightshold.com/answers/how-to-make-an-ai-agents-audit-log-append-only-so-even-an-admin-cant-silently-delete-entries)
- [How to honor a GDPR erasure request when an AI agent's audit log is tamper-evident](https://www.rightshold.com/answers/how-to-honor-a-gdpr-erasure-request-when-an-ai-agents-audit-log-is-tamper-evident)
- [How to log every AI agent tool call for audit](https://www.rightshold.com/answers/how-to-log-every-ai-agent-tool-call-for-audit)
- [How to give an outside auditor read-only, time-limited access to an AI agent's action log](https://www.rightshold.com/answers/how-to-give-an-outside-auditor-read-only-time-limited-access-to-an-ai-agents-action-log)

_Not legal advice. Updated 2026-11-10. JSON: https://www.rightshold.com/answers/how-long-do-you-have-to-keep-ai-agent-logs-under-the-eu-ai-act.json_