AI system logs: what to keep, for how long, and why they matter when a dispute comes

A customer disputes a decision taken with the help of an AI system: a rejected quote, a screened-out candidate, a blocked invoice. Who can show what the system did, when, on which data and who checked it? If the answer is "the supplier, probably", the problem is not technical but one of governance. Logs are the system's memory, and the law has started to ask for them. Here is who must keep what, for how long, and how to do it without breaching the GDPR.

What the AI Act requires (and from whom)

Regulation (EU) 2024/1689 deals with logs in three articles, all concerning high-risk systems:

• Art. 12 (record-keeping) — the system must technically allow the automatic recording of events over its lifetime. Logs must ensure traceability for three purposes: identifying situations that present a risk or a substantial modification, facilitating post-market monitoring (Art. 72) and allowing the deployer to monitor operation (Art. 26(5)). For remote biometric identification the minimum content is set by the Regulation: the period of each use, the reference database, the input data that produced a match and the persons who verified the results.
• Art. 19 (provider) — the provider keeps the automatically generated logs, to the extent they are under its control, for a period appropriate to the purpose and in any case at least six months.
• Art. 26(6) (deployer) — the same obligation, with the same six-month floor, applies to whoever uses the system. Financial institutions keep them as part of the documentation required by sector rules.

The link between the two roles is Art. 13(3)(f): the instructions for use must describe the mechanisms that let the deployer collect, store and interpret the logs. If the contract or the manual does not mention them, the deployer cannot comply, and the issue should be solved before signing, not after.

From when

After Regulation (EU) 2026/1744 (the Digital Omnibus), high-risk obligations apply from 2 December 2027 for Annex III systems (recruitment, credit, education and the other stand-alone use cases) and from 2 August 2028 for Annex I systems (safety components of regulated products). That sounds far away. But a system bought today will be in use on those dates, and the six months of logs count backwards: whoever has not set up collection by June 2027 will not be able to produce six months of records in December.

Why logs already matter in Italy today

Legislative Decree No. 160 of 9 September 2026, in force since 30 September 2026, brought forward the practical relevance of logs in civil proceedings, and it did so for any damage arising from the use of an AI system:

1. Access to evidence (Art. 17). At the request of an injured party who has made the claim plausible and shown a link between output and harm, the court may order the opposing party or a third party to produce the records, the documentation on the risk-management system, technical information and data on human oversight, subject to proportionality and trade secrets. If a party fails to produce them without justification, the court may treat the facts alleged by the injured party as admitted.
2. Presumed causal link (Art. 18). If the damage stems from a breach of the obligations of Regulation (EU) 2024/1689, the link between breach and damage is presumed unless proven otherwise. Without records, that counter-evidence is almost impossible.
3. Compliance is not enough (Art. 19). Compliance with the Regulation, even if certified, does not in itself exclude liability. But it is the main defence, and it is proven with documents.

Add the GDPR, which since 2018 requires the controller to demonstrate compliance (Art. 5(2)) and, for automated decisions with significant effects, to guarantee human intervention (Art. 22). Without a trace of who reviewed what, that guarantee remains an assertion.

What to record: the minimum content

The AI Act sets the detail only for biometrics. For other systems the yardstick is traceability appropriate to the purpose. In practice, for every relevant run:

The underlying principle: the log must allow a third party, months later, to answer the question "why did the system give this outcome and who approved it?".

For how long: six months is the floor, not the rule

Six months is the AI Act threshold. The actual period should be set in a retention policy that reconciles three constraints:

• Risk and limitation periods. A challenge to a selection or an award can come well after six months; civil limitation periods run for years.
• GDPR. Logs contain personal data. The storage-limitation principle (Art. 5(1)(e)) forbids keeping them "forever": you need a justified period, a legal basis (for high-risk systems, the legal obligation in Art. 26(6)), a privacy notice and an entry in the record of processing activities (Art. 30). Pseudonymising the user identifier after a defined period is often the right compromise.
• Workers. If logs reveal employees' activity, Article 4 of Italy's Workers' Statute and the Garante's guidance on remote monitoring come into play: declared purposes, limited access, no unplanned disciplinary use.

An operational checklist for an SME

1. Map the systems and flag which are (or will become) high-risk: only for these do Arts. 12, 19 and 26 apply. For the others, decide on a minimum record.
2. Ask the supplier where the logs are, in which format, how you export them and how long they are kept. If they cannot say, Art. 13(3)(f) gives you a contractual argument.
3. Define the content using the table above; add the trace of human intervention, which no system records on its own.
4. Set the duration in the policy: at least six months, usually more, with pseudonymisation at expiry.
5. Secure the logs: integrity, named access, backups. A log anyone can edit proves nothing.
6. Rehearse disclosure. Simulate a request under Art. 17 of D.Lgs. 160/2026: can you produce within a few days the records of a decision taken three months ago, with the name of who approved it? If not, you have found the gap.

Where to start

Logs are the only evidence that an AI system worked as declared and that someone was checking it. An independent gap assessment verifies in a few weeks whether the systems in use record what is needed, whether anyone can produce it, and whether the way you keep it complies with the GDPR. It is the cheapest starting point for reaching 2027 with something to show, not just to declare.