Updated 17 October 2026. First published on 1 February 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) deferred the Annex III high-risk obligations, Article 12 among them, to 2 December 2027, and the Annex I product-embedded obligations to 2 August 2028. The dates below follow that timeline.
When the EU AI Act's high-risk obligations apply from 2 December 2027, Article 12 will be one of the most technically demanding requirements for high-risk AI systems. It's also one of the most misunderstood.
Most compliance platforms treat Article 12 as a documentation exercise: generate some logs, store them somewhere, produce a report when asked. This approach will fail the first serious audit.
What Article 12 Actually Says
Article 12(1) requires that high-risk AI systems "technically allow for the automatic recording of events (logs) over the lifetime of the system." The key word is 'automatic.' Not 'documented after the fact.' Not 'reconstructed from memory.' Automatic.
For remote biometric identification systems (Annex III, point 1(a)), Article 12(3) specifies minimum log content: the period of each use, the reference database against which input data was checked, input data for which the search led to a match, and the identification of natural persons involved in verification of results. For every high-risk system, Article 12(2) requires that logging support identifying situations that may present a risk, post-market monitoring, and monitoring of the system's operation.
Why Documentation Platforms Fall Short
Documentation platforms excel at producing impressive compliance reports. They can generate Annex IV technical documentation, create human-readable summaries, and organize information into auditor-friendly formats.
But they have a fundamental limitation: they document what you tell them, not what actually happened. If your AI system makes a decision at 2:47 AM on a Sunday, a documentation platform can't capture it unless something else already recorded that event.
The Infrastructure Requirement
Article 12 compliance requires infrastructure that sits between your AI systems and the outside world, capturing every prediction, every input, every decision, every outcome. Not sampling. Not best-effort. Every event.
This infrastructure must be provider-independent. If you're using Claude today and GPT tomorrow, your logging can't depend on either provider's cooperation. It must work regardless of which model made the decision.
- 99.7%+ capture rate with cryptographic verification
- Immutable storage that can't be retroactively modified
- Provider-independent operation across any AI model
- Real-time logging, not batch processing after the fact
- Complete chain of custody from input to output
What Auditors Will Actually Check
Conformity Assessment Bodies won't accept a report that says "we log everything." They'll ask for evidence. Show me the logs from last Tuesday. Prove this decision was made by this model with this input. Demonstrate that the log couldn't have been modified after the fact.
Infrastructure-level compliance provides these answers automatically. Documentation-level compliance requires you to scramble.
The December 2027 Timeline
The months just before the deadline are not the time to discover your compliance approach won't survive an audit. Organizations deploying high-risk AI systems should be implementing capture infrastructure now, while there's still time to identify gaps and prove the system works.
CleanAim® provides the infrastructure layer that makes Article 12 compliance automatic. Every AI decision captured. Every event logged. Every audit answered with evidence, not explanations.