Record-keeping and logs

The requirement, in our words

High-risk systems must technically allow automatic recording of events over the lifetime of the system, with traceability appropriate to the intended purpose. For remote biometric identification, the log must include the period of use, the reference database, the input that led to a match and the people involved.

What it means for human oversight

The log is the audit trail of the oversight decision. It should let a reviewer reconstruct what the system produced, what the person did and when.

How to evidence it

Attach the artefacts above to the Record-keeping and logs row with the system name, the owner and the date. The first one is the anchor: Logging capability design evidence. The OH-42 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for A retention policy aligned with the intended purpose. If that artefact for OH-42 cannot be produced, the row is a gap, whatever the policy says.

OH-42 carries 3 evidence items and 2 common gaps. For record-keeping and logs, keep the version the operator actually received with its date, because the current intranet copy is not evidence of what was in force. The OH-42 statement above is ours, written from EU AI Act, Article 12, not a reproduction of the licensed text.

Common gaps

• Insufficient logging to reconstruct operation
• Logs not retained over the lifetime

Related units

• Documented information
• Information for users
• Context and the role you play