2:I[2567,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-f3ed02939fea6e75.js","5766","static/chunks/5766-4fe247b65648a8a7.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","5878","static/chunks/5878-a24e9e9351be5527.js","4873","static/chunks/4873-c3ddefc71fade8a6.js","2567","static/chunks/2567-e795bdb7aa0ec206.js","3894","static/chunks/app/(marketing)/guides/eu-ai-act-article-12-ai-agents/page-294ad4d6d95adbe2.js"],"MarketingShell"]
4:I[7382,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-f3ed02939fea6e75.js","5766","static/chunks/5766-4fe247b65648a8a7.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","5878","static/chunks/5878-a24e9e9351be5527.js","4873","static/chunks/4873-c3ddefc71fade8a6.js","2567","static/chunks/2567-e795bdb7aa0ec206.js","3894","static/chunks/app/(marketing)/guides/eu-ai-act-article-12-ai-agents/page-294ad4d6d95adbe2.js"],"Section"]
5:I[7382,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-f3ed02939fea6e75.js","5766","static/chunks/5766-4fe247b65648a8a7.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","5878","static/chunks/5878-a24e9e9351be5527.js","4873","static/chunks/4873-c3ddefc71fade8a6.js","2567","static/chunks/2567-e795bdb7aa0ec206.js","3894","static/chunks/app/(marketing)/guides/eu-ai-act-article-12-ai-agents/page-294ad4d6d95adbe2.js"],"CodeBlock"]
6:I[7382,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-f3ed02939fea6e75.js","5766","static/chunks/5766-4fe247b65648a8a7.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","5878","static/chunks/5878-a24e9e9351be5527.js","4873","static/chunks/4873-c3ddefc71fade8a6.js","2567","static/chunks/2567-e795bdb7aa0ec206.js","3894","static/chunks/app/(marketing)/guides/eu-ai-act-article-12-ai-agents/page-294ad4d6d95adbe2.js"],"ButtonLink"]
7:I[4707,[],""]
8:I[6423,[],""]
9:I[4873,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-f3ed02939fea6e75.js","5766","static/chunks/5766-4fe247b65648a8a7.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","1713","static/chunks/1713-838bb3f7c92f419b.js","5878","static/chunks/5878-a24e9e9351be5527.js","5896","static/chunks/5896-b2e5ead8abb9b59e.js","4873","static/chunks/4873-c3ddefc71fade8a6.js","3185","static/chunks/app/layout-4a2d8915965980a8.js"],"Providers"]
a:I[6151,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-f3ed02939fea6e75.js","5766","static/chunks/5766-4fe247b65648a8a7.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","1713","static/chunks/1713-838bb3f7c92f419b.js","5878","static/chunks/5878-a24e9e9351be5527.js","5896","static/chunks/5896-b2e5ead8abb9b59e.js","4873","static/chunks/4873-c3ddefc71fade8a6.js","3185","static/chunks/app/layout-4a2d8915965980a8.js"],"Shell"]
3:T734,{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does the EU AI Act require logging for AI agents?","acceptedAnswer":{"@type":"Answer","text":"For high-risk AI systems, yes. Article 12 requires the system to technically allow automatic recording of events over its lifetime, and the logs must make it possible to identify risky situations, support post-market monitoring, and monitor operation. Providers and deployers must keep the logs, at least six months under Articles 19 and 26, longer if other law such as GDPR applies."}},{"@type":"Question","name":"Are ordinary application logs enough for Article 12?","acceptedAnswer":{"@type":"Answer","text":"Usually not for agents. A log line records that an action happened, but an agent's consequential event is why it believed the action was right. If the memory behind the agent overwrites facts on conflict, the state that explains a past decision is gone, and the record cannot support the after-the-fact verification the article expects."}},{"@type":"Question","name":"How long must AI agent logs be kept under the EU AI Act?","acceptedAnswer":{"@type":"Answer","text":"At least six months, per Article 19 for providers and Article 26 for deployers, and longer where other applicable law requires it. GDPR can also require deletion of personal data, so the record needs to support both retention and lawful erasure at once."}},{"@type":"Question","name":"What should an AI agent audit log contain?","acceptedAnswer":{"@type":"Answer","text":"Four things, at minimum: what the agent believed at the moment it acted and where each belief came from; what conflicted and which side was believed; who authorised any risky action, by name; and enough integrity protection that the record can be shown not to have been quietly rewritten afterwards."}}]}b:{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"}
c:{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"}
d:{"display":"inline-block"}
e:{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0}
0:["qEu_4_EHEwSVj22pjWIwJ",[[["",{"children":["(marketing)",{"children":["guides",{"children":["eu-ai-act-article-12-ai-agents",{"children":["__PAGE__",{}]}]}]}]},"$undefined","$undefined",true],["",{"children":["(marketing)",{"children":["guides",{"children":["eu-ai-act-article-12-ai-agents",{"children":["__PAGE__",{},[["$L1",["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$3"}}],["$","$L4",null,{"className":"page-y","children":["$","article",null,{"className":"prose-omem max-w-3xl","children":[["$","div",null,{"className":"tech-label mb-3","children":"Guide"}],["$","h1",null,{"className":"display text-3xl","children":"EU AI Act Article 12 for AI agents: what to log, with working code"}],["$","p",null,{"className":"lede","children":"Since August 2026, the EU AI Act’s high-risk obligations are enforceable, and Article 12 is the one that lands on engineering: the system must automatically record events over its lifetime, the record has to hold up to after-the-fact verification, and it must be kept for at least six months. This guide covers what that means for AI agents specifically, why ordinary logs fail the reading, and a working, self-hosted implementation. It is written by a builder, not a lawyer, and it is not legal advice."}],["$","h2",null,{"children":"What does Article 12 actually require?"}],["$","p",null,{"children":"Read plainly, Article 12 requires high-risk AI systems to technically allow the automatic recording of events (logs) over the system’s lifetime, and those logs must make three things possible: identifying situations where the system may present a risk, supporting post-market monitoring, and monitoring the system’s operation. The companion duties in Articles 19 and 26 make providers and deployers keep those logs for at least six months, longer where other law applies."}],["$","p",null,{"children":["Two words in that reading carry most of the weight for agents:",["$","em",null,{"children":" events"}],", and ",["$","em",null,{"children":"verification"}],". An agent’s consequential event is not “an HTTP request happened”. It is “the agent decided to do something, on the basis of what it believed”. And a record you cannot verify after the fact, because the system could have rewritten it, is a diary, not evidence."]}],["$","h2",null,{"children":"Why do ordinary logs fail for agents?"}],["$","ul",null,{"children":[["$","li",null,{"children":[["$","strong",null,{"children":"They record actions, not reasons."}]," The regulator question, and the client security review question, is why the agent acted. If the memory that produced the intent overwrote its own history when facts changed, the reason is unrecoverable."]}],["$","li",null,{"children":[["$","strong",null,{"children":"They lose the conflict."}]," When two sources disagreed and the system silently picked a winner, the log shows the winner acting and nothing else. The risky situation Article 12 wants identifiable is exactly that disagreement, and it is gone."]}],["$","li",null,{"children":[["$","strong",null,{"children":"They are editable."}]," A mutable store fails the verification reading. The record needs to be append-only, and ideally provably so."]}],["$","li",null,{"children":[["$","strong",null,{"children":"They collide with GDPR instead of coexisting."}]," ","Article 12 wants retention; GDPR wants erasure on request. A record that cannot execute a real deletion without destroying its own verifiability fails one law to satisfy the other."]}]]}],["$","h2",null,{"children":"The four properties a compliant agent record needs"}],["$","p",null,{"children":"Strip the legal text to engineering requirements and you get four properties. Each maps to a concrete mechanism below."}],["$","ul",null,{"children":[["$","li",null,{"children":[["$","strong",null,{"children":"Reconstructable belief:"}]," what did the agent believe at the moment it acted, with provenance per belief."]}],["$","li",null,{"children":[["$","strong",null,{"children":"Preserved conflict:"}]," when sources disagreed, both sides on record, with which one was believed."]}],["$","li",null,{"children":[["$","strong",null,{"children":"Named authority:"}]," who approved a risky action, recorded with the decision, refusals included."]}],["$","li",null,{"children":[["$","strong",null,{"children":"Tamper evidence:"}]," proof the record was not quietly rewritten afterwards."]}]]}],["$","h2",null,{"children":"A working implementation"}],["$","p",null,{"children":["The following runs on your own infrastructure with"," ",["$","span",null,{"className":"mono","children":"pip install omem-infrastructure"}],". OMEM is an open-source (MIT) memory and accountability layer for agents; each block below is the mechanism for one property."]}],["$","$L5",null,{"label":"Reconstructable belief, with provenance","single":"from omem import Memory\nmem = Memory(api_key=\"omem_sk_...\", project=\"proj_...\",\n             base_url=\"http://127.0.0.1:8787\")\n\na = mem.remember(\"agent:claims-bot\", \"case:1042\",\n                 \"eligible_for_fast_track\")\n\nmem.why(a[\"id\"])\n# -> who asserted it, when, the evidence chain, and anything\n#    on record that contradicts it. This is the exportable\n#    answer to \"why did it act\".\n\n# the agent acted last Tuesday; reconstruct last Tuesday\nmem.recall(about=\"case:1042\", as_of=\"2026-08-25T14:00:00Z\")"}],["$","$L5",null,{"label":"Preserved conflict","single":"mem.remember(\"agent:intake\", \"case:1042\",\n             \"not:eligible_for_fast_track\")\n\nmem.conflicts()\n# -> both claims, each with source and recency. Nothing was\n#    overwritten. The \"risky situation\" Article 12 wants\n#    identifiable is exactly this, and it stays identifiable."}],["$","$L5",null,{"label":"Named authority over risky actions","single":"result = mem.healing.handle(\n    error={\"component\": \"payout\", \"error_type\": \"AuthError\"},\n    plan={\"actions\": [{\"type\": \"reload_config\"},\n                      {\"type\": \"exec_shell\"}]})\n\nresult[\"status\"]     # \"denied\" - nothing executed\nresult[\"decisions\"]  # per action: permitted / refused, with reason\n# High-risk actions wait for a NAMED approver; the approval and\n# every refusal are recorded alongside the beliefs behind them."}],["$","p",null,{"children":[["$","strong",null,{"children":"Tamper evidence"}]," is structural rather than an API call: the record is an append-only operations log, and the engine that interprets it is frozen. It must replay the log to a byte-identical state, and that replay is verified continuously (a CI test also tampers with one operation and requires the check to fail, so the proof is proven able to fail). An upgrade cannot rewrite recorded history."]}],["$","p",null,{"children":[["$","strong",null,{"children":"And the GDPR coexistence:"}]," erasure is a real, first-class operation, not a soft delete. One request rewrites the person’s data out of the record, replay-verified before anything is touched; what remains is a hash, counts, and a date. So the record satisfies retention and lawful deletion at the same time."]}],["$","h2",null,{"children":"Frequently asked questions"}],[["$","div","Does the EU AI Act require logging for AI agents?",{"children":[["$","h3",null,{"children":"Does the EU AI Act require logging for AI agents?"}],["$","p",null,{"children":"For high-risk AI systems, yes. Article 12 requires the system to technically allow automatic recording of events over its lifetime, and the logs must make it possible to identify risky situations, support post-market monitoring, and monitor operation. Providers and deployers must keep the logs, at least six months under Articles 19 and 26, longer if other law such as GDPR applies."}]]}],["$","div","Are ordinary application logs enough for Article 12?",{"children":[["$","h3",null,{"children":"Are ordinary application logs enough for Article 12?"}],["$","p",null,{"children":"Usually not for agents. A log line records that an action happened, but an agent's consequential event is why it believed the action was right. If the memory behind the agent overwrites facts on conflict, the state that explains a past decision is gone, and the record cannot support the after-the-fact verification the article expects."}]]}],["$","div","How long must AI agent logs be kept under the EU AI Act?",{"children":[["$","h3",null,{"children":"How long must AI agent logs be kept under the EU AI Act?"}],["$","p",null,{"children":"At least six months, per Article 19 for providers and Article 26 for deployers, and longer where other applicable law requires it. GDPR can also require deletion of personal data, so the record needs to support both retention and lawful erasure at once."}]]}],["$","div","What should an AI agent audit log contain?",{"children":[["$","h3",null,{"children":"What should an AI agent audit log contain?"}],["$","p",null,{"children":"Four things, at minimum: what the agent believed at the moment it acted and where each belief came from; what conflicted and which side was believed; who authorised any risky action, by name; and enough integrity protection that the record can be shown not to have been quietly rewritten afterwards."}]]}]],["$","h2",null,{"children":"The honest caveats"}],["$","p",null,{"children":"Whether your agent is a high-risk system under the Act is a legal classification that depends on what it does; ask a lawyer, not a README. And no tool makes a system compliant by itself: Article 12 sits inside a wider set of obligations (risk management, human oversight, documentation). What a builder controls is whether the technical record can support those obligations at all. That is the part this page, and OMEM, is about."}],["$","div",null,{"className":"mt-10 flex flex-wrap gap-3","children":[["$","$L6",null,{"href":"/docs/quickstart","children":"Run it locally in a minute"}],["$","$L6",null,{"href":"/accountability","variant":"secondary","children":"The accountability overview"}],["$","$L6",null,{"href":"/pilot","variant":"quiet","children":"Get it wired into your stack"}]]}]]}]}]]}],null],null],null]},[null,["$","$L7",null,{"parallelRouterKey":"children","segmentPath":["children","(marketing)","children","guides","children","eu-ai-act-article-12-ai-agents","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined"}]],null]},[null,["$","$L7",null,{"parallelRouterKey":"children","segmentPath":["children","(marketing)","children","guides","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined"}]],null]},[null,["$","$L7",null,{"parallelRouterKey":"children","segmentPath":["children","(marketing)","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":"404"}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],"notFoundStyles":[]}]],null]},[[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/52528bb155a8eade.css","precedence":"next","crossOrigin":"$undefined"}]],["$","html",null,{"lang":"en","className":"__variable_8adcd2 __variable_46451f","suppressHydrationWarning":true,"children":[["$","head",null,{"children":[["$","script",null,{"dangerouslySetInnerHTML":{"__html":"(function(){try{\nvar s=localStorage.getItem(\"omem-theme\");\nvar d=s?s===\"dark\":window.matchMedia(\"(prefers-color-scheme: dark)\").matches;\nif(d)document.documentElement.classList.add(\"dark\");\ndocument.documentElement.style.colorScheme=d?\"dark\":\"light\";\n}catch(e){}})();"}}],["$","script",null,{"defer":true,"src":"https://static.cloudflareinsights.com/beacon.min.js","data-cf-beacon":"{\"token\": \"92eda3437ae944c99c0f668453ae69f3\"}"}]]}],["$","body",null,{"children":[["$","a",null,{"href":"#main","className":"skip-link","children":"Skip to content"}],["$","$L9",null,{"children":["$","$La",null,{"children":["$","$L7",null,{"parallelRouterKey":"children","segmentPath":["children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":"$b","children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":"$c","children":"404"}],["$","div",null,{"style":"$d","children":["$","h2",null,{"style":"$e","children":"This page could not be found."}]}]]}]}]],"notFoundStyles":[]}]}]}]]}]]}]],null],null],["$Lf",null]]]]
f:[["$","meta","0",{"name":"viewport","content":"width=device-width, initial-scale=1, viewport-fit=cover"}],["$","meta","1",{"name":"theme-color","media":"(prefers-color-scheme: light)","content":"#faf9f6"}],["$","meta","2",{"name":"theme-color","media":"(prefers-color-scheme: dark)","content":"#171614"}],["$","meta","3",{"charSet":"utf-8"}],["$","title","4",{"children":"EU AI Act Article 12 for AI agents: what to log, with working code / OMEM"}],["$","meta","5",{"name":"description","content":"Article 12 requires high-risk AI systems to automatically record events over their lifetime, verifiable after the fact and kept at least six months. What that means for AI agents in practice, why ordinary logs fail the reading, and a working self-hosted implementation."}],["$","meta","6",{"name":"application-name","content":"OMEM"}],["$","link","7",{"rel":"canonical","href":"https://infrastructure.omem-cloud.com/guides/eu-ai-act-article-12-ai-agents/"}],["$","meta","8",{"name":"format-detection","content":"telephone=no"}],["$","meta","9",{"property":"og:title","content":"OMEM / accountability for the AI agents you ship"}],["$","meta","10",{"property":"og:description","content":"OMEM keeps AI agents answerable: an audit trail of what the agent believed and when, and a human approval gate before a risky action runs. Built on a belief-revision engine that keeps contradictions and proves provenance. Self-hosted, MIT, no dependencies."}],["$","meta","11",{"property":"og:url","content":"https://infrastructure.omem-cloud.com/"}],["$","meta","12",{"property":"og:site_name","content":"OMEM"}],["$","meta","13",{"property":"og:image","content":"https://infrastructure.omem-cloud.com/icon.png"}],["$","meta","14",{"property":"og:type","content":"website"}],["$","meta","15",{"name":"twitter:card","content":"summary"}],["$","meta","16",{"name":"twitter:title","content":"OMEM / accountability for the AI agents you ship"}],["$","meta","17",{"name":"twitter:description","content":"OMEM keeps AI agents answerable: an audit trail of what the agent believed and when, and a human approval gate before a risky action runs. Built on a belief-revision engine that keeps contradictions and proves provenance. Self-hosted, MIT, no dependencies."}],["$","meta","18",{"name":"twitter:image","content":"https://infrastructure.omem-cloud.com/icon.png"}],["$","link","19",{"rel":"icon","href":"/icon.png?2085097fd5dec5e8","type":"image/png","sizes":"512x512"}],["$","link","20",{"rel":"apple-touch-icon","href":"/apple-icon.png?75e7810ff587c16c","type":"image/png","sizes":"180x180"}],["$","meta","21",{"name":"next-size-adjust"}]]
1:null
