EU AI Act record-keeping: what Annex III actually requires by December 2027
July 12, 2026 · the looptail team
The Digital Omnibus moved the high-risk deadline to 2 December 2027 and everyone exhaled. Wrong reaction. The 16 months are not a reprieve — they are the window in which record-keeping gets designed, procured, and made routine. Here is what the obligations actually say, read as a builder, not a lawyer.
Scope first: this applies to you if you provide or deploy a standalone high-risk system under Annex III — hiring and worker-management tools, credit scoring, insurance pricing, education assessment, essential-services access, and adjacent categories. HR tech is named explicitly. If your AI is embedded in a regulated product instead, your date is 2 August 2028. Article 50 transparency duties — telling people they're talking to a machine — land earlier, on 2 August 2026.
Obligation one: automatic logs, per decision
Article 12 requires high-risk systems to automatically record events over their lifetime — enough to reconstruct each period of use, identify risky situations, and support post-market monitoring. Deployers must keep those logs. Two words carry the weight. "Automatically" rules out best-effort logging bolted on by convention: if an engineer can forget to log a decision, the system does not comply. And "lifetime" rules out 30-day trace retention as your only store.
Obligation two: watch it after you ship
Article 72 requires a post-market monitoring system: evidence you are observing live performance, not just pre-deployment benchmarks. In practice this means continuous evaluation of production traffic against your own standards, with failures tracked to resolution. A static test set you wrote at launch does not monitor anything — it rots while the system and its traffic drift.
Obligation three: document what you changed
This is the one that catches good teams. The Act expects the system's technical documentation to stay current across its lifetime, which means every consequential change — prompt, model swap, routing policy — needs a record of what changed, why, and with what effect. And the sleeper clause makes it unavoidable: systems already on the market are grandfathered until substantially modified. A system that improves every month is a system marching toward that line. Continuous improvement without documented change control is how you lose grandfathering with nothing to show an auditor.
What "compliant record-keeping" looks like as software
- Per-decision records, written automatically in the request path — inputs, context, output, outcome.
- Tamper-evidence — append-only, hash-chained, signed, so the record is credible to someone who doesn't trust you.
- Linkage — the decision, its evaluation, and the change it motivated reference each other.
- Retention and export — evidence you can keep for years and hand over in a format an auditor can verify independently.
That artifact has a name: an audit trail. It is exactly what Looptail's SDKs write for every loop, and the record-keeping tooling that generic observability platforms treat as an afterthought — see our honest comparison withLangfuse for where dashboards stop and evidence begins.
The calm version of the next 17 months
Stand up automatic per-decision records now (it takes minutes, not quarters). Put continuous evaluation on your live traffic so post-market monitoring is a report, not a scramble. Route changes through gates that record evidence as a by-product. Then December 2027 is a date on a calendar, not a deadline.
A builder's summary, not legal advice.
FAQ
When do the EU AI Act record-keeping obligations apply?
For standalone high-risk (Annex III) systems, from 2 December 2027, per the Digital Omnibus adopted 29 June 2026. High-risk AI embedded in regulated products follows on 2 August 2028, and Article 50 transparency duties apply from 2 August 2026.
What logging does the Act actually require?
High-risk systems must automatically record events over their lifetime (Article 12) with enough detail to identify situations that present risk and to support post-market monitoring — and deployers must retain those logs. Manual, best-effort logging does not meet the "automatic" bar.
What is a "substantial modification"?
A change to an AI system beyond what the provider planned that affects compliance or intended purpose. It matters because grandfathered systems lose their exemption when substantially modified — a system you keep improving will eventually cross that line, so documented change control is unavoidable for improving systems.
Do observability tools satisfy Article 12?
They help, but tracing dashboards are typically mutable, retention-limited, and disconnected from change management. Record-keeping obligations point toward evidence-grade records: automatic, per-decision, tamper-evident, retained, and linked to the changes that followed. That is an audit trail, not a dashboard.