Article 19 Automatically generated logs

This article establishes the log retention obligations for providers of high-risk AI systems, building directly on Article 12, which requires those systems to be capable of automatically generating logs in the first place.

Here, the focus shifts to how long those logs must be kept.

The retention obligation only applies to logs that are actually under the provider's control, and a minimum retention period of six months is set, subject to any overriding Union or national law, including data protection rules.

A carve-out is also provided for providers that are financial institutions, who may fold their log retention into their existing documentation obligations under Union financial services law.

Important points:

• Retain the automatically generated logs of your high-risk AI systems for a minimum of six months, to the extent those logs are under your control.
• The six-month minimum can be overridden by applicable Union or national law, including Union data protection law.
• Providers that are financial institutions subject to Union financial services law can satisfy this obligation by maintaining the logs as part of their documentation under that law.