AI Governance Engineer
GitHub

EU AI Act Art. 19: automatically generated logs kept by the provider

Keep the automatically generated logs under the provider's control for a period appropriate to the intended purpose, at least six months unless other law provides otherwise

By Reviewed

From clause to evidenceThe chain from EU AI Act Art. 19 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseEU AI ActArt. 19Duty holderProviderApplies from2027-12-02DeferredArtefactLog-retentionpolicy as codeLayersLayer 04Layer 05Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from EU AI Act Art. 19 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseEU AI Act · Art. 19Duty holderProviderApplies from2027-12-02 · DeferredArtefactLog-retention policy as codeLayersLayer 04Layer 05Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-EUAIA-ART19. Drawn from chapter 08.
Text alternative
  • Clause: EU AI Act, Art. 19.
  • Duty holder: Provider.
  • Applies from: 2027-12-02, Deferred.
  • Artefact: Log-retention policy as code.
  • Layers: Layer 04, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
Id
AIGE-OBL-EUAIA-ART19
Instrument
EU AI Act (post-Omnibus) law
Compared side by side
ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act
Clause
Art. 19
Duty holder
Provider
Authority
National MSA
Applies from
Deferred · Annex III
Later dates
  • Applies to Annex I embedded (product safety-component) systems
  • Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))
System class
High-risk (Annex III) · High-risk (Annex I)

The artefact that evidences it

Log-retention policy as code (at least six months, set by intended purpose); tamper-evident log store.

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

Source

Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). EU AI Act Art. 19: automatically generated logs kept by the provider (AIGE-OBL-EUAIA-ART19). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art19. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{EU AI Act Art. 19: automatically generated logs kept by the provider (AIGE-OBL-EUAIA-ART19)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art19},
  note         = {Version 0.5.0}
}