# Article 12 in practice, for engineers

> The record keeping duty is short, vague and dated for 2 December 2027. Here is what it actually asks of a system that lets agents write to production.

2026-06-25. 9 min. Source: https://www.voidagent.tech/blog/article-12-in-practice

Article 12 of the EU AI Act requires high risk systems to automatically record events over their lifetime, to a degree appropriate to the purpose of the system. That is the whole substance. Everything else is interpretation.

The date has moved once. Regulation (EU) 2026/1744, in force since 27 July 2026, deferred the Annex III high risk obligations from 2 August 2026 to 2 December 2027. The obligation did not change, only when it bites, and the Article 50 transparency duties were not deferred at all.

Interpretation is where engineering teams lose months, because the obvious answer, keep the logs, is both technically easy and legally weak. Unsigned application logs are mutable by anyone with write access, have no ordering guarantee across services, and cannot demonstrate that an entry existed at a given time.

<a id="article-12-in-practice-what-a-defensible-record-needs"></a>
## What a defensible record needs

- Ordering that survives a service being restarted or replaced.
- Tamper evidence, so a missing or edited entry is detectable rather than merely unlikely.
- Enough context to reconstruct why an action was taken, not only that it was.
- A retention story that matches the retention obligation, including redaction of personal data.

A hash chained, signed ledger gives you the first two almost for free. Each entry references the hash of the previous one, so removing an entry breaks the chain, and the workspace signature makes forging a replacement chain require the key.

```
{
  "sequence": 1042,
  "intent": "issue_refund",
  "class": "R3",
  "approved_by": "dana@acme.example",
  "prev_hash": "0x9f3c...",
  "signature": "ed25519:a10e..."
}
```

The third point, context, is where the agent case differs from classic audit logging. A refund is not interesting on its own. It becomes interesting when you can see the intent that produced it, the blast radius that was computed, the policy decision, the human who approved, and whether a compensation was later executed.

This is informational and not legal advice. Talk to your counsel about how the duty applies to your deployment.

---

This document is the markdown form of https://www.voidagent.tech/blog/article-12-in-practice, published for agents that read
text rather than a rendered page. It is generated from the same data the page
renders, so the two cannot disagree. Tag: `compliance`.