Engineering · Evidence
The evidence chain
Five provisions in three chapters, read as one pipeline. Written for the team that runs the system on its own infrastructure and controls the logs, because that team is the one the Regulation keeps addressing and almost nobody writes for.
The incident you cannot reconstruct
A customer disputes a decision your system made four months ago. You still have the model, the code and a dashboard. What you may not have is the record of that decision: which model version, on which input, with which output, seen by whom. That gap is what this chain exists to close, and every provision below is a piece of it.
Five provisions, one pipeline
Read separately, Articles 12, 19, 26(6), 72 and 73 are five obligations in three different chapters. Read from the operator’s chair, they are one pipeline with a single output: the ability to answer, months later, why one system produced one result on one date, and to prove the answer. Everything below follows that order.
| Step | What the provision asks for | Where |
|---|---|---|
| Record | The system technically allows automatic recording of events over its lifetime | Art. 12 |
| Keep | The provider keeps the logs it controls, at least six months; the deployer keeps the logs it controls, on the same floor | Art. 19, Art. 26(6) |
| Document | Technical documentation exists before the system is placed on the market, and stays at the disposal of authorities for ten years | Art. 11, Annex IV, Art. 18 |
| Monitor | A documented post-market monitoring system, based on a plan that is part of the technical documentation | Art. 72 |
| Report | Serious incidents reach the market surveillance authority inside the clocks the article sets | Art. 73 |
Record: what Article 12 asks a system to allow
Article 12 does not tell you to keep logs. It says a high-risk system shall technically allow for the automatic recording of events over its lifetime, and that the logging capabilities shall enable recording the events relevant for three named purposes: identifying situations where the system presents a risk within the meaning of Article 79(1) or amounts to a substantial modification, facilitating the post-market monitoring of Article 72, and monitoring the operation under Article 26(5). For remote biometric identification systems, Article 12(3) adds a minimum list: the period of each use, the reference database checked against, the input data that produced a match, and the identity of the people who verified the result.
One way to satisfy it
- One inference event per decision, carrying a correlation ID that survives every hop between services.
- Model and prompt versions, input references and output, recorded as fields rather than reconstructed from a dashboard.
- OpenTelemetry traces for the request path, and the application log for the decision itself: the trace explains latency, the event explains the outcome.
- Kubernetes audit logs for who changed the system, which is a different question from what the system did.
Engineering practice, not a statutory demand. The column on the left is the law.
Worth knowing The words "tamper-evident" do not appear in Article 12. Integrity is a good engineering answer to a real risk, not a statutory demand.
Keep: who holds the logs, and for how long
Two provisions, one floor, two custodians. Article 19 makes the provider keep the Article 12(1) logs its systems generate automatically, to the extent those logs are under its control, for a period appropriate to the intended purpose and of at least six months. Article 26(6) says the same to the deployer, for the logs under its control. If you run the system on your own infrastructure, the logs are under your control, and the sentence is about you. The floor is a minimum, and other Union or national law, in particular data protection law, can change the answer in either direction.
One way to satisfy it
- Decide custody before retention: which logs are yours because they never leave your cluster, and which the vendor holds.
- Object storage with a retention policy that outlives the six-month floor, and an explicit reason wherever you keep less.
- A deletion path that survives an erasure request without destroying the evidence you are required to keep, agreed with whoever owns data protection.
- A restore drill: a retention policy nobody has ever read back is a claim, not evidence.
Engineering practice, not a statutory demand. The column on the left is the law.
Worth knowing Article 18 is a different clock for a different object: technical documentation stays at the disposal of national competent authorities for ten years, and that is documentation, not logs.
Document: the file that has to exist before you ship
Article 11 requires the technical documentation of a high-risk system to be drawn up before the system is placed on the market or put into service, and kept up to date. It must demonstrate compliance with the Chapter III Section 2 requirements and contain at least the elements of Annex IV. SMEs, including start-ups, and SMCs may supply those elements in a simplified form. Article 18 then keeps that file, the quality management documentation, the notified body decisions and the EU declaration of conformity at the disposal of national competent authorities for ten years.
One way to satisfy it
- Generate what you can from the repository: model cards, evaluation results and data lineage age badly when they are maintained by hand.
- Version the documentation with the system, so that "the documentation as it stood at that release" is a checkout, not an archaeology project.
- Keep the post-market monitoring plan in the same file, because Article 72(3) puts it in the Annex IV documentation.
Engineering practice, not a statutory demand. The column on the left is the law.
Monitor: post-market monitoring is a system, not a dashboard
Article 72 makes the provider establish and document a post-market monitoring system, proportionate to the technology and the risks, which actively and systematically collects, documents and analyses data on the performance of its high-risk systems throughout their lifetime, including data that deployers provide. The point of the exercise is stated in the text: to evaluate continuous compliance with the Chapter III Section 2 requirements. The system rests on a plan, and that plan is part of the Annex IV technical documentation.
One way to satisfy it
- Route the deployer signal deliberately: Article 26(5) sends information from the deployer to the provider, and someone has to own the inbox.
- Monitor for drift against the requirements, not only for uptime: accuracy, robustness and the behaviour the risk file predicted.
- Keep the analysis, not only the alert. The article asks for data collected, documented and analysed.
Engineering practice, not a statutory demand. The column on the left is the law.
Report: the clocks that start when you find out
Article 73 makes the provider report any serious incident to the market surveillance authorities of the Member State where it occurred. The clock starts when the provider, or where applicable the deployer, becomes aware of it, and the article sets three different limits. An incomplete initial report followed by a complete one is explicitly allowed where that is needed to report in time, and after reporting the provider investigates, assesses the risk and takes corrective action.
| Situation | Deadline | Where |
|---|---|---|
| A serious incident, in general | Immediately after establishing a causal link or its reasonable likelihood, and no later than 15 days after becoming aware | Art. 73(2) |
| A widespread infringement, or an incident under Article 3(49)(b) | Immediately, and no later than 2 days | Art. 73(3) |
| The death of a person | Immediately after establishing or suspecting a causal relationship, and no later than 10 days | Art. 73(4) |
One way to satisfy it
- Rehearse the reconstruction before you need it: the incident report is written from the logs the first two steps produced.
- Put the clock in the on-call runbook. Fifteen days is generous until the first week goes into deciding who owns the decision.
- Agree with your vendors, in writing, how fast they tell you: your clock starts when you become aware, and their silence does not pause it.
Engineering practice, not a statutory demand. The column on the left is the law.
Worth knowing Commission guidance on Article 73 is still in draft. Where this site relies on it, the citation carries a draft chip.
What this page does not decide
- Whether these obligations apply to your system at all. That is a classification question, and it is answered before this page, not on it.
- How you should build it. The practice column is one way to satisfy the provision, drawn from platforms we operate. It is not the only way and it is not law.
- Anything resembling legal advice. AstroKube engineers maintain this reference against primary sources; we are engineers, not lawyers.