Logs you may have to keep
AI agent audit logs: what the EU AI Act says to record and keep
Updated
Before an agent's logs are licensed, a company should know which of them a regulator may expect it to still hold.
Ask about my agent logs 6 of the 19 agent platforms we read write that they will not train on what you send. Tell us where your traces sit and we will write back about yours, as a licence, a closing company's sale, or an introduction through your adviser.
Logging by design
Article 12 of the AI Act says high-risk AI systems shall technically allow for the automatic recording of events over the lifetime of the system. Since Regulation (EU) 2026/1744 amended Article 113, that duty applies from 2 December 2027 for systems listed in Annex III and 2 August 2028 for those under Annex I.
Source: Agent log law
Six months, at least
From the same dates, Article 19 makes providers keep those automatically generated logs, to the extent they control them, for a period appropriate to the system's purpose and at least six months; Article 26 puts the same duty on deployers, subject to other law, in particular data protection law.
Source: Agent log law
Who counts as a deployer
Article 3 defines a deployer as anyone using an AI system under its authority, other than in a personal, non-professional activity, so a company running an agent for its own work is one.
Source: Agent log law
A US state with written rules
California's privacy regulator adopted rules giving consumers rights to access and opt out of businesses' use of automated decisionmaking technology, effective from 1 January 2026.
Source: Agent log law
On this site next
Whether the model APIs your agents call keep or train on that data is on LLM agent traces.