The law on keeping and passing on AI agent logs
8 provisions of EU, UK and US state law and guidance on recording, keeping and disclosing what AI systems do, each quoted from the authority's own page, read 28 October 2026.
Whose law it is
What the provision settles
The rule, in its own words
Each provision, answer by answer
A provision per row. Every answer opens onto the line it comes from, quoted exactly, with the page it sits in and the day of the read. "Not stated" marks a question the page leaves unanswered.
| Provision | Whose law it is | What the provision settles | The rule, in its own words |
|---|---|---|---|
| California ADMT regulations | California | safeguards on automated decisions and the records kept | implemented requirements for certain businesses to conduct risk assessments and complete… |
| EU AI Act, Article 12 | the European Union | what must be logged automatically | logging capabilities shall enable the recording of events relevant for: |
| EU AI Act, Article 19 | the European Union | who keeps the logs and for how long | the logs shall be kept for a period appropriate to the intended purpose of the high-risk… |
| EU AI Act, Article 26(6) | the European Union | who keeps the logs and for how long | for a period appropriate to the intended purpose of the high-risk AI system, of at least… |
| EU AI Act, Article 3 | the European Union | what counts as an AI system or a deployer | ‘deployer’ means a natural or legal person, public authority, agency or other body using… |
| EU AI Act, Article 50(1) | the European Union | what people dealing with an AI system must be told | Providers shall ensure that AI systems intended to interact directly with natural persons… |
| Regulation (EU) 2026/1744, Article 113 dates | the European Union | when the provisions start to apply | 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2)… |
| UK GDPR, Article 30 | the United Kingdom | who keeps the logs and for how long | Each controller and, where applicable, the controller's representative, shall maintain a… |
The 24 sentences the answers come from
- California ADMT regulations, CPPA: CCPA updates and ADMT regulations, read 2026-10-08, Whose law it is:
the California Privacy Protection Agency (Agency) Board adopted regulations
- California ADMT regulations, CPPA: CCPA updates and ADMT regulations, read 2026-10-08, What the provision settles:
implemented consumers' rights to access and opt–out of businesses' use of ADMT
- California ADMT regulations, CPPA: CCPA updates and ADMT regulations, read 2026-10-08, The rule, in its own words:
implemented requirements for certain businesses to conduct risk assessments and complete annual cybersecurity audits
- EU AI Act, Article 12, Article 12, AI Act Service Desk, read 2026-10-28, Whose law it is:
Article 12: Record-keeping
- EU AI Act, Article 12, Article 12, AI Act Service Desk, read 2026-10-28, What the provision settles:
High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system.
- EU AI Act, Article 12, Article 12, AI Act Service Desk, read 2026-10-28, The rule, in its own words:
logging capabilities shall enable the recording of events relevant for:
- EU AI Act, Article 19, Article 19, AI Act Service Desk, read 2026-10-28, Whose law it is:
Article 19: Automatically generated logs
- EU AI Act, Article 19, Article 19, AI Act Service Desk, read 2026-10-28, What the provision settles:
Providers of high-risk AI systems shall keep the logs referred to in Article 12(1), automatically generated by their high-risk AI systems, to the extent such logs are under their control.
- EU AI Act, Article 19, Article 19, AI Act Service Desk, read 2026-10-28, The rule, in its own words:
the logs shall be kept for a period appropriate to the intended purpose of the high-risk AI system, of at least six months
- EU AI Act, Article 26(6), Article 26, AI Act Service Desk, read 2026-10-28, Whose law it is:
Article 26: Obligations of deployers of high-risk AI systems
- EU AI Act, Article 26(6), Article 26, AI Act Service Desk, read 2026-10-28, What the provision settles:
Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control
- EU AI Act, Article 26(6), Article 26, AI Act Service Desk, read 2026-10-28, The rule, in its own words:
for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data.
- EU AI Act, Article 3, Article 3, AI Act Service Desk, read 2026-10-28, Whose law it is:
‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy
- EU AI Act, Article 3, Article 3, AI Act Service Desk, read 2026-10-28, What the provision settles:
infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments
- EU AI Act, Article 3, Article 3, AI Act Service Desk, read 2026-10-28, The rule, in its own words:
‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity
- EU AI Act, Article 50(1), Article 50, AI Act Service Desk, read 2026-10-28, Whose law it is:
Article 50: Transparency obligations for providers and deployers of certain AI systems
- EU AI Act, Article 50(1), Article 50, AI Act Service Desk, read 2026-10-28, What the provision settles:
the natural persons concerned are informed that they are interacting with an AI system
- EU AI Act, Article 50(1), Article 50, AI Act Service Desk, read 2026-10-28, The rule, in its own words:
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system
- Regulation (EU) 2026/1744, Article 113 dates, Official Journal text, EUR-Lex, read 2026-10-28, Whose law it is:
Article 113 of Regulation (EU) 2024/1689 establishes the dates of entry into force and application of that Regulation
- Regulation (EU) 2026/1744, Article 113 dates, Official Journal text, EUR-Lex, read 2026-10-28, What the provision settles:
2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I;
- Regulation (EU) 2026/1744, Article 113 dates, Official Journal text, EUR-Lex, read 2026-10-28, The rule, in its own words:
2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
- UK GDPR, Article 30, UK GDPR Article 30, records of processing activities, read 2026-10-28, Whose law it is:
There are currently no known outstanding effects by UK legislation for Regulation (EU) 2016/679 of the European Parliament and of the Council, Article 30.
- UK GDPR, Article 30, UK GDPR Article 30, records of processing activities, read 2026-10-28, What the provision settles:
Each processor and, where applicable, the processor's representative shall maintain a record of all categories of processing activities carried out on behalf of a controller
- UK GDPR, Article 30, UK GDPR Article 30, records of processing activities, read 2026-10-28, The rule, in its own words:
Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility.
Read and excluded
3 named documents fell outside what this board reads once we had read them; their reasons follow. They are tallied, never scored as answers.
- UK GDPR Article 22: automated individual decision-making: the stored page carries no rule text: Article 22 was substituted by Chapter 3 Section 4A (Articles 22A to 22D) by the Data (Use and Access) Act 2025, s80(1), and the page shows only the heading and the amendment note
- ICO guidance on AI and data protection: the stored read is the guidance's landing page (navigation and headings, 8,274 characters); no rule is stated in it
- Colorado SB24-205: consumer protections for artificial intelligence: repealed and re-enacted by Colorado SB 26-189 (signed 14 May 2026, leg.colorado.gov/bills/sb26-189, read 2026-10-28: 'The act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions'), so this bill page no longer states live law
Method
Each provision's own statutes, regulations and regulator guidance were read through estate-fetch and stored whole (sha256 on every row).
For every page, three questions were answered from its own words: whose law it is, what the provision settles, the rule, in its own words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the page read does not address the question.
A provision with several pages reads 'varies' where they disagree.
8 provisions, 8 pages.
The 11 pages we read
- EU AI Act Article 3: definitions (AI Act Service Desk) (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
- EU AI Act Article 12: record-keeping (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
- EU AI Act Article 19: automatically generated logs (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
- EU AI Act Article 26: obligations of deployers (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
- EU AI Act Article 50: transparency obligations (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
- UK GDPR Article 22: automated individual decision-making (read, set aside)
- UK GDPR Article 30: records of processing activities (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
- ICO guidance on AI and data protection (read, set aside)
- California Privacy Protection Agency: CCPA updates, automated decisionmaking technology regulations (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
- Colorado SB24-205: consumer protections for artificial intelligence (read, set aside)
- Regulation (EU) 2026/1744 amending the AI Act (application dates, Article 113) (from the publisher's own statutes, regulations and regulator guidance; reproduced for comment)
Quote this figure or put it on your site
8 provisions of EU, UK and US state law and guidance on recording, keeping and disclosing what AI systems do, each quoted from the authority's own page, read 28 October 2026.
Whose law it is, by provision: the European Union 6 of 8, the United Kingdom 1 of 8, California 1 of 8 (8 provisions, read 28 October 2026).
What the provision settles, by provision: who keeps the logs and for how long 3 of 8, when the provisions start to apply 1 of 8, safeguards on automated decisions and the records kept 1 of 8, what counts as an AI system or a deployer 1 of 8, what must be logged automatically 1 of 8, what people dealing with an AI system must be told 1 of 8 (8 provisions, read 28 October 2026).
The rule, in its own words, by provision: stated 8 of 8 (8 provisions, read 28 October 2026).
Citation: "The law on keeping and passing on AI agent logs", updated 2026-10-28, https://sellagentlogstoai.com/datasets/agent-log-law/.
Download as CSV (24 answers as of 2026-10-28)