Article 12 of the EU AI Act: record-keeping and what it means for AI agents

In the debate on the EU AI Act, attention almost always goes to two articles: 14 (human oversight) and 50 (transparency). But there is a third, less cited and just as operational, that directly concerns whoever builds agents: Article 12 — record-keeping.

What it says, in practice

Article 12 states that high-risk AI systems must allow the automatic recording of events ("logs") over their lifecycle, with a level of traceability appropriate to the system's purpose. The goal is to make it possible to reconstruct how the system worked, identify risk situations and support subsequent checks.

In other words: it is not enough for the system to work. It must be able to prove what it did.

Why it is harder for agents

For deterministic software, logging is trivial: every branch of the code is predictable. For an agent based on a language model, it is not. The output cannot be traced back to an explicit rule, and the risk is to log the technical data — prompts, tokens — without recording what really matters: the decision and its basis.

A log that says "model call, 3,200 tokens, 200 OK" is useless to an auditor. What is needed is: which decision was made, on which risk dimensions, with which verdict, and whether a human reviewed it.

What a compliant record must capture

Translated into concrete requirements, a record useful for Article 12 should contain at least:

Identification — which decision, when, produced by which system and model.

Decision content — the verdict and the scores that support it.

Risk — the risk level associated with the decision.

Retention — the record must survive over time, even if the original data is modified or deleted.

This last point is often overlooked: if the registry only points to the "live" database row, a deletion makes the evidence disappear. A serious registry keeps a self-contained snapshot.

From theory to a concrete layer

The DAMM AI decision registry is designed around this logic: every decision produced via an agent generates an immutable, denormalized snapshot — which stays valid even if the original decision is removed — with verdict, scores, risk level, transparency disclosure and human-oversight status. It is queryable via API and exportable to CSV.

Article 12 does not ask you to make the agent "explainable" in an absolute sense — still an open research problem. It asks something simpler and more enforceable: that every decision leaves a retainable record. That is exactly what a decision registry provides, and one of the most direct ways to move closer to the requirements of the EU AI Act.