EU AI Act — Article 12 (automatic event logs)

How Aira satisfies the Article 12 automatic logging obligation — what the report covers, what the retention window is, and how to generate, verify, and share it.

Article 12 of Regulation (EU) 2024/1689 requires providers of high-risk AI systems to automatically record events relevant to identifying incidents, monitoring operation, and substantiating compliance. The logs must enable traceability of the system's functioning throughout its lifetime and be retained for at least six months (or longer under sectoral law).

Aira's eu_ai_act_art12 report renders those logs as a signed PDF technical file — one entry per receipt in the period, grouped by agent, with the Annex VII field mapping each Article 12 requirement expects.

What's in the report

Annex VII field	Aira source
Period of use	`period_start` / `period_end` on the report row
Input data hash	`agent_action.action_details_hash`
Output data hash	`agent_action.outcome_hash`
System identifier	`agent_action.agent_id` + `agent_version`
Model identifier	`agent_action.model_id` + `model_version`
Instruction hash	`agent_action.instruction_hash`
Natural persons in the loop	`human_authorization.authorizer_email`
Policy decision chain	`action_receipt.authorization_ref`
Tamper evidence	Ed25519 signature + RFC 3161 timestamp

The PDF also includes an operator summary: total actions, distinct agents, distinct models, status breakdown. All counters are pinned into the signed descriptor — if a reader changes any number, the verify endpoint reports a mismatch.

Retention

Aira retains the full report row (PDF + signature + metadata) for six years (report_metadata.retention_requirement_years = 6) by default. This matches the strictest interpretation of the Article 12 six-month minimum combined with Article 19's longer retention for documents provided to authorities.

Generate

from aira import Aira, FRAMEWORK_ART12

client = Aira(api_key="aira_live_...")

report = client.create_compliance_report(
    framework=FRAMEWORK_ART12,
    period_start="2026-01-01T00:00:00Z",
    period_end="2026-03-31T23:59:59Z",
)
pdf = client.download_compliance_report(report.id)
open("article-12-q1.pdf", "wb").write(pdf)

import { Aira, FRAMEWORK_ART12 } from "aira-sdk";

const aira = new Aira({ apiKey: "aira_live_..." });

const report = await aira.createComplianceReport({
  framework: FRAMEWORK_ART12,
  periodStart: "2026-01-01T00:00:00Z",
  periodEnd: "2026-03-31T23:59:59Z",
});
const pdf = await aira.downloadComplianceReport(report.id);

curl -X POST https://api.airaproof.com/api/v1/compliance/reports \
  -H "Authorization: Bearer $AIRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "framework": "eu_ai_act_art12",
    "period_start": "2026-01-01T00:00:00Z",
    "period_end": "2026-03-31T23:59:59Z"
  }'

agent_filter (a string array of agent ids) restricts the period selection. Omit it to include every agent in the org.

Size limits

A single Article 12 report tops out at 100,000 receipts by default. Periods with more throughput must be split into smaller windows or switch to a Compliance Bundle — bundles scale by Merkle commitment instead of by per-receipt PDF rendering.

Verify

curl https://api.airaproof.com/api/v1/compliance/reports/{id}/verify \
  -H "Authorization: Bearer $AIRA_API_KEY"

Returns { valid, checks: { content_hash_matches, signature_valid }, descriptor }. The descriptor is the structure Aira signed — recompute its canonical JSON, SHA-256 it, and check against the PDF bytes' hash to reproduce the result offline.

Pairing with other reports

Article 9 — required alongside Article 12. See eu-ai-act-article-9.
Annex IV — the top-level technical documentation that references Article 12 and Article 9 as evidence. See annex-iv.
Article 6 — per-action explanation on demand. See eu-ai-act-article-6.