EU AI Act: logging, oversight and retention, mapped.
Five articles that touch agents that act. For each: what it asks, what Ares does, what the record shows, and what remains yours.
When it applies
Dates are moving, so read this first. Most sources say the obligations for high-risk systems apply from August 2026. A reported Digital Omnibus change would move standalone high-risk systems to December 2027; we have not verified that change, and you should check its status before you plan around it. Rules for general-purpose AI models apply from August 2026.
Whether your agents are high-risk depends on what they are used for. That assessment is yours.
Article by article.
Requirements are paraphrased. Read the regulation for the exact text.
| What the article asks | What Ares does | What the record shows | What remains yours | |
|---|---|---|---|---|
| Art. 12, record-keeping | High-risk systems must automatically log events over their lifetime, so their working can be traced. | Every decision is written to the record as it happens: allowed, refused, redacted or sent to a human. Nothing depends on the agent choosing to log. | Which agent acted, for whom, under which badge, what was refused or redacted and why, and when. | Deciding which systems are high-risk, and which events your use case must trace. |
| Art. 13, transparency to deployers | Providers must give deployers enough information to understand the system’s output and use it properly. | Each badge states what an agent may do for this job. Each refusal names what was outside it; each redaction names the rule that fired. | The reason behind each decision, in plain terms, next to the decision itself. | Instructions for use, the system’s intended purpose and its known limits. |
| Art. 14, human oversight | High-risk systems must be designed so people can oversee them, step in, and stop them. | Steps over a limit are sent to a human and wait. An agent’s badges can be revoked, and it stops at the door. | Who was asked, what they decided, and when. Revocations are on the record too. | Naming the people who oversee, giving them the authority and training, and setting the limits. |
| Art. 19, log retention | Providers must keep automatically generated logs for at least 6 months, unless other law says otherwise. | The record is kept as long as you set, in the region or building your shape allows. Nobody can quietly edit it in the meantime. | The full decision history for the period, available to export for a reasoned request. | Setting the retention period your obligations require, and handling requests for the logs. |
| Art. 26, deployer duties | Deployers must use the system as instructed, assign human oversight, monitor it, and keep the logs under their control for at least 6 months. | Badges keep agents inside the use you set. The record gives your monitoring something to read. On hybrid and on-prem, the logs stay under your control. | Evidence that agents stayed inside their badges, and every case where they tried not to. | Monitoring, informing affected people and staff where required, and reporting serious incidents. |
This page maps Ares features to a published framework. It is not legal advice, and it does not certify compliance. Your obligations depend on your system, your role and your jurisdiction; check them with your counsel.
Show your auditor the record, not a promise.
The security pack covers the architecture, the data flows and how the record is protected, at the depth these pages leave out. We send it after a short NDA.