EU AI Act Article 12: implementing automatic logging for your AI agents
High-risk AI systems must keep an automatic, durable record of what they did. Here's what Article 12 asks for, when it applies, and the code to capture a tamper-evident, independently-verifiable decision log — without re-architecting later.
What Article 12 actually requires
Article 12 of the EU AI Act requires high-risk AI systems to automatically record events (“logs”) over their lifetime, to a degree appropriate to the system's purpose. The point is traceability: being able to identify situations where the system might present a risk, support post-market monitoring, and show — after the fact — how the system behaved. The practical implication for engineers is the hard part: you can't reconstruct these logs later. If you didn't capture a decision at the moment it happened, the record doesn't exist.
When it applies (honestly)
The obligations for high-risk systems (Annex III) — Article 12 among them — apply from 2 December 2027 under the Commission's Digital Omnibus. Timelines in this area have moved more than once, so confirm the current date with counsel. But the engineering decision is independent of the date: because logging is architectural and capture-at-decision-time, the right move is to build the capability now and accumulate a real record, rather than scramble to bolt it on near a deadline (and have no historical log to show).
Implement it in a few lines
Log every agent decision to an append-only, hash-chained trail. With the Praxa SDK that's one call per decision. Python (the common language for high-risk hiring/lending/insurance ML):
pip install praxa-sdk
from praxa import PraxaClient
px = PraxaClient(api_key="praxa_...") # or env PRAXA_API_KEY
# Log each high-risk decision at the moment it is made
px.log(
agent_id="loan-underwriter",
input={"applicant_id": 4821, "features": {...}},
output={"decision": "decline", "score": 0.41},
model="gpt-4o",
rationale="score below 0.5 cutoff",
)Or over plain HTTP, from any stack:
curl -X POST https://praxa.piposlab.com/api/v1/events \
-H "Authorization: Bearer praxa_..." \
-H "Content-Type: application/json" \
-d '{"agent_id":"loan-underwriter",
"input_payload":{"applicant_id":4821},
"output_payload":{"decision":"decline","score":0.41},
"model":"gpt-4o"}'Each event is hashed into a chain (every entry references the previous hash), and the table is append-only at the database level — so a logged decision can't be altered after the fact, even by us. Handling applicant PII? Configure per-agent capture-time redaction (drop / hash / mask fields, or auto-detect emails, phones, SSNs, card numbers) so sensitive values are stripped before anything is stored.
Make the record provable, not just present
A log only helps if you can prove it wasn't edited. Praxa anchors each chain head periodically, signs the anchor with Ed25519, and emails it to you — so you hold an independent, third-party-verifiable snapshot outside our control. Anyone can verify a chain offline with the open-source @piposlabs/praxa-verify, and verify an anchor signature against our public key at /api/v1/pubkey. That's the difference between “trust our dashboard” and “here's cryptographic proof.”
What you can hand an auditor
On demand, Praxa generates an Article 12 / Annex IV evidence pack and a NIST AI RMF / SOC 2 report from the live chain, describing exactly what was recorded and how its integrity is guaranteed. It documents your record-keeping; it doesn't replace your risk-management, data-governance, or human-oversight obligations.
Scope & honesty: Praxa supports EU AI Act / NIST / SOC 2 compliance work by providing a tamper-evident record-keeping layer. It does not by itself make any system compliant, and this guide is not legal advice — confirm your obligations and timelines with qualified counsel.