[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text admin_label=”Text” _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n
Most enterprise logging architectures were designed for deterministic applications: a user logs in, performs an action, and the log records who, what, and when. A generative AI system or an autonomous agent<\/a> breaks this simple model. The \u201cwhat\u201d becomes a natural-language prompt\u2014which may be modified during the session by an injection\u2014and the \u201cwho\u201d can be a chain of delegation involving a user, an agent, and the tools that the agent, in turn, invokes. Most current logging stacks do not capture any of these specific elements. <\/p>\n Before examining what AI is changing, we must return to the standard definition in France. The CNIL describes a logging system<\/a> as the recording, in log files, of three categories of events: users\u2019 business activities (application logs), technical interventions\u2014including those by administrators\u2014and security-related anomalies and events (technical or \u201csystem\u201d logs). <\/p>\n Its recommendation of October 14, 2021 (Resolution No. 2021-122<\/a>) specifies the purpose of these mechanisms: to ensure the traceability of access and actions by users authorized to access information systems and, consequently, of the processing of personal data carried out within those systems. In other words, to know who accessed which data, on which system, and at what time. This record-keeping is not merely an optional best practice: it directly contributes to compliance with the security principle set forth in Articles 5 and 32 of the GDPR<\/a>. <\/p>\n According to the CNIL, this data is used to detect and investigate incidents, intrusions, or misuse by an authorized individual. A log is not a compliance document to be archived; it is an investigative tool. <\/p>\n The CNIL recommends that log data be subject to automated analysis to enable the rapid detection of unauthorized use. Simply storing the data is not enough, and this requirement was already established in 2021, well before the AI Act. <\/p>\n This definition was developed for deterministic processing, where the authorized user and the logged action are two clearly identifiable entities. It is precisely this pairing that generative AI systems and autonomous agents blur, which is why a log stack compliant with the CNIL framework may remain structurally unaware of what an agent is actually executing. <\/p>\n Article 12<\/a> of the EU AI Regulation<\/a> requires that high-risk AI systems have technical capabilities that enable the automatic logging of relevant events throughout their entire lifecycle. These capabilities must ensure a level of traceability appropriate to the system\u2019s purpose, in particular to identify situations that may pose a risk, to facilitate post-market surveillance, and to enable the deployer to monitor the system\u2019s operation. <\/p>\n Article 19 requires <\/a>the provider to retain automatically generated logs under its control for a period appropriate to the purpose of the system, of at least six months, unless Union law or national law provides for a different or longer period. Specific sector-based rules may also apply, particularly in the field of financial services. <\/p>\n Article 18<\/a> establishes a separate obligation: the supplier must make the technical documentation and several other conformity documents available to the competent national authorities for a period of ten years from the date the system is placed on the market or put into service. It is therefore incorrect to calculate this period from the date the system is withdrawn from the market. <\/p>\n Calendar-related note: The initial schedule did not provide for uniform implementation across all high-risk systems as of August 2, 2026. The Digital Omnibus on AI, definitively adopted by the Council on June 29, 2026, establishes, among other things, a deadline of December 2, 2027, for high-risk AI systems covered by Article 6(2) and Annex III, as well as a deadline of August 2, 2028, for systems covered by Article 6(1) and Annex I. <\/p>\n This postponement does not negate the importance of implementing a structured and proportionate logging system now: it is a measure to prepare for compliance, oversight, and a potential audit, rather than an additional obligation explicitly imposed by Section 12 prior to the applicable deadline.<\/p>\n Most traditional application logging stacks capture an HTTP request, an authenticated user, and a return code. This is insufficient for an AI system. A usable log must include: <\/p>\n A log that can be modified retroactively has no evidentiary value in the event of an investigation or regulatory audit. The most robust architectures follow an \u201cappend-only\u201d<\/em> principle (additions only, with no possibility of retroactive modification) and include protection against tampering, such as cryptographic signatures or certified timestamps. It is this level of rigor that distinguishes a simple application log file from audit evidence that is defensible before a regulatory authority. <\/p>\n A large volume of logs that is stored but cannot be analyzed is of no use when it matters most. Two uses must be anticipated from the design phase: <\/p>\n For agents connected to external tools via connectors, each tool call must be logged as a separate event\u2014not just the initial interaction with the model\u2014otherwise, visibility into what the agent actually executed on behalf of the user will be lost.<\/p>\n [\/et_pb_text][et_pb_accordion _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_accordion_item title=”Should all prompts and responses be kept in plain text?” open=”on” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]Not necessarily. For the most sensitive exchanges, a cryptographic fingerprint combined with separate encrypted storage makes it possible to verify the integrity of an exchange without exposing its content to anyone with access to the logs.[\/et_pb_accordion_item][et_pb_accordion_item title=”Is a six-month retention period sufficient for all purposes?” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content” open=”off”]<\/p>\n This is a regulatory minimum, not a recommended maximum. The financial and healthcare sectors, as well as sectors subject to specific record-keeping requirements, generally must retain these logs for a longer period, in accordance with their existing sector-specific obligations. <\/p>\n [\/et_pb_accordion_item][et_pb_accordion_item title=”Does an AI-powered SaaS provider automatically generate logs for me?” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content” open=”off”]No, the retention obligation remains the responsibility of the deployer under Article 26, regardless of the system provider. It is essential to verify contractually that you have actual access to the provider\u2019s logs before considering this obligation to be fulfilled.[\/et_pb_accordion_item][\/et_pb_accordion][et_pb_text _builder_version=”4.27.8″ _module_preset=”default” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n Our experts assess your current logging coverage and assist in implementing a log architecture that is compliant and useful for investigations, consistent with your <\/span>AI governance<\/a> and your overall <\/span>AI security<\/a> strategy <\/span>.<\/span><\/p>\n Would you like to discuss your project or assess your needs? Contact our experts.<\/a><\/p>\n [\/et_pb_text][et_pb_code _builder_version=”4.27.8″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″]Logging: What Is It?<\/strong><\/h2>\n
What the EU AI Act Actually Requires<\/strong><\/h2>\n
What an AI log must contain<\/strong><\/h2>\n
\n
Why the integrity of the log is just as important as its content<\/strong><\/h2>\n
Use logs for investigations, not just store them<\/strong><\/h2>\n
\n
FAQ: AI Logging, AI Logs, Agent Traceability, and the AI Act<\/strong><\/h2>\n
Organizing Logging for Your AI Systems<\/strong><\/h2>\n