EU AI Act

Two articles decide whether you need a record.

Most of the Act does not concern a team shipping an agent. Article 50 and Article 12 do, and only one of them is still in the future.

The duties, in order of when they bite

What each article actually asks for.

Quoted from the published text rather than paraphrased into something more alarming.

Article 50
In force

Tell people they are talking to a machine

Any provider of a system that interacts with people

Systems that interact with natural persons must disclose that fact, unless it is obvious to a reasonably observant person. Synthetic audio, image, video and text must be marked as artificially generated in a machine-readable form. The duty is on disclosure — and proving a disclosure was actually made on a particular call is a records problem, not a UI problem.

Article 12
2 December 2027

Automatic logging, over the system's lifetime

High-risk systems, per Annex III

High-risk systems must technically allow the automatic recording of events over their lifetime. The logs must let you identify situations where the system presents a risk, and support post-market monitoring. Annex III includes employment and worker management, access to essential private and public services including creditworthiness, and law enforcement — which is where most agent deployments in finance and HR land.

Article 99
Applies with the duty

What it costs to have nothing

Everyone in scope

Penalties run to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher, for breaches of most operator obligations. Prohibited-practice breaches carry a higher ceiling of €35,000,000 or 7%. Member States set the detail, and enforcement is national.

What a record has to survive

The log is the easy part.

Article 12 asks for automatic recording. The harder question is what that record is worth when somebody disputes it.

  • It has to outlive the obligation

    A duty measured in years, met by storage measured in days, is not met.

  • It has to resist revision

    A record anyone could have edited proves what it says today, not what happened then.

  • It has to name a person

    A service account is not accountability. Article 14 human oversight needs a human in the record.

  • Someone else has to be able to read it

    An authority that must take your word for the export has not verified anything.

What no product can do for you
Decide whether your system is high-risk. That turns on what it decides and who it affects, it is a legal judgement about your deployment, and any vendor answering it for you in a sales call is guessing with your liability.
The questions counsel asks first

Four, answered plainly.

Including whether the dates are actually final, where the honest answer is that they may not be.

What a governance platform does →
01Does the Act apply to us if we are not in the EU?
It can. The Act reaches providers placing systems on the EU market and deployers established in the EU, and it also reaches providers outside the EU where the output is used in the EU. An Indian company serving an EU customer is frequently in scope through that route or through its customer's contract, whichever bites first.
02Is our agent high-risk?
That depends on what it decides, not on how it is built. Annex III lists the areas — employment and worker management, creditworthiness and essential services, education, law enforcement, migration, justice. An agent that screens CVs or scores a loan is a much easier call than a support bot, and if you are genuinely unsure that is a question for counsel rather than for a vendor page.
03What counts as a log under Article 12?
The Act requires the technical capability for automatic recording of events over the lifetime, sufficient to identify risk situations and support post-market monitoring. It does not prescribe a format. What it plainly does not contemplate is a log that expires in fourteen days, or one whose contents can be revised without trace.
04Are the dates final?
The staged application is set in the Act. There has been active discussion in 2025 and 2026 about simplifying or delaying parts of the high-risk regime, and it would be dishonest to tell you 2 December 2027 is beyond revision. It is the date on the books, and building a record now costs nothing if it moves.
Start

December 2027 is two budget cycles.

A record only counts if you were already keeping it. Two lines in one agent, free while you evaluate.

Start freeSee it live
  • No card to start
  • Nothing is blocked until you say so
  • Your proof stays yours if you leave