The most important sentence in the EU AI Act

The EU AI Act is long, and most commentary about it is longer. But if you build or deploy AI in a regulated business, one sentence deserves your attention more than the rest. Article 12(1): "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system."

Read it again, slowly. Not "providers should keep logs", which would be a policy obligation someone could satisfy with a retention memo. The system itself shall technically allow automatic recording, over its lifetime. That is not a compliance requirement. That is an engineering requirement, written into law.

Why this sentence bites

Most AI deployments today cannot satisfy it in spirit, even where they satisfy it in letter. Typical logging exists for debugging: it is truncated for cost, rotated on a schedule, mutable by anyone with database access, and split across a model API, an orchestration layer and an application. Each of those properties is fatal to the purpose of Article 12, which is traceability: the ability to reconstruct, after the fact, what a system did and why.

A log you can edit is not a record. A log that dropped the prompt to save storage is not a record. A log that lives in a vendor's dashboard behind a ninety-day window is not a record. When the first serious enforcement actions arrive, the gap between "we have logs" and "we can show you" is where they will land.

A log you can edit is not a record.

The bar is tamper-evidence

The honest engineering answer to Article 12 is a record that proves its own integrity. Hash each event. Chain each hash to the previous one. Anchor the chain so that a retroactive edit, by anyone, breaks every subsequent link visibly. This is a few pages of careful code, not a research programme, and it converts "trust our logging" into "check the chain yourself".

It also changes the conversation with a regulator. Firms that arrive with an editable log are asking to be believed. Firms that arrive with a hash-chained record are asking to be verified. Those are different meetings.

The pattern beyond Europe

The same logic is arriving from other directions. The FCA's financial-promotions regime expects firms to evidence why content was compliant, not merely assert it. The SEC's marketing rule polices untrue statements in advertisements, which presumes you can reconstruct what was published and on what basis. Different jurisdictions, one direction of travel: show your work.

We build for that direction. Velkron's evidence packs and hash-chained receipts are, in effect, Article 12 implemented as a product: automatic recording, over the lifetime of the system, that nobody can quietly rewrite. The law asked for a property. We think the right response is to ship it.