Palimpsests / EU AI Act Article 12
EU AI Act · Art. 12, 19, 26(6), 99EU AI Act Article 12: automatic logging for high-risk AI systems
High-risk AI systems must record events automatically over their lifetime, and those logs must be kept. Palimpsests supplies that record-keeping as a tamper-evident log on your own hardware; the rest of the Act stays with you.
What the Act asks
- Article 12 — a high-risk system must technically allow the automatic recording of events over its lifetime.
- Article 19 — providers keep the logs under their control for at least six months.
- Article 26(6) — deployers keep the logs under their control for at least six months.
When it applies
As amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI):
| Scope | Applies from |
|---|---|
| High-risk systems listed in Annex III | 2 December 2027 |
| High-risk AI in products covered by Annex I | 2 August 2028 |
What is at stake — Article 99
| Breach | Up to | SMEs and start-ups |
|---|---|---|
| Prohibited practices (Art. 5) | €35M or 7% of worldwide annual turnover | the lower of the two |
| Obligations of providers, deployers and other operators, including the high-risk requirements (Art. 99(4)) | €15M or 3% | the lower of the two; also small mid-caps (Art. 99(6a)) |
| Incorrect, incomplete or misleading information to authorities (Art. 99(5)) | €7.5M or 1% | the lower of the two; also small mid-caps |
For other undertakings the higher of the two figures applies. These are ceilings, set by national authorities case by case; the circumstances they weigh include the degree of cooperation and the measures taken to mitigate harm (Art. 99(7)). Logging obligations fall in the €15M / 3% tier — the €35M / 7% tier is for prohibited practices only.
What Palimpsests covers — and what it doesn't
Covers: automatic event recording (Article 12); support for keeping those records through retention — segmentation, rotation and prefix proofs; and integrity that anyone can verify without the decryption key.
Does not cover: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), transparency (Art. 13), human oversight (Art. 14), accuracy and robustness (Art. 15), quality management (Art. 17), or conformity assessment (Art. 43).
The Article 12 mapping sets out, requirement by requirement, what ships today — 24 of 27 rows as of 0.12 — and what is planned.
Evidence you can hand over
When an authority asks for logs, what matters is whether the record itself can be believed. A PALA-1 chain can be verified by the authority on its own machine, from a published specification, without your decryption key — see verify without reading.
Questions
Does Palimpsests make us compliant with the EU AI Act?
No — and be wary of anything that claims to. Fines under Article 99 attach to your obligations as a provider or deployer, most of which no runtime can carry for you. Palimpsests carries one of them well: automatic, verifiable record-keeping. The log is evidence of how you met your obligations, not a substitute for meeting them.
Is our system high-risk?
That classification is yours to make, against Article 6 and Annex III. Palimpsests cannot answer it for you.
Is this page legal advice?
No. It summarises the text of the Regulation as amended; the source text on EUR-Lex governs.
Not legal advice. Figures and dates as of 30 September 2026; source: Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, on EUR-Lex.