Reference note, 5 September 2026
Obligations for high-risk systems began applying on 2 August 2026. The harmonised standards that will say what satisfies them are not finished: the AI trustworthiness framework, prEN 18229, is still in draft, and nothing in the series has been cited in the Official Journal, so nothing yet carries a presumption of conformity.
That leaves deployers and providers being asked for evidence of oversight before the document defining that evidence exists. This note maps the obligations onto what a record would have to contain to answer them, and says where the mapping is speculative.
It is not legal advice and it claims compliance with nothing. Whether a given deployment satisfies a legal obligation is a matter for the parties to it and their regulator. What follows is about evidence, which is a narrower and more answerable question.
Automatic recording of events over the lifetime of the system, at a level enabling traceability. In practice a reader months later needs to establish what the system held to be true, where that came from, and that the record has not been rewritten since.
This is a logging obligation with an identifiability character. Metrics and traces do not satisfy it: they record that calls happened, not what was concluded.
That the system is designed so natural persons can oversee it, understand its capacities and limits, remain alert to automation bias, interpret output, decide not to use it, and intervene or halt.
Note what the Article is about and what it is not. It requires that oversight be possible. It does not, in terms, require that you be able to show afterwards that it happened, or by whom. That is the gap this note exists to point at, because it is the first question asked when an action is disputed and the one an ordinary agent log cannot answer.
Levels TR-1 to TR-4 are the conformance levels of the Testimony Record, a published record format. They are used here as a vocabulary for what a record contains, not as a compliance claim.
| Obligation | What a record has to show | Level |
|---|---|---|
| Art. 12 | Events recorded automatically as they occur, append-only, each carrying its own write time, in one stated format. | TR-1 |
| Art. 12 | What the system concluded, and what each conclusion rested on, including where it rested on nothing. Contradictions retained rather than silently resolved. | TR-2 |
| Art. 13 | Information sufficient for a deployer to operate and oversee the system, including what it cannot do. Sits in instructions for use rather than in the record. | outside |
| Art. 14 | Every consequential action carries a verdict, whether or not it ran, with a risk class the proposing model could not set. | TR-3 |
| Art. 14 | An intervention is attributable: the record names the person or the named role holder, takes that identity from authentication rather than from run state, and the approver is not the principal that proposed the action. | TR-3 |
| Art. 14 | Refusals recorded as faithfully as permissions, with reasons. A record of only what was done cannot show oversight working. | TR-3 |
| Art. 15 | Accuracy and robustness figures as declared, and resistance to manipulation of the record itself. | TR-4 |
| Art. 26 | Deployer duties: logs kept, competent oversight assigned, affected people informed. Most tooling addresses the provider side only. | TR-1 to TR-3 |
| Art. 72 | Post-market monitoring, which is continuing rather than a single assessment, so the record has to remain readable and comparable over time. | TR-1, TR-4 |
CEN-CENELEC JTC 21 holds the mandate. The relevant series is prEN 18229: Part 1 logging, Part 2 transparency, Part 3 human oversight, Parts 4 and 5 accuracy and robustness. Each carries an Annex ZA mapping its clauses to the Article it covers, and Annex ZA is the first thing worth reading in any of them.
Two cautions. A draft prefixed prEN is not a standard. And a standard not cited in the Official Journal grants no presumption of conformity however finished it looks.
Part 3 reached public comment on 30 July 2026 and closed on 22 September 2026. Its central mechanism is the reaction timeframe: the time available to a designated person to intervene between an output and the harm, which determines which oversight measures apply and whether real-time oversight is feasible at all.
Two technical comments were submitted on that draft from this programme, both on clause 5.7. The first observes that clause 5.8.3 d) requires a manual reviewer's identity to be recorded for remote biometric identification systems, while clauses 5.7.1 to 5.7.5 route every other intervention to logging without stating that the designated person's identity forms part of the record. The second observes that 5.8.3 a) requires individual authentication of manual reviewers, and that clause 5.7 requires nothing equivalent, so intervention functions on a non-RBI system may be operated from a shared account.
An AI management system standard: governance, roles and processes. It is organisational rather than a product requirement, it is not a substitute for Articles 8 to 15, and certification to it is not conformity with the Act. That last point is misstated often enough to be worth repeating.
Measured rather than assumed. Eight agent memory and agent framework implementations were assessed in September 2026 against twenty requirements, every verdict citing a file and a line at a named commit. Six take or gate actions. Against whether an approval identifies a person or a named role holder, four were assessed absent and one could not be established either way. The assessment includes its author's own implementation, the one entry that passes, and states that this entry carries no evidential weight.
An organisation assembling Article 14 evidence on top of one of these frameworks is, by default, assembling it on a record that cannot say who decided.
The record format, the validator and the adapters are free and require no permission. A record can be checked in a browser without installing anything, and the validator is a single standard-library file that can be copied into your own CI so that a conformance claim is checked by the party hearing it rather than the party making it.
If this mapping is wrong, saying so is useful and there is a route for it. A correction published under the name of whoever found it is worth more to this programme than the original being right.