Reference note, 5 September 2026
Corrected 6 September 2026. This page previously said that obligations for Annex III high-risk systems began applying on 2 August 2026. They did not. Regulation (EU) 2026/1744, the digital omnibus on AI, entered into force on 27 July 2026, six days before that date, and deferred them to 2 December 2027. Systems embedded in products already covered by EU product-safety law, Annex I, move to 2 August 2028. Much of the commentary still online, including pages written after the deferral, carries the old date.
What was not deferred: the Article 5 prohibitions, in force since February 2025; the general-purpose AI provider obligations, applying since August 2025; and the Article 50 transparency and labelling duties, which kept the August 2026 date.
The deferral does not change what the obligations will ask for, and the Regulation says why it happened. Recital 40 gives "the delayed availability of standards, common specifications, and alternative guidance" as the reason. The harmonised standards are still not finished: prEN 18229 is in draft and nothing in the series is cited in the Official Journal, so nothing yet carries a presumption of conformity.
So the position is a deadline fifteen months out and no document yet defining what satisfies it. This note maps the obligations onto what a record would have to contain to answer them, and says where the mapping is speculative.
It is not legal advice and it claims compliance with nothing. Whether a given deployment satisfies a legal obligation is a matter for the parties to it and their regulator. What follows is about evidence, which is a narrower and more answerable question.
Automatic recording of events over the lifetime of the system, at a level enabling traceability. In practice a reader months later needs to establish what the system held to be true, where that came from, and that the record has not been rewritten since.
This is a logging obligation with an identifiability character. Metrics and traces do not satisfy it: they record that calls happened, not what was concluded.
That the system is designed so natural persons can oversee it, understand its capacities and limits, remain alert to automation bias, interpret output, decide not to use it, and intervene or halt.
Note what the Article is about and what it is not. It requires that oversight be possible. It does not, in terms, require that you be able to show afterwards that it happened, or by whom. That is the gap this note exists to point at, because it is the first question asked when an action is disputed and the one an ordinary agent log cannot answer.
Levels TR-1 to TR-4 are the conformance levels of the Testimony Record, a published record format. They are used here as a vocabulary for what a record contains, not as a compliance claim.
| Obligation | What a record has to show | Level |
|---|---|---|
| Art. 12 | Events recorded automatically as they occur, append-only, each carrying its own write time, in one stated format. | TR-1 |
| Art. 12 | What the system concluded, and what each conclusion rested on, including where it rested on nothing. Contradictions retained rather than silently resolved. | TR-2 |
| Art. 13 | Information sufficient for a deployer to operate and oversee the system, including what it cannot do. Sits in instructions for use rather than in the record. | outside |
| Art. 14 | Every consequential action carries a verdict, whether or not it ran, with a risk class the proposing model could not set. | TR-3 |
| Art. 14 | An intervention is attributable: the record names the person or the named role holder, takes that identity from authentication rather than from run state, and the approver is not the principal that proposed the action. | TR-3 |
| Art. 14 | Refusals recorded as faithfully as permissions, with reasons. A record of only what was done cannot show oversight working. | TR-3 |
| Art. 15 | Accuracy and robustness figures as declared, and resistance to manipulation of the record itself. | TR-4 |
| Art. 26 | Deployer duties: logs kept, competent oversight assigned, affected people informed. Most tooling addresses the provider side only. | TR-1 to TR-3 |
| Art. 72 | Post-market monitoring, which is continuing rather than a single assessment, so the record has to remain readable and comparable over time. | TR-1, TR-4 |
| Art. 86 | The role of the system in the decision and its main elements: what the system held to be true and what that rested on. A recruiter, a lender, a school or an immigration officer must be able to say this after the fact, and Article 12 tells them nothing about what to record in order to be able to. | TR-2 |
| Art. 86 | And whether anything contradicted it. A decision explained without the disagreement that existed at the time is not the main elements of the decision, it is the winning half of one. Absence is not a verdict: a record with no disagreement in it may have retained none or may have had none, and no reading of one record tells those apart. | TR-2 |
On Article 86 and its date. It sits in Chapter IX, which Regulation (EU) 2026/1744 did not defer, so by Article 113 it has applied since 2 August 2026. Whether it can be invoked before December 2027 is arguable and this page does not assert it. It reaches seven of the eight Annex III areas, excepting only point 2, critical infrastructure, and Article 12(3) specifies log content for exactly one area, point 1(a), remote biometric identification. Seven areas must explain a decision; one is told what to write down. The full reading is at the duty to explain.
CEN-CENELEC JTC 21 holds the mandate. The relevant series is prEN 18229: Part 1 logging, Part 2 transparency, Part 3 human oversight, Parts 4 and 5 accuracy and robustness. Each carries an Annex ZA mapping its clauses to the Article it covers, and Annex ZA is the first thing worth reading in any of them.
Two cautions. A draft prefixed prEN is not a standard. And a standard not cited in the Official Journal grants no presumption of conformity however finished it looks.
Part 3 reached public comment on 30 July 2026 and closed on 22 September 2026. Its central mechanism is the reaction timeframe: the time available to a designated person to intervene between an output and the harm, which determines which oversight measures apply and whether real-time oversight is feasible at all.
Two technical comments were submitted on that draft from this programme, both on clause 5.7. The first observes that clause 5.8.3 d) requires a manual reviewer's identity to be recorded for remote biometric identification systems, while clauses 5.7.1 to 5.7.5 route every other intervention to logging without stating that the designated person's identity forms part of the record. The second observes that 5.8.3 a) requires individual authentication of manual reviewers, and that clause 5.7 requires nothing equivalent, so intervention functions on a non-RBI system may be operated from a shared account.
Everything above is about a regulation that applies to high-risk systems from 2 December 2027. A right to human review of an automated decision has existed in European law since 25 May 2018, and it is worth reading beside the Act because it is the provision every instrument on this site descends from.
Article 22(3) of the General Data Protection Regulation requires a controller to implement suitable measures to safeguard the data subject, “at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision”. Article 22(1) gives a data subject the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them.
So the right to a person is eight years old. The question this site asks is what would show one was involved, and the answer in the GDPR is the same as everywhere else.
Article 22 contains no occurrence of record, log, retain or document. The regulation's record-keeping obligation is Article 30, and its seven items are the controller's name, the purposes of processing, the categories of data subjects and personal data, the categories of recipients, transfers to third countries, envisaged erasure time limits, and a general description of security measures. Not one of them is about a decision. Not who intervened, not when, not what they were shown, not whether they changed anything.
That is the same shape as Colorado's section 6-1-1703, which enumerates three years of records and makes every one of them a fact about the software. It is the same shape as the United Kingdom's Articles 22A to 22D, which replaced Article 22 on 5 February 2026 and carry no record requirement at all. The gap is not recent drafting. It has been in the most widely copied data protection law in the world since 2018, and everything modelled on it inherited it.
An AI management system standard: governance, roles and processes. It is organisational rather than a product requirement, it is not a substitute for Articles 8 to 15, and certification to it is not conformity with the Act. That last point is misstated often enough to be worth repeating.
Measured rather than assumed. Eight agent memory and agent framework implementations were assessed in September 2026 against twenty requirements, every verdict citing a file and a line at a named commit. Six take or gate actions. Against whether an approval identifies a person or a named role holder, four were assessed absent and one could not be established either way. The assessment includes its author's own implementation, the one entry that passes, and states that this entry carries no evidential weight.
An organisation assembling Article 14 evidence on top of one of these frameworks is, by default, assembling it on a record that cannot say who decided.
The record format, the validator and the adapters are free and require no permission. A record can be checked in a browser without installing anything, and the validator is a single standard-library file that can be copied into your own CI so that a conformance claim is checked by the party hearing it rather than the party making it.
If this mapping is wrong, saying so is useful and there is a route for it. A correction published under the name of whoever found it is worth more to this programme than the original being right.