recording
app logging
Logging is a feature someone remembers to wire in per agent.
a2a receipts
The runtime invokes signed-receipt generation for each skill execution.
Article 12 technical evidence
EU AI Act Article 12 logging for AI agents.
Article 12 requires high-risk AI systems to support automatic event recording over their lifetime. Article 19 generally requires provider-controlled automatic logs to be retained for at least six months. a2a cloud supplies a technical evidence layer: Ed25519-signed execution receipts, decision records, and a 180-day retention-policy floor.
automatic · retained ≥180d · signed per run
retention floor (days)
0
Annex III timeline
0
receipt per invocation
the problem
Automatic, retained, reviewable records cannot be a bolt-on.
Article 12 does not ask for logs in the abstract. It requires automatic event-recording capabilities over the system's lifetime, with enough traceability for the system's intended purpose. Article 19 adds retention duties for provider-controlled automatic logs. Bolt-on application logging fails quietly: an execution path skips instrumentation, rotation removes records too soon, or free text never ties an action to a caller and an authority.
Logging wired per agent means some execution paths produce no record at all.
Log rotation ages events out before the six-month retention expectation.
Free-text logs rarely tie a decision to a caller and the authority that permitted it.
Mutable logs used for oversight can be quietly edited — useless to a surveillance authority.
the a2a way
Build the record-keeping evidence layer.
The control plane signs and persists receipts for authenticated Agent API calls and trusted public `/invoke` or standard MCP `tools/call` executions. The /compliance layer can turn those receipts into decision records; formal A2A message/task routes and connector MCP jobs need separate inventory and evidence controls.
Automatic, not opt-inArticle 19 retention floorTraceable eventsDecision records for Article 13/14Tamper-evident by designPortable evidence
Automatic, not opt-in
Article 12 requires automatic event-recording capability over the system's lifetime. The runtime invokes the receipt path for each skill execution, rather than asking every agent author to add logging code.
Article 19 retention floor
Article 19 says provider-controlled, automatically generated logs for high-risk systems must generally be kept for at least six months, subject to other applicable law. a2a cloud floors the active EU AI Act retention policy at 180 days.
Traceable events
Article 12 calls for events relevant to risk and post-market monitoring. Receipts record caller identity/classification, skill, input evidence, verified grant IDs, outcome/result preview, and timing. Tool traces require separate instrumentation; referenced grants carry audience, expiry, and scope.
Decision records for Article 13/14
The /compliance layer projects receipts, grants, and audit into human-readable decision records — the transparency and human-oversight surface Articles 13 and 14 expect, built from the same signed source.
Tamper-evident by design
Ed25519 verification detects changes to the fields inside an individual signed receipt. Separate retention and inventory controls are still needed to demonstrate that the reviewed population is complete and that records were not removed.
Portable evidence
When a notified body or authority requests records, you export signed receipts they verify independently — not a database dump they have to take your word on.
side-by-side
Bolt-on logging vs. signed receipts.
retention
app logging
Log rotation ages records out well before six months.
a2a receipts
A 180-day retention floor on receipts, grants, and audit records.
traceability
app logging
Free-text logs rarely tie an action to a caller and an authority.
a2a receipts
Each receipt binds the caller and grant IDs; the grant record carries audience, expiry, and scope.
integrity
app logging
Mutable logs — an operator can edit the oversight record.
a2a receipts
Ed25519-signed. Altering a signed field breaks verification.
oversight
app logging
Article 13/14 transparency assembled by hand from scattered logs.
a2a receipts
Decision records projected from receipts on the /compliance layer.
dimension
app logging
a2a receipts
recording
Logging is a feature someone remembers to wire in per agent.
The runtime invokes signed-receipt generation for each skill execution.
retention
Log rotation ages records out well before six months.
A 180-day retention floor on receipts, grants, and audit records.
traceability
Free-text logs rarely tie an action to a caller and an authority.
Each receipt binds the caller and grant IDs; the grant record carries audience, expiry, and scope.
integrity
Mutable logs — an operator can edit the oversight record.
Ed25519-signed. Altering a signed field breaks verification.
oversight
Article 13/14 transparency assembled by hand from scattered logs.
Decision records projected from receipts on the /compliance layer.
questions
Frequently asked.
What does EU AI Act Article 12 require for logging?
Article 12 requires high-risk AI systems to technically allow automatic recording of events over their lifetime at a level appropriate to their purpose. Article 19 separately requires provider-controlled automatic logs to be retained for an appropriate period of at least six months, unless other applicable law provides otherwise. a2a cloud emits signed execution receipts and floors the active EU AI Act retention policy at 180 days.
When does EU AI Act agent logging become enforceable?
The timeline changed in 2026. Following the May 2026 political agreement on the AI Omnibus, the European Commission's current implementation guidance says rules for certain stand-alone high-risk systems apply from 2 December 2027, while rules for high-risk systems embedded in regulated products apply from 2 August 2028. Teams should confirm the category and current legal text for their system rather than rely on a single general deadline.
Are signed receipts sufficient for Article 12 record-keeping?
No single technical artifact is sufficient for EU AI Act compliance. Signed receipts can support automatic recording, traceability, and integrity evidence, while retention controls can support Article 19. Classification, risk management, documentation, data governance, accuracy, cybersecurity, and human oversight still require a system-specific legal and operational assessment.
How does this connect to human oversight under Articles 13 and 14?
The a2a cloud compliance layer projects receipts, scoped grants, and audit into human-readable decision records. That gives operators the transparency and traceability Articles 13 and 14 expect for human oversight — every decision, its inputs, and the authority behind it — built from the same signed source as the raw logs. See the /compliance page.
Does using a2a cloud make an AI system compliant?
No. a2a cloud provides technical controls and evidence primitives that can support a compliance program: scoped grants, signed execution receipts, decision records, retention policies, and evidence export. Whether a specific system complies depends on its classification, intended purpose, deployment context, processes, and the law in force. Obtain qualified legal advice for that assessment.
primary sources
Check the source, not just our summary.
Regulation (EU) 2024/1689 ↗
Official legal text. See Article 12 for record-keeping and Article 19 for the minimum retention rule.
European Commission AI Act overview ↗
Current Commission overview and implementation timeline after the May 2026 political agreement.
High-risk system guidance ↗
Commission guidance on classification and the December 2027 / August 2028 high-risk timelines.
Last checked 11 July 2026 · External specifications and policies can change
keep reading
Related guides.
All guides live in the guides index.
governed agent execution
Log automatically. Preserve verifiable evidence.
a2a cloud deploys any agent with managed Postgres, MCP and API surfaces, and a frontend. Agent API, public `/invoke`, and standard MCP `tools/call` executions receive signed receipts. Retention and decision records can support an Article 12/19 evidence program, but protocol routes outside that coverage need separate controls.