EU AI Act · Article 12 + 19 · Article 50 transparency live Dec 2 2026 · High-risk Annex III live Dec 2 2027

Article 12 logging.
Built in. Self-hosted.

200 days until Article 50 transparency rules apply (AI-content disclosure, deepfake labels) — and 565 days until Annex III high-risk obligations + the €15M / 3% global revenue penalty go live. Auto-generated logs that satisfy Article 12 + 19, 6-month retention by default. Free for self-hosted teams under 250 employees.

Updated post Digital AI Omnibus political agreement (Council + Parliament, 7 May 2026). High-risk Annex III obligations were deferred from 2 Aug 2026 to 2 Dec 2027; transparency obligations now apply from 2 Dec 2026 (grace cut from 6 to 3 months). GPAI rules remain in force since Aug 2025.

See an Article 12 log →View on GitHub

Auch auf Deutsch verfügbar — auf Anfrage. · Disponible en français — sur demande.

why SMBs are the squeezed middle

Big 4 won't touch you. Solo dev tools won't survive an audit.

IBM / Accenture / KPMG

Enterprise-priced engagements assume €200k+ budgets and an in-house compliance team. Off the table for 50-500 person shops.

US-only AI governance SaaS

No EU localisation, no on-prem option, GDPR transfer questions. Your DPO will say no on day one.

Hand-rolled spreadsheets

Article 12 requires automatic logging "throughout the lifetime" of the system. A spreadsheet is not a logging system. The Notified Body will say so.

what AttestProto provides

Article 12 logs + Article 19 conformity evidence, signed and exportable.

# every decision your high-risk AI system makes $ attestproto sign \ --agent recruitment-screen-v2 \ --tool decision.shortlist \ --input '{"candidate_id":"...","model_version":"...","factors":[...]}' \ --out attestation.json # at audit time — export the Article 12 log bundle $ attestproto export \ --rule eu-ai-act \ --from 2026-04-01 --to 2026-06-30 \ --out conformity-bundle-q2.zip # Article 12 § 1-3 logs · Article 19 evidence package · DPIA-ready

EU AI Act, Article 12 § 1High-risk AI systems shall technically allow for the automatic recording of events ('logs') over the duration of the lifetime of the system.

EU AI Act, Article 19 § 1Providers of high-risk AI systems shall ensure that their system undergoes the relevant conformity assessment procedure prior to its placing on the market.

readiness self-assessment

How ready are you for the Dec 2 2027 high-risk deadline? — 8 questions, 60 seconds.

Self-assessment quiz covering Article 6 high-risk classification, Article 9 risk management, Article 10 data governance, Article 12 logging, Article 14 human oversight, Article 19 conformity. Scores your tier + lists exact gaps to close before enforcement.

Does your AI system fall under any Annex III high-risk category? (recruitment screening, credit scoring, education, law enforcement, migration/border, justice administration)

Does your system automatically record events (logs) over the lifetime of the system?

Are logs retained for a minimum of 6 months?

Do you have a documented risk management system that identifies known risks and tests them iteratively?

Is your training data documented (provenance, demographic representation, known biases)?

Do users / affected persons receive clear information that they are interacting with an AI system?

Is there a documented human oversight mechanism (review, override, stop)?

Have you completed (or scheduled) the conformity assessment required prior to placing the system on the EU market?

try it

Sign one Article 12 log entry in your browser.

No install, no account. The keypair is generated client-side and never leaves this page. Same code path as the production CLI.

Generates an Ed25519 keypair in your browser. Nothing leaves this page.

SMB-friendly

Free for organisations under 250 staff. MIT-licensed. Hosted in your EU data centre, not ours.

GDPR-native

Self-hosted. Personal data never enters a US-controlled cloud. DPO sign-off in minutes, not months.

Localisation

Article citations and rule mappings translated to DE, FR (more on request). UI in English; documentation localised.

Notified Body export

The conformity-assessment bundle is a single signed archive. Drop it into your Notified Body submission unchanged.

Article 12 logging.Built in. Self-hosted.