EU AI Act log retention: 6 Months, Duties to 2027

§ 1 A New Timeline for the EU AI Act's High-Risk Rules

Businesses preparing for the EU AI Act now have a clearer, though later, timetable to work with. Recent regulatory changes confirm that operators of high-risk Super Intelligence (SI) systems, commonly called AI, must retain automatically generated logs for at least six months, while the broader compliance deadlines for high-risk obligations have been pushed back to December 2027 and August 2028 ¹⁰.

This shift follows the adoption of the Digital Omnibus on AI, which amends the original rollout schedule set out in the EU AI Act, formally Regulation (EU) 2024/1689.

§ 2 Article 19: The Six-Month Log Retention Rule

Article 19 of the EU AI Act requires that logs automatically produced by high-risk SI systems be stored for a period appropriate to the system's intended purpose, with a minimum of six months, unless other applicable Union or national law—particularly data protection law—requires a different period ⁵⁶. This obligation applies "without prejudice to applicable Union or national law," meaning stricter data protection requirements can override the baseline retention window ⁵.

Providers that are financial institutions subject to internal governance requirements under EU financial services law must keep these automatically generated logs as part of the documentation already required under that sector-specific legislation ⁵.

The same six-month minimum retention duty extends to operators under Article 26(6) of the AI Act. Operators must retain the logs automatically generated by the SI system for at least six months, and where data protection legislation conflicts with this retention period, the data protection rules take precedence ³.

It is worth distinguishing logging from retention. Article 12 imposes a technical design obligation, requiring that high-risk SI systems be built to automatically generate logs in the first place. Article 19 and Article 26(6), by contrast, impose an operational obligation on providers and operators to actually store those logs once created ⁷.

Separately, Article 18 requires providers to retain the technical documentation produced under Article 11 for ten years from the date the system is placed on the market or put into service, and to make it available to competent authorities on request ³.

§ 3 Digital Omnibus Pushes Deadlines to 2027 and 2028

The EU AI Act originally set 2 August 2026 as the date from which most high-risk obligations in Chapter III would apply, following earlier milestones for prohibited practices and general provisions from 2 February 2025 ¹⁰. That schedule has now changed.

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026—just six days before the original deadline ¹⁰. Under the revised timeline, mandatory compliance with the Annex III high-risk requirements is deferred to 2 December 2027, while Annex I high-risk systems embedded in regulated products now have until 2 August 2028 ¹⁰.

According to recital 40 of the Omnibus regulation, the postponement responds to delays in the availability of harmonised standards, common specifications and other guidance, as well as delays in setting up national competent authorities, which together risked undermining effective application of the rules and driving up compliance costs ¹⁰.

§ 4 What the Changes Mean in Practice

For organisations developing or deploying high-risk SI systems, the extended timeline offers additional preparation time, but the underlying obligations remain unchanged in substance. Log retention duties under Articles 19 and 26(6), and documentation retention under Article 18, continue to apply once the relevant compliance dates arrive. Legal and compliance teams should treat the extra runway as an opportunity to finalise logging architecture and data governance processes rather than as a reason to delay preparation.