The unit of logging is one tool call
Compliance logging fails in a predictable place: teams log the conversation, or the agent's summary of its day, and discover in an audit that neither one can answer what a specific tool actually did. Fix the unit first. By the canonical definition, an agent receipt is a record of one ai agent tool call that anyone can check: it keeps the exact saved bytes and their sha-256 digest, and it proves the result was not changed since it was saved, not that it was right. One call, one record, made while the call runs.
With that unit, the day's work is a set of records that can be counted, sampled, and checked. Without it, the trail is a narrative, and narratives are exactly what an audit is designed to look past.
What to log per call: the six fields
- When. The start and end time of the use, so the period of each use can be reconstructed later.
- What ran. The identity of the system and the tool that was called, with its version where you track one.
- What went in. The input data given to the tool, saved as it was given, not paraphrased.
- What it checked against. The reference data or databases the tool consulted to reach its result.
- What came back. The output exactly as returned, saved at the moment it was returned, byte for byte.
- Who checked it. The natural person involved in verifying the result, where a person performs that check.
Two properties matter as much as the fields. The record must be produced automatically as the system runs, not reconstructed afterwards from chat history. And it must survive distrust: the person examining it later was not there, and may have every reason to doubt the operator who kept it.
Log versus evidence: the one difference that decides audits
A log and evidence can hold the same six fields and still be different things. A log is kept by the operator, in the operator's store, in a format the operator can edit. Nothing about a quiet edit shows. That is not a character flaw in any team; it is a property of plain text, and auditors price it in.
Evidence closes that gap. A verifiable receipt carries a SHA-256 digest over the exact saved bytes of the call. Anyone, later, recomputes the digest from the saved bytes and compares it to the one on the receipt. A match proves the saved result was not changed since it was saved. A mismatch proves it was. The check needs no account, no vendor dashboard, and no cooperation from the operator, which is why it settles the question a log leaves open. The format is AER-1, an open IETF Internet-Draft (draft-zambo-aer1-26), whose appendix maps its fields to Article 12 as an informative mapping.
Real records, open now
These live receipts show the shape an auditor receives. Each was verified live before this page was written, and each can be checked free at zambo.dev/verify.
- A single call record: a continuity read, zambo.dev/run/fe376b2f-dd43-4510-9946-4de6269dddba, with the tool, the time, and the saved result on one page.
- A closed job set: a workflow close, zambo.dev/run/2c970a44-fb38-49c4-9bff-1718c51a9e4b, and its closing record, zambo.dev/run/dff1fb91-844c-4f13-acef-82137138d7e4. A closed set is how a whole day or job is handed over as one checkable unit, steps in order, none missing.
Article 12 in plain terms: who, when, how long
Who. Article 12, titled Record-keeping, is a design requirement for high-risk AI systems, identified mainly through Annex III: areas such as employment, education, law enforcement, migration, and critical infrastructure. The provider builds the recording capability; the deployer keeps the logs the system produces while they are under its control. If you built the agent and you run it, both seats are yours.
When. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred the Chapter III high-risk duties for Annex III systems to 2 December 2027. For Annex I product legislation systems, the date is 2 August 2028. The field by field companion is the Article 12 logging guide, and retention is worked separately on the retention periods page.
How long. At least six months under Article 19, for a period appropriate to the intended purpose, longer if another law that applies to you says so. Write down why you chose your period. An undocumented period reads as an unconsidered one.
The packet you hand an auditor
- The receipt links for the period in scope. Public URLs, one per call, plus the closed workflow records for each job.
- Your retention note. The period you keep, why it fits the purpose, and the rule that deletes records when it ends.
- The check, stated in one paragraph. How anyone recomputes a receipt's digest and compares it, free at zambo.dev/verify, so the auditor's team can sample records on their own machines.
- A sample you already ran. Pick five records at random each month and recompute them yourself. A trail nobody rechecks is a trail nobody knows still works, and your own sample log is evidence the system runs, not just exists.
The fuller pack format lives on the auditor packet page, and the evidence framing for governance teams is on AI agent compliance evidence.
How Zambo produces this record set
Zambo is the verifiable work layer for AI. Work run through its MCP endpoint at zambo.dev/mcp produces an AER-1 receipt on every call automatically, with the fields above, and the day of work can be reviewed on zambo.dev/today. Its flagship HANDOVER passes work between agents and people with the record attached, so a compliance trail survives a change of hands. Start on the free tier, 20 free calls per day, connect through zambo.dev/add, and the record set starts with the first call. At volume, the math is worked on the heavy caller page.
Agent logging for compliance: FAQ
What should AI agent logging for compliance actually record?
Record one entry per tool call, made automatically as the call runs: the start and end time of the use, the identity of the system and the tool that ran, the inputs the tool was given, the reference data it checked against, the output exactly as returned, and the natural person who verified the result where a person does. Four of those six fields track EU AI Act Article 12 directly; the system and tool identity and the exact output complete the set, and they are the same set an auditor asks for under any regime, because they are what reconstructing an event takes.
What is the difference between an agent log and compliance evidence?
A log is text the operator keeps, and the operator can edit text after the fact without leaving a mark. Evidence is a record built so a later edit shows. An AER-1 receipt keeps the exact saved bytes of one tool call with their SHA-256 digest, so anyone can recompute the digest later and compare: a match means the saved result was not changed since it was saved, and a mismatch means it was. Hand an auditor records they can recompute themselves, and the argument about whether the trail survived the operator ends.
How long do AI agent logs have to be kept under the EU AI Act?
Article 12 requires the recording capability itself. The retention floor sits in Article 19: logs under the control of the provider are kept for a period appropriate to the intended purpose, with a floor of six months, unless another law that applies requires longer. Deployers keep logs under their control on the same six-month floor, unless otherwise provided in applicable Union or national law. In practice, set retention to at least six months, document why the period fits the purpose of the system, and check sector rules that may extend it.
When do the EU AI Act Article 12 record-keeping duties apply?
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred the Chapter III high-risk duties, including Article 12 record-keeping, for Annex III systems from 2 August 2026 to 2 December 2027. For high-risk systems covered by Annex I product legislation, the application date is 2 August 2028. The deferral is time to build the record set, not an exemption from it: a trail already running in production is stronger than one switched on at the deadline.
Does logging through Zambo or AER-1 make a system compliant with the EU AI Act?
No. No tool and no file format makes a system compliant: compliance is a legal judgment about a whole system and its governance. AER-1 is an IETF Internet-Draft, and its mapping to Article 12 is an informative appendix, which means it explains how receipt fields line up with what Article 12 asks a log to hold. What the receipt layer answers well is one question: was this record changed after the fact. Risk management, data governance, human oversight, and the rest of the high-risk duties sit outside any record format.
How does an auditor check an agent's compliance records?
The auditor picks records, ideally at random, and recomputes them. For each sampled receipt: open its public page, read the saved result, recompute the SHA-256 digest of the saved bytes, and compare it to the digest the receipt carries. For a multi-step job, recompute the workflow record from the step receipts and confirm no step is missing or reordered. The free verifier at zambo.dev/verify runs these checks in a browser, with no account, so the auditor's check never depends on the operator's dashboard or say-so.