EU AI Act record-keeping for small business AI users: what to log and what to keep (2026)
Short answer: if your business only uses AI tools such as ChatGPT, Microsoft Copilot or a vendor's website chatbot, and none of them is used for a high-risk purpose, the EU AI Act does not require you to keep technical AI logs. The deployer log duty in Article 26(6), keeping the logs a system generates automatically for at least six months, covers high-risk AI systems only, and the high-risk rules for Annex III uses (such as hiring, education and credit scoring) apply from 2 December 2027 after the Digital Omnibus on AI. What you can be asked about today is narrower: the AI literacy measures you took (Article 4), that you do not use banned practices (Article 5), and Article 50 transparency where it applies. A short, dated register is the easiest way to show all three.
What the Act actually says about logs
- Providers build the logging in. Article 12 requires high-risk AI systems to technically allow automatic recording of events (logs) over their lifetime. That is a design duty for the company that makes the system, not for you.
- Deployers of high-risk systems keep the logs. Article 26(6) says deployers of high-risk AI systems keep the logs automatically generated by that system, to the extent the logs are under their control, for a period appropriate to the intended purpose and of at least six months, unless other EU or national law (in particular data protection law) provides otherwise.
- No log duty for ordinary AI use. The Act sets no general duty to log prompts or outputs for tools that are not high-risk. Keeping full chat histories that contain personal data can create GDPR problems of its own, so do not log "just in case".
Dates and what moved: EU AI Act in 2026: what applies now. Official texts: Regulation (EU) 2024/1689 and the amending Regulation (EU) 2026/1744.
Quick check: is any of your tools in high-risk territory?
- Screening CVs, ranking candidates, or deciding on promotion, dismissal or task allocation for staff
- Assessing creditworthiness or setting life or health insurance prices for individuals
- Deciding admission to, or grading in, education and vocational training
- Biometric identification or categorisation, or emotion recognition
- Access to essential public services or benefits
- AI as a safety component of a regulated product (machinery, medical devices, toys, lifts)
If nothing is ticked, the high-risk duties (including the six-month log rule) do not reach you through that tool. If something is ticked, run that tool through the free risk-tier checker and get specialist advice. Article 6(3) can take some Annex III uses out of high-risk, for example narrow preparatory tasks, so a tick is a reason to check, not a verdict.
What to keep instead: 8 records for a small team
| Record | Legal hook | Why keep it |
|---|---|---|
| List of AI tools in use: vendor, owner, purpose, who uses it | No named AI Act document for non-high-risk use | Every other duty starts from knowing what you use |
| Your role per tool (deployer, or provider if you built it or put your name on it) | Art. 3(3)–(4), Art. 25 | Your duties depend on your role |
| Article 5 screen per tool, dated ("none of the banned uses") | Art. 5, applies since 2 Feb 2025 | Shows you checked, not assumed |
| AI literacy measures: policy version, briefing dates, attendees | Art. 4, applies since 2 Feb 2025 | Simple evidence of the measures you took |
| Article 50 check per tool: chatbot disclosure, deepfake labels, AI text published on matters of public interest | Art. 50, applies since 2 Aug 2026 | Records which transparency duty is yours and which is the vendor's |
| Vendor documents: terms, data processing agreement, instructions for use, how long the vendor keeps logs | GDPR Art. 28; for high-risk, AI Act Art. 26(1) | Needed if a tool later turns out to be high-risk |
| Personal data notes: what data goes in, lawful basis, retention | GDPR Art. 30 records may apply; the under-250-staff exemption has exceptions | AI tools that process personal data are GDPR processing |
| Incidents and fixes (wrong output sent, data pasted by mistake) | Good practice; for high-risk, Art. 26(5) | Shows the rules are used, not just filed |
A register you can start in 15 minutes
One row per AI system. These columns cover everything in the table above:
System | Vendor | Owner | Purpose | Our role | Personal data in? (Y/N, which) Art. 5 screen (date, result) | Art. 50 duty (none / ours / vendor's) | Literacy briefing date Vendor docs on file (terms, DPA, instructions) | Vendor log retention | High-risk flag (Y/N, why) Last incident | Next review date
Review it every six months and whenever a new tool is switched on. For the starting list, use the SME AI inventory template; for the vendor column, send the 12 AI vendor questions.
If a tool is (or may become) high-risk: what Article 26 adds
From the applicable date (2 December 2027 for Annex III uses), deployers of high-risk systems must, among other things:
- use the system in line with the provider's instructions for use (Art. 26(1))
- assign human oversight to people with the competence, training and authority to do it (Art. 26(2))
- make sure input data they control is relevant and sufficiently representative (Art. 26(4))
- monitor the system, inform the provider of risks, and report serious incidents (Art. 26(5))
- keep the automatically generated logs under their control for at least six months (Art. 26(6))
- inform workers' representatives and affected workers before using it at work (Art. 26(7)), and tell people when an Annex III system is used to make or help make decisions about them (Art. 26(11))
- for public bodies, private providers of public services, and credit and life or health insurance uses: carry out a fundamental rights impact assessment (Art. 27)
Practical step now: ask that vendor whether you can export the logs, where they are stored and how long they are kept. If the logs sit only on the vendor's side, write down who holds them.
A register is not proof of EU AI Act compliance, and this guide does not cover every duty. Do not claim a certification you do not have. For hiring, credit, education, biometrics or staff monitoring, get specialist advice. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients already ask "do we need to keep anything for AI?". The honest answer for most of them is a short register, not log files, which you can help them start alongside the year-end pack. The 60-minute client AI inventory workshop walks through it. Stay inside your professional rules and pass legal questions to a lawyer.
Partner programme opening soon
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. If you advise SMEs: Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Free start: add your first AI tool, its Article 5 screen date and its Article 50 duty to the EURO AI Register free edition. Related: Article 4 literacy · Article 5 banned practices · Article 50 checklist · Staff AI use policy.
Sources
- Regulation (EU) 2024/1689 (AI Act): Articles 3, 4, 5, 6, 12, 25, 26, 27, 50 and Annex III
- Regulation (EU) 2026/1744 (Digital Omnibus on AI): amended application dates
- Regulation (EU) 2016/679 (GDPR): Articles 5, 28 and 30
- European Commission: AI Act regulatory framework
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.