The EU AI Act asks high-risk systems to log. The harder, unwritten question is whether your logs are evidence or just a story, and most are built to be edited.
The EU AI Act's high-risk record-keeping obligations contain a quiet requirement most logging stacks will fail: not whether you logged, but whether you can prove the record was never altered, without asking anyone to trust you. Tamper-evident, post-quantum, independently verifiable logs are the missing piece, and the clause will bite in the dispute, not the audit.
Originally published on mickai.co.uk. This is a cross-post; the canonical version, with the full body, footnotes and references, lives on the mickai.co.uk article page.
Top comments (0)