Risk management leaves a trail
Article 9 calls for a continuing process that identifies, tests and addresses risks across the system's lifecycle. An undocumented intention is not the same as a dated, reviewable record of that work.
Logging and oversight are designed in
Article 12 addresses automatic event recording; Article 14 addresses people with the information and authority to intervene. Together they make it necessary to understand both what a system did and what a reviewer decided.
Providers and deployers both have duties
Articles 19 and 26 deal with keeping logs and monitoring use. The record must remain accessible to the responsible organisation, not disappear into an inaccessible vendor system.
Basis
EU AI Act Articles 9, 12, 14, 19, 26 and 99 (Regulation (EU) 2024/1689)