The EU AI Act imposes record-keeping and traceability obligations on providers and deployers of high-risk AI systems. Application logs and observability traces are mutable, operator-owned, and cannot be independently verified. Certified Execution Records produce tamper-evident, portable evidence that supports these obligations without depending on the operator's infrastructure.
What an EU AI Act audit trail is
An EU AI Act audit trail is the set of records a provider or deployer of a high-risk AI system maintains to satisfy the record-keeping and traceability obligations of the Regulation. The trail must allow supervisory authorities and, where relevant, deployers to reconstruct how the system operated over its lifecycle, including inputs, outputs, model context, and material decisions.
Article 12: automatic logging
Article 12 requires high-risk AI systems to include logging capabilities that automatically record events over the system's lifetime. The logs must enable identification of situations that may result in the system presenting a risk, and support post-market monitoring.
A Certified Execution Record captures the material inputs, outputs, model context, parameters, and optional identity binding at each decision point, sealed with a cryptographic commitment. Because the record is tamper-evident and independently verifiable, it strengthens the integrity of Article 12 logs beyond what mutable application logs can provide.
Related articles: 11, 13, 20, 72
| Article | Obligation | How CERs support it |
|---|---|---|
| Article 11 | Technical documentation for high-risk AI systems. | Provides verifiable execution evidence that can be referenced by, and attached to, the technical documentation. |
| Article 12 | Automatic event logging over the system lifetime. | Produces tamper-evident, independently verifiable records of each execution. |
| Article 13 | Transparency and information provided to deployers. | Portable JSON records deployers can inspect, archive, and hand to auditors. |
| Article 20 | Retention of automatically generated logs. | Records are portable and archivable alongside existing retention systems. |
| Article 72 | Post-market monitoring by providers. | Cryptographically sealed records of production behavior support monitoring analysis and incident reconstruction. |
For the logging obligation in detail, see EU AI Act Article 12 logging. For the full standards mapping across EU AI Act, ISO/IEC 42001, NIST AI RMF, and SOC 2, see Standards alignment.
Why application logs alone are not enough
- Logs are mutable. Any operator with database access can alter them, so a regulator cannot rely on them to reconstruct behavior.
- Logs are operator-owned. Their integrity depends on trusting the operator's infrastructure and procedures.
- AI behavior drifts. The same input can produce different outputs across model versions, temperatures, and provider changes, so a log entry is not a reproducible record.
- Retention is fragile. Logs are frequently rotated, sampled, or overwritten before the six-month minimum in Article 20 is reached.
How Certified Execution Records support the trail
- Instrument each decision. A single SDK call at each AI decision point produces a Certified Execution Record.
- Seal the record. Each record is sealed with a cryptographic commitment. Sensitive fields can remain private through confidential execution, supporting data minimisation.
- Attest independently. Records are submitted to the NexArt attestation node, which returns a signed receipt with an RFC 3161 timestamp issued via DigiCert's public timestamp authority.
- Archive alongside existing logs. The record is portable JSON. It sits next to Article 12 logs and Article 11 technical documentation, not instead of them.
- Verify without the operator. A supervisory authority or auditor holding the record and the node's public key can verify integrity independently.
Scope and limits
- NexArt does not classify AI systems as high-risk. That classification is determined by the AI Act's Annex III and the provider's own assessment.
- NexArt does not perform conformity assessments and is not a notified body.
- NexArt is not itself certified under the EU AI Act, ISO/IEC 42001, or SOC 2.
- Certified Execution Records support Article 12 logging integrity and traceability. They do not replace governance, risk management, or human oversight obligations.
See Non-goals for the full boundary of what NexArt does not do.
Frequently asked questions
What is an EU AI Act audit trail?
An EU AI Act audit trail is the set of records a provider or deployer of a high-risk AI system maintains to satisfy the record-keeping and traceability obligations of the Regulation, in particular Article 12 automatic logging. The trail must allow supervisory authorities to reconstruct how the system operated over its lifecycle.
Does NexArt make my AI system EU AI Act compliant?
No. Compliance with the EU AI Act is determined by the provider or deployer, their notified body, and the competent supervisory authority. NexArt produces verifiable execution evidence that supports a narrow set of record-keeping and traceability obligations. It is not a governance platform, a conformity assessment, or a compliance certification.
Which EU AI Act obligations does a Certified Execution Record support?
Certified Execution Records primarily support Article 12 automatic logging of events over the AI system lifetime, and complement Article 11 technical documentation, Article 13 transparency, and Article 20 record retention. They also support post-market monitoring under Article 72 by producing tamper-evident evidence of what the system executed in production.
Is a Certified Execution Record a legal record?
A Certified Execution Record is a cryptographically sealed, portable execution log. Its legal weight depends on the jurisdiction, the contractual context, and the operator's own procedures. NexArt does not itself assert legal admissibility. The record is designed to be independently verifiable so that its integrity does not depend on the operator or on NexArt.
How long should audit trail records be retained?
Article 20 of the EU AI Act requires providers to keep logs generated by high-risk AI systems for a period appropriate to the intended purpose, and at least six months unless applicable law provides otherwise. NexArt records are portable JSON and can be archived alongside your existing retention systems.
Do Certified Execution Records expose sensitive data?
Not by default. Confidential execution uses cryptographic commitments so the record contains keyed hashes of inputs, outputs, and identity fields rather than the raw values. This supports privacy and data minimisation obligations while preserving verifiability.
Strengthen your EU AI Act audit trail
Add verifiable, tamper-evident execution evidence alongside your existing Article 12 logs.
Related
- Standards alignment: full mapping across EU AI Act, ISO/IEC 42001, NIST AI RMF, SOC 2
- Governed AI execution: the broader evidence layer pattern
- AI agent execution: evidence for autonomous agent systems
- Certified Execution Records: what a CER contains and how it is sealed
- Confidential execution: privacy-preserving verifiability
- Regulated workflows: audit-supporting execution evidence