Six months of history.
Art. 19 and 26(6) set a six-month minimum retention. To hold six months on 2 Dec 2027, the system is running by June 2027.
EU AI Act compliance
You can't backfill evidence
Article 12 requires high-risk systems to automatically log production behaviour. WildEdge captures what is required for both on-device & cloud AI, without compromising data privacy.
Timeline
Clock is ticking..
The Digital Omnibus on AI pushed the high-risk obligations to December 2027 and August 2028. Everything else below is already in force.
When each obligation applies
| Obligation | Applies from | Status |
|---|---|---|
| Prohibited practices, AI literacy | 2 Feb 2025 | In force |
| GPAI models, governance, penalties | 2 Aug 2025 | In force |
| Transparency duties (Art. 50) | 2 Aug 2026 | In force |
| Annex III standalone high-risk | 2 Dec 2027 | Deferred from 2 Aug 2026 |
| Annex I embedded high-risk | 2 Aug 2028 | Deferred from 2 Aug 2027 |
The same instrument narrowed the definition of "safety component" and largely excluded AI in Machinery Regulation products from high-risk classification. Medical devices, IVDs, and toys remain in scope.
Why now, not 2027
Plan your compliance work
On the day the obligations apply, your technical file must describe a post-market monitoring system that is already in place, and you must hold at least six months of logs. A purchase order on the deadline satisfies neither.
Conformity assessment.
Notified body queues for regulated products currently run six to twelve months. That work starts before the logs are complete, not after.
Writing the file.
Annex IV point 9 asks you to describe the monitoring system and its plan. You cannot describe what you have not run.
Realistic instrumentation date for a 2 Dec 2027 obligation is Q1 2027. That puts the decision roughly two quarters out.
Your date depends on how the system is classified. Work out yours in six questions.
Start a proof of conceptArticle mapping
What we provide
Six provisions concern what the system does once it is in use. These are the ones WildEdge is built against.
Provisions WildEdge is built against
| Provision | Requirement | What WildEdge contributes |
|---|---|---|
| Art. 12Record-keeping | Automatic logging of events over the system lifetime, at a level of traceability appropriate to its purpose. | Per-inference records with timestamp, model version, device, accelerator, latency, and confidence, emitted by the SDK. |
| Art. 19Provider retention | Providers keep automatically generated logs for at least six months. | Configurable retention in an open table format, in storage you control. See the retention note below. |
| Art. 26(5), 26(6)Deployer duties | Deployers monitor operation against the instructions for use, and retain logs under their control for six months. | Drift, latency, and error-rate monitoring per model and per device, with alerting when behaviour moves. |
| Art. 72Post-market monitoring | Providers actively collect and analyse performance data throughout the system's lifetime. | Continuous collection plus a query path over the full history in SQL or natural language. |
| Art. 14(4)Human oversight | Overseers must monitor operation, stay alert to automation bias, and be able to disregard or override the output. | Accept, reject, undo, and edit events tied to the originating inference, with response latency and edit distance. Evidence that oversight happened, and a measurable automation-bias signal. |
| Annex IV, point 9Technical documentation | "A detailed description of the system in place to evaluate the AI system performance in the post-market phase in accordance with Article 72, including the post-market monitoring plan." | WildEdge is that system. You still write the description and the plan; this is what they describe. |
Art. 12 · Record-keeping
Rich Inference Telemetry
The SDK instruments models where they run, including calls that never reach a server.
# Zero-dependency Python SDK
import wildedge
client = wildedge.init(dsn="<Your DSN>")
# Inferences are tracked automatically
Art. 14 · Human oversight
Measured AI Bias
User actions stay linked to the inference, revealing whether operators reviewed, overrode, or reflexively accepted it.
0 msTime to user action5 s
"action": "reject", "latency_ms": 842
If a vendor tells you a monitoring tool makes you compliant with the AI Act, read Annex IV.
Breaches of provider and deployer obligations sit in the Art. 99 middle tier: administrative fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher. The headline 7% tier applies only to the prohibited practices in Art. 5.
Deployment and retention
Collect Evidence
Records are only useful if they are complete, attributable, and still there when someone asks.
Retention.
Art. 19 and Art. 26(6) set a six-month floor. Enterprise supports custom retention windows that meet or exceed it, along with bring-your-own object storage so the records remain yours.
Vendor-free evidence.
Records land as Apache Iceberg tables with immutable snapshots and point-in-time reads, so you can reconstruct what a given model version was doing on a given date. Stop using WildEdge and the evidence is still there, still queryable.
Deploy in your VPC or air-gapped.
VPC, on-premise, and air-gapped deployment. Ingestion, storage, and query traffic stay inside your perimeter, which is what makes the record-keeping obligation compatible with sovereignty and classification requirements.
Zero raw data capture by default.
The SDK emits structured telemetry by default. Raw inputs and outputs stay on the device unless you explicitly enable capture for a defined scope, so record-keeping does not become a new personal-data liability.
Art. 14(4)(b)
Automation bias, measured.
Overseers are required to stay alert to the tendency to over-rely on model output. That is usually asserted in a document and never checked. WildEdge records what the human actually did with each inference: whether they accepted, rejected, edited, or reported it, how long they took, how much they changed, and whether they accepted and then reverted. A fleet accepting at a median of 180 milliseconds is not being overseen, and no document will tell you that.
accept / reject / undo / edit
Time to user action
Edit distance
Linked to the originating inference
Evaluation
Questions you should ask your vendor
Record-keeping obligations outlast procurement cycles. These decide whether the evidence is still there, and still yours, on the day someone asks for it.
Where do the records physically live, and who controls that storage?
Art. 12 records describe inferences made about people. If they sit in a vendor's cloud, your record-keeping obligation has quietly created a data transfer question on top of itself.
If you stop paying, or the vendor is acquired, what happens to the evidence?
Retention obligations outlive contracts. Art. 19 sets a six-month floor, and medical device technical documentation runs ten years past the last unit shipped. Ask whether the records stay readable without the vendor.
Can it record inference that never reaches a server?
If the model runs on the device, there is no server-side call to instrument. A platform built around a serving endpoint cannot produce a record of an event it never saw.
Does the human-oversight evidence come from real users, or from internal reviewers?
Art. 14(4) concerns the person operating the system choosing to disregard or override the output. A sampling workflow or annotation queue is a proxy for that. A record of what the operator actually did is not.
Can you reconstruct what a specific model version was doing on a specific date?
"We keep the logs" and "here is the state of the record set as of 14 March" are different claims. An Art. 74 request asks for the second one.
Get started
Start the clock before the clock starts.
Instrumentation takes minutes. Accumulating the history it produces takes six months. Only one of those is under your control on the deadline.
This page summarises Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 and is provided for information only. It is not legal advice. Whether a given system is high-risk, and which obligations attach to it, depends on facts specific to that system.