Somewhere in your stack, an agent has already produced the number that will one day sit in front of an auditor. It computed the figure — or generated it; you may not know which — someone pasted it into a deck, and the deck shipped. Months later arrives the question every production AI system eventually gets: where did this number come from, and would we get it again today?
Most teams answer with a transcript. In a Q1 2026 survey of 420 organizations running AI agents in production, only 17% could reconstruct the full sequence of tool calls, inputs, and outputs behind a specific agent task after the fact (AgentNode, 2026). The other 83% had partial logs, no logs at all, or logs that captured the model's reasoning but not what it actually invoked. A transcript and a feeling.
The record is becoming law
For a while this was an engineering embarrassment. It is about to be a legal one.
The EU AI Act requires high-risk AI systems to technically allow — designed in, not bolted on — "the automatic recording of events (logs) over the lifetime of the system" (European Commission, 2024). Manual record-keeping does not satisfy Article 12. The logs must be good enough to identify situations that may present risk or substantial modification, to support post-market monitoring, and to monitor how the system actually operates. For remote biometric identification, the article names the minimum outright: each period of use, the reference database checked, the input data that led to a match, the natural persons who verified the result. That is not "keep some logs." That is reconstruct the decision.
The dates are close. The Act entered into force on 1 August 2024; prohibitions applied from February 2025, general-purpose model obligations from August 2025 — and the high-risk obligations, Article 12 among them, apply from 2 August 2026 (Future of Life Institute, 2026). Eight days from the date on this post. High-risk systems embedded in regulated products (Annex I) follow in August 2027.
Retention has a floor, too. Providers must keep automatically generated logs for at least six months, and Article 26(6) puts the mirror duty on deployers — longer where other law such as GDPR requires, and in every case appropriate to the system's intended purpose, not just the minimum (artificialintelligenceact.eu, 2024).
None of this arrives in a vacuum. GDPR Article 30 has expected written records of processing — purposes, categories of data, recipients, erasure time limits, security measures — since 2018, producible to the supervisory authority on request (gdpr-info.eu, 2016). SOC 2's CC7.2 expects you to monitor system components for anomalies and analyze what you find; CC7.3 expects you to evaluate whether an event compromised your objectives (AICPA, 2022). In a Type II audit those criteria are tested against log evidence spanning the whole review period — typically twelve months of it (AgentNode, 2026) — not a screenshot from the day the auditor visited.
Why "log more" fails
The reflex response is verbosity: turn on tracing, store everything, buy a dashboard. Three problems survive it.
Transcripts record what was said, not what ran. A chat log is the model narrating its own behavior. Among the 83% above, one bucket is exactly this: reasoning captured, tool invocations not. When the narration and the execution disagree, the transcript keeps a straight face — computed and generated read identically on the page. They are not the same thing.
A log you cannot re-execute is testimony, not evidence. Even teams that capture every tool call usually cannot run one again and compare, because nothing pinned the world it ran in. The SQL was generated fresh that day, against a database that has since moved on; the arithmetic was sampled from a model that was never stable to begin with. Retaining that for six months — or twelve — means storing claims longer, not making them checkable. Article 12's phrasing is exact: the system must technically allow the recording. Reproducibility that was not designed in cannot be retrofitted by a logging library.
Metadata is not correctness. The minimum viable audit record — six core fields, among them trace ID, timestamp, and agent identity (AgentNode, 2026) — establishes who and when. It says nothing about whether the number was right, or whether it would come out the same today. Research on LLM-agent observability lands in the same place: traceability has to cover the artifacts of the whole agent lifecycle, not the messages alone (CSIRO Data61, 2024).
The failure is structural. Free-form execution — a model emitting strings that something else runs — produces nothing stable enough to record, no matter how much of it you write down.
Provenance as part of the result
SQAI's answer is to make the record a property of execution rather than a feature of logging. Every executed result carries four hashes, each answering a distinct audit question:
contract_hash— what could run: the exact capability contract in force (sha256:79f1c5a6c716…).plan_hash— what the request resolved to: the validated plan, with its resolution recorded (decision_path: "exact_spec").invocation_hash— what ran, on what: the capability plus canonicalized inputs, including aninput_hashof the data as it stood.computation_hash— what came out: bound to the invocation and the value together.
The constructions are domain-separated, so no artifact can impersonate another:
invocation_hash = sha256("sqai:invocation:v1\0" + canonicalJson(identity))
computation_hash = sha256("sqai:computation:v1\0" + invocation_hash + canonicalJson(value))
Alongside the hashes rides the determinism envelope — the recorded execution environment: runtime_bundle_version 0.1.0 and its sha256, platform and architecture, precision_mode: float64, thread_count: 1, and the seed where one is required. The ten simulation capabilities that need one refuse to run without it — seed_required, not a silently different answer. Everything that could change the number is either pinned or written down.
Here is what that buys, concretely. In March, an agent computes a net present value:
finance.npv(0.1, [-1000, 300, 420, 560, 680])
→ 505.020148896933
computation_hash b74f67d0d7a594aa…
In July, the auditor asks. You replay the invocation — same typed spec, same pinned runtime — and compare hashes: b74f67d0d7a594aa… again, byte-identical. It does not matter whether the replay runs in TypeScript or Python. canonicalJson and canonical_json are a cross-language serialization contract — keys sorted, -0 normalized to 0, fixed unicode escaping — so the same value yields the same bytes yields the same hash in both. The determinism page shows two of these envelopes, months apart, side by side.
And when the replay doesn't match, that is signal. A changed source fails loudly with schema_revision_mismatch — the engine refuses to quietly compute a different number against different data and let you attribute it to the past. The mismatch names what moved.
Map that back to the obligations. Automatic recording over the system's lifetime: every executed result records itself, by construction — there is no unrecorded path, because the execution surface is 4,574 read-only capabilities with typed inputs, not free-form strings. Six or twelve months of retention: store the result envelopes; retention becomes a storage decision instead of archaeology. Evidence spanning a SOC 2 review period: the artifacts are the evidence — the answer to the auditor is a replay, not an investigation. The same pipeline produces the record for every capability, and the persistent audit trail ships with SQAI's Pro tier.
Eight days, then every audit after
The August date formally binds high-risk systems in the EU. But deadlines like this set the template for every review that follows — the SOC 2 auditor, the procurement questionnaire, your own CFO in March asking about a number from January. Agents are going to be asked to justify their answers the way employees are: with records. Most stacks cannot produce them, because generated SQL and sampled arithmetic leave nothing stable enough to record — a problem that starts well before the audit.
An answer you can replay is an answer you can defend. Everything else is a screenshot.