Skip to content

Knowledge base · AI in HR

How long do we have to keep the logs of a high-risk AI system for HR?

From 2 December 2027, as a deployer you keep the automatically generated logs under your control for a period appropriate to the intended purpose, and at least six months, unless other law provides otherwise, in particular the GDPR. If the logs contain personal data of candidates or employees, you do not keep them longer than necessary for the purpose.

Prepare; applies from 2 December 2027Trusq editorial · checked against the official textLast verified:

Next step: Record your HR AI tools in Trusq

The rule

You keep the logs that the high-risk system generates automatically, to the extent they are under your control, for a period appropriate to the intended purpose, of at least six months, unless applicable Union or national law provides otherwise [1]. For HR systems that applies from 2 December 2027 [2].

What logs are

A high-risk system automatically records events over its lifetime [3]. The provider also keeps the logs under its control for at least six months [4]. Agree which logs are held by you and which by the supplier.

Overlap with the GDPR

Logs about applicants or employees are often personal data. You do not keep those longer than necessary for the purpose [5]. Record the period and the reason, for example in your DPIA.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Logging AI Act 12, AI Act 19, AI Act 26

Sources

  1. [1] AI Act Art. 26(6), first subparagraph (AI Act, Regulation (EU) 2024/1689). Deployers keep the automatically generated logs for at least six months, unless other law provides otherwise.
    Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data.
    Source, retrieved on 3 October 2026.
  2. [2] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 3 October 2026.
  3. [3] AI Act Art. 12(1) (AI Act, Regulation (EU) 2024/1689). High-risk systems record events (logs) automatically.
    1. High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system.
    Source, retrieved on 3 October 2026.
  4. [4] AI Act Art. 19(1) (AI Act, Regulation (EU) 2024/1689). Providers keep the logs under their control for at least six months.
    1. Providers of high-risk AI systems shall keep the logs referred to in Article 12(1), automatically generated by their high-risk AI systems, to the extent such logs are under their control. Without prejudice to applicable Union or national law, the logs shall be kept for a period appropriate to the intended purpose of the high-risk AI system, of at least six months,
    Source, retrieved on 3 October 2026.
  5. [5] GDPR Art. 5(1)(e) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Personal data is not kept longer than necessary for the purpose.
    (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
    Source, retrieved on 3 October 2026.

Related questions

What duties do we have from December 2027 as a deployer of a high-risk HR system?Do we have to carry out a DPIA before we use AI in recruitment or personnel management?What do we agree with the supplier of an AI tool for HR?

Next step

Register the AI tools you use in HR. Trusq shows per tool which duties may apply and sets them up as actions, with the evidence that is expected and the source.

Record your HR AI tools in Trusq

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.