EU AI Act Article 12 Logging Requirements for ChatGPT API

The EU AI Act's Article 12 requires “automatic recording of events” for high-risk AI systems. If you use the ChatGPT API (or any LLM API) as part of a system deployed in the EU for hiring, credit scoring, healthcare, or education, you need compliant logging before August 2, 2026.

Does Article 12 Apply to Your ChatGPT API Usage?

Article 12 applies to high-risk AI systems as defined in Annex III of the AI Act. If your ChatGPT API integration falls into any of these categories, you need compliant logging:

• Employment & HR — resume screening, interview analysis, performance evaluation
• Credit & insurance — creditworthiness assessment, risk scoring, claims processing
• Education — student assessment, admission decisions, learning path optimization
• Healthcare — diagnostic assistance, treatment recommendations, triage
• Law enforcement & migration — risk assessment, document analysis
• Critical infrastructure — safety-related decision support

What Article 12 Requires You to Log

Article 12(1) states the system must have “logging capabilities that enable the recording of events relevant to identify risk-related situations.” For ChatGPT API integrations, this means logging:

Key Compliance Requirements

Build It Yourself vs. Use a Compliance Gateway

You can implement Article 12 logging in your application code (wrap every API call with a logging layer) or use an AI gateway that handles it automatically.

import hashlib, json, datetime
from openai import OpenAI

client = OpenAI()

def logged_completion(messages, model="gpt-4.1", **kwargs):
    input_hash = hashlib.sha256(
        json.dumps(messages, sort_keys=True).encode()
    ).hexdigest()

    response = client.chat.completions.create(
        model=model, messages=messages, **kwargs
    )

    output_hash = hashlib.sha256(
        response.choices[0].message.content.encode()
    ).hexdigest()

    log_entry = {
        "timestamp": datetime.datetime.utcnow().isoformat() + "Z",
        "model": response.model,
        "input_fingerprint": input_hash,
        "output_fingerprint": output_hash,
        "tokens": {
            "input": response.usage.prompt_tokens,
            "output": response.usage.completion_tokens,
        },
    }
    # TODO: Write to tamper-evident log store
    # TODO: Implement hash-chaining
    # TODO: Handle retention & export
    return response

This works for a proof of concept, but production compliance requires tamper-evident storage (hash-chaining), export APIs for regulatory inspection, deletion protection, and retention policies. That's significant infrastructure to build and maintain.

Gateway approach: Two lines of code

AI Security Gateway automatically generates hash-chained, tamper-evident audit logs for every API call. Enable it by changing your base URL — no additional logging code needed.

from openai import OpenAI

client = OpenAI(
    base_url="https://api.aisecuritygateway.ai/v1",
    api_key="aisg_your_key_here",
)

# Every call is automatically logged with:
# - SHA-256 input/output fingerprints (not raw content)
# - Hash-chained tamper-evident records
# - Exportable via authenticated API
# - Deletion-protected storage
response = client.chat.completions.create(
    model="gpt-4.1",
    messages=[{"role": "user", "content": "Analyze this application..."}]
)

Compliance Timeline