Compliance vs. Proof in Data Law

An obligation of compliance and an obligation of proof are not prepared at the same time. Practitioners of data law know this distinction better than anyone else, because a regulation has already imposed it on them.

Regulation on Data Law Compliance

Article 5, paragraph 2, of Regulation (EU) 2016/679 provides that "the controller is responsible for compliance with paragraph 1 and is able to demonstrate that it is complied with." The text does not only require that the processing be lawful: it requires that its lawful nature can be established.

AI Regulation Adds Timeframe

Regulation (EU) 2024/1689 establishing harmonized rules concerning artificial intelligence takes this mechanism for the deployer of a high-risk system. It adds what the 2016 regulation did not contain: a numerical duration. It is this number that shifts the schedule, and it is this that should structure the advice given today.

Obligations for AI Deployers

Article 26 of the regulation lists the obligations of the deployer. It is usually read as a compliance program. Read a second time, asking simply "by what would this obligation be established before a third party?", it reads like a list of documents.

Technical and Organizational Measures

Paragraph 1 requires the deployer to take "appropriate technical and organizational measures to ensure that they use these systems in accordance with the accompanying user instructions of the systems." An organizational measure is not observed: it is written, dated, and attributed.

Human Oversight Requirements

Paragraph 2 provides that deployers "entrust human control to physical persons who have the necessary skills, training, and authority as well as the necessary support." The formulation is an act of designation: it requires a named person, and three distinct qualities in her.

Data Input and Relevance

Paragraph 4 provides that, "to the extent that the deployer exercises control over the input data, it ensures that these are relevant and sufficiently representative with respect to the purpose of the high-risk AI system." The diligence here concerns a technical operation of which, after the fact, only what has been recorded will remain.

Monitoring and Incident Reporting

Paragraph 5 requires deployers to monitor the operation of the system and, when they have reasons to consider that a use in accordance with the instructions could lead to a risk under Article 79, paragraph 1, to inform "without undue delay" the supplier or distributor as well as the relevant market supervision authority, and to "suspend the use of this system."

Log Retention Obligations

Paragraph 6 is the most concrete of the article, and the most often overlooked: the deployers "ensure the keeping of the logs automatically generated by this high-risk AI system to the extent that these logs are under their control, for a period adapted to the purpose of the high-risk AI system, of at least six months."

Cooperation with Authorities

Paragraph 12 finally requires deployers to cooperate "with the concerned competent authorities on any measure taken by these authorities with respect to the high-risk AI system in order to implement this regulation." An obligation of cooperation is measured by what one is able to provide.

Application Date and Its Implications

Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, states in its recital 40 that "it is therefore appropriate to set the date of entry into application of sections 1, 2, and 3 of Chapter III to 2 December 2027." Article 26 is in section 3 of this chapter.

Log Retention Window

If an organization is questioned on 2 December 2027 on the use of a system falling under Article 26, the window of logs it must be able to maintain does not start on that day: six months of retention, counted from this date, go back to the beginning of June 2027.

Legal Objections and Practical Risks

A lawyer will object, and he will be right on the formal ground: the obligation of paragraph 6 is a retention obligation, not a retroactive production obligation. An organization that starts keeping its logs on the morning of 2 December 2027 does not violate any provision that day.

Client and Regulatory Demands

The client comes first, and he does not know the entry into force date. A supplier safety questionnaire, a contractual annex, a public or private tender can require today the inventory of AI systems used in the performance of the service, the name of the supervisor and the retention period of the logs.

Judicial and Insurance Considerations

The judge comes last and he rules on documents. His office is not to verify compliance: it is to assess diligence, at a date, in view of what is produced. The insurer, for his part, poses the same questions at the stage of risk declaration, and again at the stage of the claim.

Human Oversight and Organizational Power

Paragraph 2 deserves a stop, because a word there does a legal work that operational translations almost always lose. The deployer must entrust human control to physical persons who have "the necessary skills, training, and authority as well as the necessary support."

What the Compliance File Must Contain

A file that responds to Article 26 contains, at a minimum: the dated inventory of AI systems actually in service — and not the list of those that have been authorized, which is a different document and almost always shorter.

The Right Question to Ask

"Are you compliant?" is a question to which an organization always answers yes, in good faith, and whose answer has no probative value. The useful question is otherwise: what can you produce today, for what period, and before whom?