WARRANTThe artefact and the manual.
Article 12 binds the provider to record events automatically over the lifetime of the high-risk AI system. Article 13 binds the same provider to deliver an interpretive layer for those records. Without 13, the logs from 12 are technically present but interpretively useless. A column of timestamps, action types, and tensor shapes does not, on its own, tell a deployer whether the system behaved within its intended purpose, whether human oversight fired correctly, or whether an output sits inside the documented accuracy envelope.
The opening of Article 13 paragraph 1 fixes the principle:
Read alongside Article 12(1), the structure becomes explicit. Article 12(1) says the system shall technically allow for the automatic recording of events. Article 13(1) says the system shall be designed... to ensure that their operation is sufficiently transparent to enable deployers to interpret. One records. The other interprets. The two articles describe the two halves of a single regulator-readable artefact.
Placement matters. Article 13 sits inside Section 2 of Chapter III, the requirements the provider must satisfy before placing the system on the Union market. Article 16(b) reads those requirements back as a provider obligation. Article 99(4)(a) reads Article 16 back as a fineable failure. The same three steps that take Article 12 to the EUR 15 million ceiling take Article 13 there too.
Paragraph 1 · the transparency principle.
Three load-bearing phrases. Sufficiently transparent sets a functional bar, not a maximum disclosure mandate. Interpret the system's output ties transparency to the operational read of decisions, not to the model's internals. Use it appropriately hooks the obligation into the deployer's downstream duty under Article 26.
Recital 72 of the regulation makes the operational frame explicit: transparency exists so that providers and deployers can comply with their respective obligations, and so that affected persons can understand how decisions relating to them are made. It is not transparency for its own sake. It is transparency in the service of accountability.
Paragraph 2 · the seven mandatory elements.
Paragraph 2 fixes the format, paragraph 3 fixes the content. Together they describe what regulators will read.
Paragraph 3 then enumerates the seven information elements the instructions for use must contain:
Notice the structural shape. Three of the seven elements are about the system's behaviour at decision time (b, d, f). Two are about its boundaries (c, g). Two are about the responsible party and the resources (a, e). The instructions are an operating manual for a regulated artefact, not a marketing description.
Paragraph 3 · accuracy, robustness, cybersecurity.
Paragraph 3 sub-clause (b) is the longest in Article 13 and carries the heaviest performance disclosure burden. It requires the provider to document:
The accuracy and robustness language pairs directly with Article 9 risk management and Article 15 accuracy, robustness and cybersecurity. Article 13 is where the testing and validation results actually leave the provider's premises and reach the deployer. The accuracy metric is not aspirational. It is the metric the system was tested against and the metric the deployer can expect in production within the documented operating conditions.
Sub-clause (b) also requires disclosure of any known or foreseeable circumstance, related to the use of the high-risk AI system in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to risks to the health and safety or fundamental rights. This is the foreseeable-misuse vector, and it carries direct implications for agentic systems treated in section 09 below.
Why 12 and 13 are one obligation in two articles.
The cross-reference is explicit and load-bearing. Article 13(3)(f) requires the instructions for use to include the following:
The verb chain is the regulator's specification: collect, store, interpret. Three operations on the same artefact. Article 12 mandates that the artefact exists. Article 13 mandates that the deployer is told how to do all three operations on it. Without the Article 13 instructions, the Article 12 logs are technically present but interpretively useless.
The pairing closes a loop on the deployer side. Article 26(6) requires the deployer to keep the logs automatically generated by the high-risk AI system to the extent such logs are under their control. The mechanism for keeping them, and the schema for reading them, comes from the provider's Article 13 instructions. The triangle of obligations is closed: Article 12 produces, Article 13 explains, Article 26 retains and uses.
This is also why instructions and logs co-author the technical documentation file under Annex IV. Annex IV(1)(g) requires the instructions for use referred to in Article 13. Annex IV(2)(d) requires the logs automatically generated by the high-risk AI system as referred to in Article 12. The same file binds them.
One evidence package, both obligations.
Warrant produces both halves of the pairing in a single evidence package. The evidence of record carries (1) the per-decision log that satisfies Article 12 and (2) the per-decision interpretive layer that satisfies Article 13. The interpretive layer names which sub-clause of which obligation was engaged on each action, the operational envelope the system was running in, and the human oversight checks that fired or did not.
A live sample sits at /v/7de85ceaeac42a47. The package contains the trace, the classification, the per-action authorisation assessment, the obligation map back to Article 13(3)(a) through (g), and a record that is independently verifiable without contacting Warrant. The file is the Annex IV technical documentation entry, not a separate marketing artefact.
The architectural choice is deliberate. Splitting Article 12 logging from Article 13 instructions across two systems creates a co-ordination gap exactly where the regulator reads. A single record mapped to the Article 13 obligations, independently verifiable without contacting Warrant, removes the gap. The deployer reads one document. The national competent authority reads one document. The record is independently verifiable as one record.
What the deployer actually receives.
Annex IV requires the technical documentation file. The deployer reading a Warrant package, at the point of system handover or at the point of regulator inquiry, gets three things layered into one PDF.
- The trace · the per-decision log of inputs, outputs, intermediate tool calls, and timestamps. This is the Article 12 fulfilment.
- The interpretive layer · the classification (which Annex III area), the extracted actions, the per-action authorisation assessment, and the obligation map citing Article 13(3)(a) through (g). This is the Article 13 fulfilment.
- The verification layer · the package is independently verifiable without contacting Warrant, and any edit shows up at confirmation time. This is the Article 13(3)(b) cybersecurity disclosure made operational.
The verification layer is not decorative. Article 15(5) requires that high-risk AI systems be resilient against attempts by unauthorised third parties to alter their use, outputs or performance. A record that is independently verifiable without contacting Warrant is the post-hoc analogue of that requirement. The reader confirms the record, not the producer's good word.
Article 13 sub-clauses mapped to evidence fields.
Each sub-clause of Article 13 paragraph 3 maps to a specific structured field inside the evidence package. The deployer or the regulator can read the package by clause number and find the corresponding artefact.
| Art. 13 sub-clause | What evidence must show | Warrant field |
|---|---|---|
| § 3(a) | Provider identity and authorised representative | metadata.provider_did |
| § 3(b) | Capabilities, limits, accuracy, robustness, cybersecurity | classification.scope_envelope |
| § 3(c) | Pre-determined changes, version at decision time | metadata.model_version |
| § 3(d) | Human oversight measures, when human-in-loop fired | trace.actions[].oversight_check |
| § 3(e) | Compute and hardware resources | metadata.runtime_fingerprint |
| § 3(f) | Log retrieval and interpretation mechanisms | regulator_evidence.audit_trail_pointer |
| § 3(g) | Lifetime, retention horizon, update cadence | metadata.retention_until |
The table is the spec. A deployer reading the package by clause number finds the corresponding artefact in a known location. A national competent authority running an Article 21 access request finds the same. The structure is the discharge.
Article 13(3)(b) and the agentic AI vector.
Article 13(3)(b) requires the provider to disclose any known or foreseeable circumstance, related to the use of the high-risk AI system in accordance with its intended purpose or under conditions of reasonably foreseeable misuse. For classical machine-learning systems, the foreseeable-misuse vector is well-understood: distribution shift, adversarial inputs, data drift outside the validation envelope.
For agentic AI systems, three new vectors require disclosure. Each is foreseeable in the regulatory sense: the technical literature describes them, the threat is published, and a reasonable provider should know.
- Prompt injection within trace data. A user input or a downstream tool output that contains adversarial instructions can hijack the agent's chain of action. The disclosure must say what the system does when it detects suspicious input patterns and what residual exposure remains after detection.
- Tool misuse. An agent with access to a transactional API can be steered into actions outside its intended purpose by a sufficiently well-crafted prompt. The disclosure must cover the action allow-list, the authorisation envelope, and the rollback path.
- System-prompt leak. An agent that exposes its system prompt under adversarial pressure leaks the boundary of its own operating constraints. The disclosure must cover the leak surface and the system-prompt redaction strategy.
Warrant's adversarial robustness eval treats all three vectors as in-scope under Article 13(3)(b). The eval methodology and its results sit at /blog/regulator-grade-evals. The output of the eval becomes a structured disclosure section inside the instructions for use. Agentic AI does not get a discount on Article 13. It gets an expanded disclosure surface.
Application timing · 2 August 2026 and the May 2026 Omnibus.
Article 113 of the AI Act as enacted sets the application date for high-risk AI systems under Annex III at 2026-08-02. On 2026-05-07 Council and Parliament negotiators reached a provisional political agreement, the Digital Omnibus on AI, deferring that date to 2027-12-02. The provisional agreement is not yet binding law. Until Council formal endorsement, Parliament formal endorsement, legal-linguistic revision, and publication in the Official Journal complete, the 2026-08-02 date in the AI Act as enacted continues to govern. After whichever date binds, a provider that places an Annex III high-risk AI system on the Union market without an Article 13-shaped instruction-for-use deliverable is exposed to Article 99(4) at EUR 15 million or 3 percent of global turnover, whichever is higher.
The Warrant evidence-package format is built to land inside the Annex IV technical documentation file. The instructions cover all seven sub-clauses by structure, not by promise. The record is tamper-evident against post-hoc editing, and its date of issue is independently verifiable without contacting Warrant.
Questions a compliance officer asks first.
Read the source directly.
- Regulation (EU) 2024/1689 · EUR-Lex CELEX:32024R1689
- Article 13 transparency and provision of information to deployers · annotated text
- Article 12 record-keeping · paired obligation
- Article 14 human oversight · cross-referenced by 13(3)(d)
- Article 26 obligations of deployers of high-risk AI systems
- Annex IV technical documentation file
- Article 99 penalties
- Per-obligation Warrant evidence field mapping
Authored by Warrant Compliance, the regulatory-analysis function at Warrant. [email protected]. Editorial commentary on regulatory text. Not legal advice. The verbatim quotations of Article 13 reflect the official English-language text of Regulation (EU) 2024/1689 as published in the Official Journal of the European Union on 12 July 2024.