What records must an AI agent keep to satisfy a regulator?

The record set, in one paragraph.

The regulator's question is narrow. Show me what the agent did, prove the record is intact, and prove you kept it long enough. Three regimes ask it three ways. The EU AI Act asks for an automatic event record over the lifetime of the high-risk system. NYDFS asks for an audit trail that detects cybersecurity events at the operation level. US bank model risk guidance asks nothing of the agent itself: SR 26-2 § II footnote 3 places generative and agentic AI models outside its scope, so no US model-risk clause compels a per-decision record from a bank AI agent — the two clauses that do compel one are the EU's and New York's. Warrant answers all three with a single unit — a record mapped to a specific obligation, kept for at least the retention floor, independently verifiable without contacting Warrant — and that convergence is Warrant's conservative design choice, not a requirement the three regimes share.

This entry is structured as the regulator's question, the record artifact that answers it, and the article that demands it. Run the list against a production agent and the gaps are the gaps an inspection finds first.

EU AI Act Article 12 · the event record over the lifetime.

Article 12(1) binds providers of high-risk AI systems to automatic event recording over the lifetime of the system. For Annex III standalone high-risk systems the application date is 2 December 2027 (deferred from 2 August 2026 to 2 December 2027 by the Digital Omnibus; Regulation (EU) 2026/1744, OJ 24 July 2026). Non-compliance is reachable under Article 99(4) at up to EUR 15 million or 3 percent of global annual turnover. The line-by-line read is in Article 12, line by line.

What the record has to capture is set by Article 12(2). Paragraph 2(a) covers situations that may result in the system presenting a risk under Article 79(1) or a substantial modification. Paragraph 2(b) covers facilitation of post-market monitoring under Article 72. Paragraph 2(c) covers monitoring of the operation under Article 26(5). The record is event-shaped, not request-shaped: it must be addressable by deployment, by version, and by the action the agent took, not just by the HTTP call that carried it.

For an autonomous agent that takes many consequential actions in one run, whether the record is one running log or a discrete record per action is the open boundary. That question is read in full at does Article 12 require a record per agent action.

The retention floor · at least six months, on two sides.

Article 19(1) is the provider floor. The provider keeps the Article 12 logs for a period appropriate to the intended purpose, of at least six months, unless Union or national law requires longer. Article 26(6) is the deployer mirror. The deployer keeps the logs that come under its control, for the same appropriate period, of at least six months. The two floors run in parallel. The detail of the deployer side is in the Article 26 deployer obligations, line by line.

Six months is a floor, not a ceiling. Sectoral law pushes the actual horizon longer wherever it speaks. MiFID II Article 16(7) requires records of telephone conversations and electronic communications relating to transactions and client orders, and those records shall be kept for a period of five years and, where requested by the competent authority, for a period of up to seven years. The Medical Device Regulation Article 10(8) runs at least ten years after the last device covered by the declaration of conformity was placed on the market, and at least fifteen for implantable devices. A six-month rolling window destroyed twelve months ago is not an answer to a regulator's request twelve months and one day after the event. The phrase in particular in Union law on the protection of personal data is the GDPR carve-back: where logs contain personal data, storage-limitation under GDPR caps the upper bound, and the deployer settles on a per-use-case number that satisfies both regimes.

NYDFS · the audit trail at the operation level.

The 16 October 2024 NYDFS Industry Letter imposes no new rule. In its own words it "does not impose any new requirements beyond obligations that are in DFS's cybersecurity regulation codified at 23 NYCRR Part 500", and it explains instead how Covered Entities should use the Part 500 framework against four AI-related risk categories, working them mainly through § 500.11, third-party and vendor management. Note what it does not do: the Letter cites neither § 500.6 nor § 500.17. Reading § 500.6(a)(2) onto an AI deployment is an inference from the regulation's own text, not an instruction in the Letter, and it is marked as Warrant's throughout. Read against an AI agent, a standard application log does not satisfy: it records that a request returned a status code, not what was accessed or under what authorization. The full reading is in standard API call logs do not satisfy 23 NYCRR § 500.6.

The audit trail has to answer four questions about each operation the agent performed. What was accessed — the specific nonpublic-information element, not a request hash. By which agent — the model identifier and provider, not "the chatbot". Under what authorization — the policy and purpose limitation the action satisfied. When — a timestamp the covered entity cannot retroactively change. The retention side is its own clock: § 500.6(b) runs five years for the (a)(1) reconstruction records and three years for the (a)(2) audit-trail records.

SR 26-2 · the documentation obligation that left.

The fourth pillar of US bank model risk guidance is documentation, and in 2026 it got weaker on both axes. SR 26-2, issued 17 April 2026 (OCC Bulletin 2026-13) by the Federal Reserve / OCC / FDIC, is the current guidance: it supersedes and replaces SR 11-7 (the 4 April 2011 letter, with OCC Bulletin 2011-12 the same day, adopted by FDIC through FIL-22-2017) and SR 21-8. Footnote 3 to its § II states that generative AI and agentic AI models are not within the scope of the guidance. And the documentation subsection quoted above is the whole subsection: two sentences, both permissive, and the SR 11-7 standard that documentation be detailed enough for parties unfamiliar with a model to understand how it operates did not survive into the new text. A deployer looking for the clause that forces a per-decision record out of a US bank agent will not find one here. The line-by-line read is in SR 26-2 / SR 11-7, line by line.

For an AI agent, the documentation record is three layers. The development record — the agent's tool-selection logic, prompt template, retrieval policy, scope of use, and limitations, which are bank artifacts even when a vendor supplies the foundation model. The validation record — the ongoing-monitoring cadence and the triggers that force re-validation. And the per-decision record — what the agent did and the alternatives it weighed, which no US model risk letter now requires and which the examiner will nonetheless ask about. An agent excluded from the guidance is not an agent excluded from examination. Footnote 1 keeps supervisory action available for unsafe or unsound practices, and the bank arrives at that conversation holding whatever record it decided to keep.

The checklist · question, record, clause.

The mapping below is the whole entry in one table. Each row is a question a regulator asks, the record artifact that answers it, and the clause that demands it. A deployer can run this against a production agent and treat any empty record cell as a finding.

Read the Clause column as the demand, not as what a package cites. The § 500.6(a)(2) rows are Warrant's reading of the regulation. The obligation corpus carries no § 500.6 table, so a package reports NYDFS Part 500 as classified and in scope, not evaluated, and no package asserts a § 500.6 citation.

The structural choice a deployer makes now is whether each of these records lives inside the agent or in a record layer downstream of the decision. A record mapped to a specific obligation, kept past the retention floor, and independently verifiable without contacting Warrant satisfies the question in every column at once.

Questions a compliance officer asks first.

Read the source directly.

• Regulation (EU) 2024/1689 · EUR-Lex CELEX:32024R1689
• Article 12 record-keeping · annotated text
• Article 19 automatically generated logs · retention
• Article 26 obligations of deployers of high-risk AI systems
• 23 NYCRR Part 500 · Second Amendment (1 November 2023, PDF)
• Federal Reserve / OCC / FDIC SR 26-2 · Revised Guidance on Model Risk Management (17 April 2026) · current; supersedes SR 11-7
• Federal Reserve SR 11-7 · Supervisory Guidance on Model Risk Management (2011) · superseded predecessor
• Article 12, line by line · the record obligation read in full
• Article 26 deployer obligations · who keeps the records
• NYDFS § 500.6(a)(2) · why standard logs do not satisfy

Authored by Warrant Compliance, the regulatory-analysis function at Warrant. [email protected]. Editorial commentary on regulatory text. Not legal advice. The verbatim quotations of Article 12(1) and Article 19(1) reflect the official English-language text of Regulation (EU) 2024/1689 as published in the Official Journal of the European Union on 12 July 2024. The 23 NYCRR § 500.6(a)(2) text reflects the Second Amendment effective 1 November 2023. The documentation quotation is the § VI Documentation subsection of the SR 26-2 attachment in full, and footnote 3 to § II is quoted as published, both from federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf, retrieved 28 July 2026. SR 26-2 (17 April 2026, OCC Bulletin 2026-13) supersedes SR 11-7 (4 April 2011) and SR 21-8.