Art.19 — Automatically generated logs (provider retention)
Official article title: Automatically generated logs. Source: Regulation (EU) 2024/1689
Examine this duty against your system’s use and your operator role. Keep supporting records, unresolved questions and a named reviewer’s determination together.
See how E-ARI connects evidence and decision review to governance reports.
- Who it binds
- provider
- Supporting record to examine
- a written policy. A record supports review; its presence does not establish that this duty is satisfied. Documentation cannot make a prohibited practice permissible.
- Usually owned by
- CISO
- Severity
- Major — a gap here is a finding an auditor will raise and expect a remediation plan for.
Does it apply to you?
Applicability under the Act is risk tier × operator role, not tier alone. This grid is computed by running the same function the assessment uses, so it cannot drift from what the product would tell you.
- high riskprovider
Read against Regulation (EU) 2024/1689 as amended, consolidated text 02024R1689-20260727 (consolidation 001.001, incorporating Regulation (EU) 2026/1744). What we work from