Open-Source Article 12 Logging Library for EU AI Act Compliance

What This Is

An open-source TypeScript library that provides Article 12-compliant logging infrastructure for AI systems affected by the EU AI Act. It's specifically designed for Node.js applications using the Vercel AI SDK.

Key Details

The library addresses the EU AI Act's Article 12 requirements, which take effect in August 2024 and mandate automatic event recording with six-month retention for high-risk AI systems. Legal commentators have interpreted this as requiring append-only ledger functionality rather than standard application logging.

The implementation includes:

• Middleware that wraps AI models to capture every inference call
• Structured JSONL logging to your own S3 bucket or local filesystem
• SHA-256 hash chaining between entries for tamper detection
• Automatic enforcement of 180-day retention minimum
• CLI tool to reconstruct specific decisions and verify log integrity
• Coverage command that identifies potential logging gaps (omissions are noted as a bigger practical risk than edits)

The library is deliberately simple in design: TypeScript-based, targeting Vercel AI SDK middleware, supporting S3 or local filesystem storage, and using linear hash chaining. It also works with the Mastra agentic framework, and the maintainer welcomes PRs to expand integrations.

As noted in the HN discussion, the library provides tamper-evident logging rather than tamper-proof protection. It detects modification but doesn't prevent wholesale chain reconstruction by someone with storage access. The design assumes defense-in-depth with S3 Object Lock (Compliance mode) at the infrastructure layer and hash chain verification at the application layer. External timestamping (like OpenTimestamps or RFC 3161) could be added as an optional feature for independent temporal anchoring.

According to the developer's regulatory interpretation, Article 12 requires "automatic recording" that enables monitoring and reconstruction, with current guidance not mandating tamper-proof storage—only trustworthy, auditable records.