No law and no logging standard we have read says an AI log must record which rule decided and which provision of law that rule applies. This post is not going to claim otherwise. It makes a narrower point: several explanation duties already in force or arriving soon cannot be met for a past decision unless that information was written down when the decision was taken.
What the logging rules say
The EU AI Act's record-keeping article, Article 12, says what logs are for and lists concrete fields only for remote biometric identification. It does not ask for the rule or the legal basis of each decision. The public guide from the Spanish supervisory agency, AESIA Guía 12, lists nineteen common attributes of a record; none is the rule applied or the provision behind it. We go through both, and the standards in progress, in what the EU logging standard will and will not tell you.
What the explanation duties say
- EU AI Act, Article 86. A person subject to a decision taken by a deployer on the basis of the output of a high-risk AI system listed in Annex III, other than the critical-infrastructure systems in point 2, has the right to obtain "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken", where the decision has legal or similarly significant effects that the person considers adverse to their health, safety or fundamental rights. Under Article 86(3) the right applies only where Union law does not already provide it, as the GDPR often does for a decision based solely on automated processing. Article 86.
- GDPR, Articles 15(1)(h) and 22. Where a decision is based solely on automated processing, the data subject has a right to "meaningful information about the logic involved", and Article 22(3) adds the right to obtain human intervention, to express a point of view and to contest the decision. Regulation (EU) 2016/679.
- The Court of Justice, Dun & Bradstreet Austria (C-203/22, 27 February 2025). On Article 15(1)(h), the Court held that the controller must describe the procedure and principles actually applied, so that the person can understand which of their personal data were used. Handing over an algorithm is not enough. Case C-203/22 on curia.europa.eu.
- Consumer Credit Directive, Article 18. From 20 November 2026, where a creditworthiness assessment involves automated processing, the consumer can ask for human intervention, including an explanation of the assessment. Directive (EU) 2023/2225.
- Platform Work Directive, Article 11. People doing platform work get a right to human review of significant decisions taken or supported by automated systems, and a written statement of reasons for decisions such as restricting or suspending an account. Directive (EU) 2024/2831.
Why that needs the law per decision
Each of these duties is about one past decision. "The procedure and principles actually applied" means the ones applied to that person, at that time. Rules change: a policy is tightened, a threshold moves, a reading of an article is corrected. Months later, the current rules say nothing reliable about which rule applied then.
So the facts an explanation has to rest on are best written at the moment of the decision: which rule fired, which provision it applies, and which version of the rule set was running. Written then, they are a record. Reconstructed later, they are an argument.
That is not the same as saying the law requires the field. It does not. The AI Act's own record-keeping duty for Annex III systems applies from 2 December 2027, and even then it names purposes, not this field. The duty to explain is what makes the field worth having.
What it looks like in a record
In the record ComplyEdge writes, every decision carries the digest of the rule set that decided, and when a rule fires, its rule ID and the citation of the provision it applies. The rule's citation names the provision in the open ComplyEdge rule set, and the digest tells a reviewer whether the rules changed between two decisions. The record holds no text, so the explanation also needs your own copy of what was said; the event_id joins the two, as set out in keep your text, we keep the proof.
A record does not write the explanation, and it does not make a decision lawful. It means that when someone asks why, the answer starts from what was recorded at the time, not from what the rules say today. This is not legal advice.