aai-institute / aai-institute/practical-ai-act
Inference log section missing: GDPR Art. 17 erasure conflict for logs containing user input data
- Langage dominant
- Python
- Étoiles
- 21
- Forks
- 3
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
The [inference log page](https://practical-ai-act.eu/latest/engineering-practice/inference-log/) covers Art. 12(1), 12(2), Art. 19, Art. 26(5), Art. 26(6), and Art. 72 thoroughly. There is a compliance gap that the current guidance doesn't address: inference logs that capture user input data (the common case) are simultaneously **Art. 12 retention-required evidence** and **GDPR Art. 17 erasure targets**.
**The conflict:**
- Art. 12 / Art. 19: logs must be retained to identify risks and support post-market monitoring
- GDPR Art. 17: if the user query contains personal data (a name, a health condition, a financial situation), the user can request erasure of that data
When a deployer receives a DSAR against a row that is also compliance evidence, a standard "delete-on-request" response destroys records the deployer is legally required to retain. A "retain-everything" policy violates GDPR. TTL-based retention policies cannot resolve this conflict because they have no visibility into *why* a log entry exists.
**The gap in the current guidance:**
The inference log section correctly notes that logs should capture input data for drift detection and hazard identification, but it does not flag that those same inputs may carry personal data subject to Art. 17 — or that the deployer needs to decide *at write time* how to handle a future DSAR against a compliance-required row.
**Suggested addition:**
A short note under the existing "Compliance Info" section on the inference log page flagging:
1. Inference logs containing personal data are dual-obligation records: Art. 12 retention + Art. 17 erasure
2. The conflict must be resolved at write time (not at deletion time) by annotating each log entry with its record class and retention basis
3. A reference implementation: the [lifecycle_class spec](https://github.com/agent-morrow/morrow/blob/main/lifecycle_class/spec.md) (MIT license) provides a JSON Schema-validated annotation format for this: `record_class: ["compliance", "identity"]`, `compliance_anchor.retain_until`, and a `subject_chain` linking the entry to affected data subjects
The appliedAI Institute's audience of SMEs deploying high-risk AI systems under the August 2026 deadline is exactly the population likely to discover this conflict during a DSAR they weren't expecting — and currently the guide doesn't prepare them for it.
Happy to submit a PR with the suggested text if this direction is accepted.
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
L’issue consiste à ajouter une note à la page du journal d’inférence du guide. Commencez par localiser le fichier source de cette page, probablement dans le répertoire de documentation du dépôt. Consultez la section existante 'Compliance Info' pour comprendre le contexte. L’ajout suggéré concerne des concepts juridiques et techniques (GDPR, AI Act, formats d’annotation) ; recherchez donc la 'lifecycle_class spec' liée afin de comprendre l’implémentation proposée. La tâche consiste à rédiger et à intégrer le texte suggéré, en veillant à ce qu’il s’insère dans le ton et la structure du guide.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Domaine
- documentation
- Type d'issue
- Documentation
- Difficulté
- 2/5
- Temps estimé
- 1-3 heures
- Activité
- À l'abandon
- Clarté
- Clairement spécifiée
- Accessibilité débutants
- 45/100