aai-institute / aai-institute/practical-ai-act

Inference log section missing: GDPR Art. 17 erasure conflict for logs containing user input data

Đang mở
#149 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Python
Star
21
Fork
3
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

The [inference log page](https://practical-ai-act.eu/latest/engineering-practice/inference-log/) covers Art. 12(1), 12(2), Art. 19, Art. 26(5), Art. 26(6), and Art. 72 thoroughly. There is a compliance gap that the current guidance doesn't address: inference logs that capture user input data (the common case) are simultaneously **Art. 12 retention-required evidence** and **GDPR Art. 17 erasure targets**.

**The conflict:**
- Art. 12 / Art. 19: logs must be retained to identify risks and support post-market monitoring
- GDPR Art. 17: if the user query contains personal data (a name, a health condition, a financial situation), the user can request erasure of that data

When a deployer receives a DSAR against a row that is also compliance evidence, a standard "delete-on-request" response destroys records the deployer is legally required to retain. A "retain-everything" policy violates GDPR. TTL-based retention policies cannot resolve this conflict because they have no visibility into *why* a log entry exists.

**The gap in the current guidance:**
The inference log section correctly notes that logs should capture input data for drift detection and hazard identification, but it does not flag that those same inputs may carry personal data subject to Art. 17 — or that the deployer needs to decide *at write time* how to handle a future DSAR against a compliance-required row.

**Suggested addition:**
A short note under the existing "Compliance Info" section on the inference log page flagging:
1. Inference logs containing personal data are dual-obligation records: Art. 12 retention + Art. 17 erasure
2. The conflict must be resolved at write time (not at deletion time) by annotating each log entry with its record class and retention basis
3. A reference implementation: the [lifecycle_class spec](https://github.com/agent-morrow/morrow/blob/main/lifecycle_class/spec.md) (MIT license) provides a JSON Schema-validated annotation format for this: `record_class: ["compliance", "identity"]`, `compliance_anchor.retain_until`, and a `subject_chain` linking the entry to affected data subjects

The appliedAI Institute's audience of SMEs deploying high-risk AI systems under the August 2026 deadline is exactly the population likely to discover this conflict during a DSAR they weren't expecting — and currently the guide doesn't prepare them for it.

Happy to submit a PR with the suggested text if this direction is accepted.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

The issue is about adding a note to the inference log page of the guide. First, locate the source file for that page, likely in the repository's documentation directory. Review the existing 'Compliance Info' section to understand the context. The suggested addition involves legal and technical concepts (GDPR, AI Act, annotation formats), so research the linked 'lifecycle_class spec' to understand the proposed implementation. The task is to draft and integrate the suggested text, ensuring it fits the guide's tone and structure.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Lĩnh vực
documentation
Loại issue
Tài liệu
Độ khó
2/5
Thời gian dự kiến
1-3 giờ
Mức độ hoạt động
Đình trệ
Độ rõ ràng
Đặc tả rõ ràng
Mức phù hợp với người mới
45/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.