What the EU AI Act, FTC and NIST Expect From Marketing Agent Logs

The logging and audit trail requirements that legal compliance places on an agentic AI marketing system are fewer than the usual checklist implies, and the binding ones state their retention periods in plain numbers. The EU AI Act asks for logs kept at least six months, only from systems it classes as high-risk, and that duty applies from 2 December 2027 for systems listed in Annex III. The FTC's Telemarketing Sales Rule asks sellers and telemarketers for 5 years of call records. Most of the rest, including the whole NIST AI Risk Management Framework, is voluntary practice or a burden of proof with no retention period attached. We read each text on October 7, 2026. Have counsel confirm how it applies to your stack.

Which rules bind a marketing agent's logs, and which are voluntary?

Audit trail and logging requirements for an agentic AI marketing system sort into three legal compliance tiers: rules that name a retention period, rules that put the burden of proof on the advertiser without naming one, and frameworks a company adopts by choice. An agent that plans and acts across tools (see our primer on what agentic AI is) can touch all three in one campaign.

The field-level schema is a separate job, covered in our governance operating model and the governance layer for multi-agent stacks. This page covers what the law asks you to keep, and for how long.

What do Articles 12, 19 and 26 of the EU AI Act require?

EU AI Act logging and record keeping duties for high-risk AI systems sit in three articles: Article 12 for the system itself, Article 19 for its provider and Article 26 for the business that deploys it. Article 12, as shown on the European Commission's AI Act Service Desk in the consolidated version as at 27 July 2026, opens with a design rule: "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." Article 12(3) sets a minimum field list only for remote biometric identification. We found none in Article 12 for any other kind of system. Article 12(2) names only the purposes the logs must serve, such as flagging risk situations and supporting post-market monitoring, so the log schema of a marketing agent is its provider's own interpretation.

Retention comes in two matching clauses. Under Article 19 on the AI Act Service Desk, providers keep automatically generated logs "to the extent such logs are under their control" for "a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in the applicable Union or national law, in particular in Union law on the protection of personal data." Article 26(6) on the AI Act Service Desk gives deployers the same six-month floor. A team running a vendor's agent therefore has to know which logs sit in its own tenant, and because other law can change the period, it deserves a decision per system instead of a platform default.

These duties do not apply yet. Article 113 on the AI Act Service Desk, as amended by the Digital Omnibus on AI, applies Sections 1 to 3 of Chapter III, where all three articles sit, from 2 December 2027 for systems classed as high-risk through Annex III and from 2 August 2028 for those classed through Annex I.

When does a marketing agent count as high-risk?

On our reading, most marketing agents sit outside the class. Annex III on the AI Act Service Desk lists the areas, and a few touch marketing work. Point 4(a) covers AI used for recruitment or selection, "in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates". Points 5(b) and 5(c) cover credit scoring of natural persons and risk assessment and pricing for life and health insurance, and point 1(c) covers emotion recognition. We found no Annex III point that names ad targeting for ordinary products, content generation, budget pacing or sales lead prioritization.

Article 6(3) on the AI Act Service Desk lets an Annex III system leave the class when it "does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons", but never "where the AI system performs profiling of natural persons". Under Article 6(4), a provider relying on that exit "shall document its assessment before that system is placed on the market or put into service." A marketing agent that scores individuals inside a listed area should plan for the high-risk track.

What does the FTC expect you to be able to show?

FTC guidance on AI claims in advertising rests on the same substantiation doctrine as any other ad, and we found no general record keeping period for automated systems in it. The 1984 Policy Statement Regarding Advertising Substantiation from the FTC states the requirement as "that advertisers and ad agencies have a reasonable basis for advertising claims before they are disseminated". We found no retention period in it. For an agent that drafts and ships ad variants unattended, the consequence is a timing rule: the evidence record has to exist, linked to the claim, before the publish action fires.

Retention periods appear once the agency writes an order. The August 21, 2025 Decision and Order against Workado, a seller of an AI content detection product, published by the FTC, requires evidence for effectiveness claims "at the time such representation is first made, and each time such representation is made thereafter". Its recordkeeping provision says the company "must create certain records for 10 years after the issuance date of the Order, and retain each such record for 5 years", including each unique advertisement making a covered claim and, for 5 years from a claim's last dissemination, the materials relied on for it. The consent order binds only Workado, but it shows what the agency treats as a complete claims file.

One FTC rule does carry a clock for everyday marketing records. Under 16 CFR 310.5, as published on the eCFR, "Any seller or telemarketer must keep, for a period of 5 years from the date the record is produced unless specified otherwise," a list of telemarketing records that includes scripts, consent records, do-not-call requests and a record of each call, with times in Coordinated Universal Time. A voice agent whose calls count as telemarketing under the rule inherits that list, and paragraph (e) holds seller and telemarketer both responsible unless a written agreement allocates the work. Section 310.6(b)(7) exempts calls to businesses from most of the rule, though the misrepresentation bans in section 310.3(a)(2) and (4) still reach them, so B2B outbound sits outside section 310.5 while consumer calling sits inside.

Endorsements, reviews and disclosures an agent touches

FTC recordkeeping for endorsements and disclosure in AI marketing remains, as the guidance stands in 2026, a matter of the evidence you choose to keep, because we found no retention clause in the Endorsement Guides. The Guides at 16 CFR Part 255 on the eCFR say they "provide the basis for voluntary compliance with the law". Section 255.1(d) still holds advertisers "subject to liability for misleading or unsubstantiated statements made through endorsements or for failing to disclose unexpected material connections" and says they should guide endorsers, monitor their compliance and remedy what they find. When an agent briefs creators or scans posts for disclosures, its log is the proof of that monitoring.

The Consumer Reviews and Testimonials Rule at 16 CFR Part 465 sets a harder limit for content agents: a business may not "write, create, or sell" a review or testimonial that materially misrepresents that the reviewer exists or had experience with the product. We found no recordkeeping section in Part 465.

Where does the NIST AI RMF fit?

The NIST AI Risk Management Framework addresses audit logs and traceability for AI systems through documentation outcomes, and a marketing governance team adopts it by choice. NIST describes the framework as "intended for voluntary use" and notes that "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." The Core, published in the AI Resource Center run by NIST, is written as outcomes. Govern 1.6 asks for mechanisms to inventory AI systems, and Manage 4.3 includes this sentence: "Processes for tracking, responding to, and recovering from incidents and errors are followed and documented." We found no retention period and no log field list in the Core. Its use to a marketing team is as a question set: is every agent in an inventory, does each have an owner, does an incident leave a record.

How legal and brand review use the log

In agentic AI marketing governance, audit logs give legal and brand review three different things: NIST AI RMF practice gives the logging its structure, FTC marketing rules decide which evidence must be attached, and the EU AI Act sets a retention floor where it applies. Take a hypothetical home energy retailer that sells to US consumers, hires in Germany and runs three agents.

The 5-year period in the first row is our proposal, borrowed from the Workado order; the other two clocks come from the rule texts, and the third row assumes the recruitment agent stays high-risk under Article 6.

Two human approval points follow. A named reviewer approves the evidence for any new objective claim before the agent publishes variants of it, and a named person holds oversight of the recruitment agent, which Article 26(2) requires deployers to assign. The failure modes are predictable: logs that live only in a vendor console with a retention window nobody chose, evidence files time-stamped after the ad went live, and call records stored in local time. Records an agent writes into your own systems need the same care, a point we cover in what marketing agents can write back to your CRM.

For measurement we would track three numbers each quarter: the share of live objective claims whose evidence record predates first publish, the time a drill takes to retrieve the complete file for one claim or one call, and the share of agents with a named owner and a stated retention period. Five years of call records also need storage and review time, a cost that belongs in the unit economics in what a marketing AI agent costs per contact. Our AI ROI calculator is a further resource for weighing that overhead against the return, and our agentic AI automation service is where this mapping work sits if you want help with it.

The order the texts imply is classification before schema. Decide for each agent whether it makes objective claims, places telemarketing calls or operates in an Annex III area, and the retention clock follows from the answer.

Sources

• AI Act Service Desk, Article 12, consolidated version as at 27 July 2026
• AI Act Service Desk, Article 19
• AI Act Service Desk, Article 26
• AI Act Service Desk, Article 6
• AI Act Service Desk, Annex III
• AI Act Service Desk, Article 113
• FTC, Policy Statement Regarding Advertising Substantiation (November 23, 1984)
• FTC, Decision and Order, Workado, LLC, Docket No. C-4822 (August 21, 2025)
• eCFR, 16 CFR 310.5, Recordkeeping requirements
• eCFR, 16 CFR 310.6, Exemptions
• eCFR, 16 CFR Part 255, Endorsement Guides
• eCFR, 16 CFR Part 465, Consumer Reviews and Testimonials Rule
• NIST, AI Risk Management Framework
• NIST, AI RMF Core