docs(verification): add Article 12 and correct the Article 111(2) attribution

[ioanavalea]

What this changes

Two corrections to the informative section added in #310, in one diff at @lywinged's suggestion in review there.

Article 12 joins Article 11 and Annex IV as a provision a reader might expect to supply a verification depth, and does not. The Article 111(2) sentence is corrected, because it presented a recital as operative text.

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

None. docs/verification.md only. Section 3.3.1 of spec/trace-v0.2.md is unchanged and no schema file is touched.

Why

Article 12. Suggested on the ground that a reader who knows this repository will look for it. Article 12(1) requires that a high-risk system technically allow the automatic recording of events over its lifetime, which addresses neither provenance nor build inputs, so it makes the section's argument rather than complicating it. Article 12 sits in Chapter III Section 2, so the closing sentence's list of provisions is extended to Articles 11, 12, 15 and 25 rather than left inconsistent. The count in "Two adjacent provisions are sometimes read as supplying one" is deliberately untouched, since that sentence refers to Article 25(4) and Article 15(5).

Article 111(2). The merged sentence made the dates "subject to the Article 111(2) grace period for units of a type and model already placed on the market". Article 1 point (39)(a) of Regulation (EU) 2026/1744 replaces Article 111(2), and the replacement carries the significant-changes test and a 2 August 2030 compliance date for providers and deployers of high-risk systems intended to be used by public authorities. It does not carry the type-and-model language. That reading is recital 39, and "type and model" occurs three times in the whole Regulation, all three inside that recital and none in the operative articles. The reading was right and the attribution was not.

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (for any normative change): not applicable, no normative change
• Breaking changes marked in spec text: not applicable
• Backward compatibility statement included: not applicable

AI assistance

Drafting and source verification were AI-assisted. Article 12 of Regulation (EU) 2024/1689, and Article 111(2) as replaced by Article 1 point (39)(a), recital 39, and Article 113 third paragraph point (c) as replaced by point (40)(b) of Regulation (EU) 2026/1744, were read against the Official Journal text before being cited.

[lywinged]

Approved.

Both corrections hold, and I checked them against the Official Journal text rather than against the PR body, from the Publications Office copy since EUR-Lex answers this environment with an empty page.

• Article 12 sits in Chapter III Section 2 with Articles 11 and 15, and Article 25 in Section 3, so the extended list is right. Article 12(1) reads "shall technically allow for the automatic recording of events (logs) over the lifetime of the system", which is the capability requirement the new sentence describes and nothing about provenance or build inputs.
• Article 1 point (39)(a) replaces Article 111(2) with the significant-changes test and the 2 August 2030 sentence for systems intended to be used by public authorities. "type and model" occurs three times in the Regulation, all three inside recital 39, and the operative articles carry it nowhere, which is what the closing sentence now says.
• The count in "Two adjacent provisions" is right to leave alone; the new sentence sits before it and the two it refers to are still Article 25(4) and Article 15(5).

One suggestion, not a condition. The paraphrase of the replaced Article 111(2) says operators of systems "placed on the market before that date of application". The replacement says "placed on the market or put into service", and it carves out "other than the systems referred to in paragraph 1 of this Article", the Annex X large-scale IT systems. The first is two words and costs nothing. The second is a real exclusion, but in an informative paragraph about which provisions impose a verification depth it is optional, and I would not hold the merge for either.

On the Article 42(3) question you raised on #310: a separate PR, and yes, it has a place in the paragraph on Regulation (EU) 2024/2847. I read point (18), Article 12 of the Cyber Resilience Act and Annex I Part II point 1 against the Official Journal and reached the same result. The opening words of that Article 12(1), "Without prejudice to the requirements relating to accuracy and robustness set out in Article 15 of Regulation (EU) 2024/1689", reserve two of Article 15's three subjects to the AI Act, so what is deemed satisfied is its cybersecurity requirement and nothing else; and condition (b) is met through the software bill of materials "covering at the very least the top-level dependencies", an inventory rather than a provenance check. Two instruments arriving at the section's point from opposite sides is worth three sentences, and the narrowing to one subject of Article 15 is the sentence that must survive editing. I would keep this PR to the two corrections it names, which is the reason for a separate diff rather than a reason against the addition.

Checked on the branch: the four CI steps green on 3.11 with the hash-pinned install, 1402 passed and 1 skipped on the head, base a247244, no dashes in the added lines, docs/verification.md only, DCO present. Nothing in the test suite reads this section; two tests name the file in their docstrings for a different rule.

Issue #314 is the right shape for the line 61 sentence, and I will answer there rather than here.

[ioanavalea]

Pushed bfdc1ba, which dismissed your approval, so this needs another look.

Both points from your review are in. The sentence now reads "placed on the market or put into service", and it carries the exclusion as "other than the systems referred to in Article 111(1)". You called the second optional in an informative paragraph and I took it anyway, since the paragraph reports the population the provision applies to, and without the exclusion it reports a wider one than the provision has.

Two further clauses went in for the same reason. Neither was in your review, so revert either if you read the paragraph's job more narrowly than I have.

• only where, as from that date, those systems are subject to significant changes in their designs. Without "as from that date" the sentence loses the point from which a design change starts to count.
• and in any case requires providers and deployers. The provision opens that limb with "In any case", which marks the 2030 date as independent of the significant-changes test rather than as a second condition under it.

Article 111 of Regulation (EU) 2024/1689 and Article 1 point (39) of Regulation (EU) 2026/1744 were read against the Official Journal text. Point (39) replaces paragraph 2 and adds a paragraph 4, so paragraph 1 stands as enacted, and the excluded population is AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X.

The Article 42(3) addition stays out of this diff, as you suggested, and follows in its own.

Source verification for this comment was AI-assisted.

[imran-siddique]

Both corrections are right and one of them catches something I flagged and did not chase. One sentence needs sourcing before this can land.

Article 12: take it. A reader of this repository will look for Article 12 first, and the reason it does not supply a verification depth is worth stating rather than leaving to inference. Art. 12(1) requires that a high-risk system technically allow the automatic recording of events over its lifetime, which is a capability requirement about logging and says nothing about provenance or build inputs. Verified against the Regulation.

Article 111(2): take it, and thank you for chasing it. When I approved #310 I wrote that I had not independently verified the Article 111(2) characterisation, and it turns out the version that merged was wrong. Your replacement matches the provision as amended: it applies to operators of high-risk systems other than those in 111(1) placed on the market before the date of application, only where they undergo significant changes in design from that date, and in any case requires providers and deployers of high-risk systems intended for use by public authorities to comply by 2 August 2030.

The last sentence cannot ship as written. It reads:

The reading that one lawfully placed unit carries the other units of the same type and model is recital 39 rather than operative text.

It does not name an instrument, and recital 39 of Regulation (EU) 2024/1689 is about the processing of biometric data for biometric identification and its relationship to Article 9(1) GDPR. It says nothing about units already placed on the market. The AI Act's transitional recitals sit in the 110s, next to Article 111.

If you mean recital 39 of Regulation (EU) 2026/1744 rather than of the AI Act, that is plausible from the surrounding sentence and it needs saying, because a reader lands on the AI Act by default.

So: name the instrument and confirm the number, or drop the sentence. The paragraph stands without it, since the operative text you have added already does the work.

I would rather ask than correct it myself. This is a citation-accuracy change and the citations should be yours.

[ioanavalea]

Fixed in 2ebe592, and you are right on both halves of it.

Recital 39 of Regulation (EU) 2024/1689 concerns any processing of biometric data and other personal data involved in the use of AI systems for biometric identification, and its relationship to Article 10 of Directive (EU) 2016/680 and Article 9(1) of Regulation (EU) 2016/679. It carries nothing about units already on the market, and "type and model" does not occur in that Regulation at all.

The instrument is Regulation (EU) 2026/1744, whose recital 39 provides that "if at least one individual unit of the high-risk AI system has been lawfully placed on the market or put into service before the date specified in Article 111(2), other individual units of the same type and model of high-risk AI system are subject to the grace period provided in that Article 111(2)". The phrase occurs three times in that Regulation, all three inside that recital.

I named the instrument rather than dropping the sentence, because it is the sentence that stops a reader carrying the grace period into operative text, which is the error the merged version made. The same sentence also said "one lawfully placed unit" where the recital says placed on the market or put into service, so that limb is restored as well.

On #310, the Article 111(2) characterisation you approved was mine, so this is me clearing up after myself rather than catching you.

Source verification for this comment was AI-assisted. Recital 39 of each Regulation was read against the Official Journal text before being quoted.

[lywinged]

Recital 39 of Regulation (EU) 2026/1744 is the grace-period one, so the number is right and only the instrument is missing. It carries a condition the sentence would want as well: the other units are subject to the grace period as long as the design of that system remains unchanged.

Worth knowing before you write the correction, because it is what makes this easy to get wrong. In that Regulation 39 is both the recital and the point of Article 1, and point (39)(a) is the operative replacement of Article 111(2). The contrast your sentence draws is between two things numbered 39 in the same instrument.

One more in the same paragraph while it is open, and it is at least as much mine as yours. Point (39)(a) requires those providers and deployers to "take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030", and the paragraph has them "comply by 2 August 2030". Writing it as to take the necessary steps to comply by 2 August 2030 closes it. The short form is in the paragraph I approved at f7fd601 and in the review above as well, so it has already survived two readings that should have caught it.

Those two are my only open items.

[lywinged]

Your fix is right, and the limb you restored alongside it is one I had not raised: recital 39 has at least one individual unit lawfully placed on the market or put into service, and the sentence now says so.

Withdrawing the condition I suggested. The paragraph already carries it, inverted, in the sentence immediately before: the provision applies only where those systems are subject to significant changes in their designs, which is the recital's design-remains-unchanged the other way round. Adding it would have said the same thing twice. You were right not to.

I also wrote that I had two open items and that was short by three. None of the three is an ask. They are listed so they are declined rather than missed, and because you have the sentence open.

The provision's opening, "Without prejudice to the application of Article 5 as referred to in Article 113, third paragraph, point (a)", is not carried at all. "only where" stands where both Article 111(2) as enacted and its replacement say "only if", and your own commit message for bfdc1ba writes "only if". And "before that date of application" points at the two dates of Sections 2 and 3 where the provision points at Chapter III.

The necessary-steps limb is the one I would still take.

[ioanavalea]

eb2a5b3 takes the necessary-steps limb, and one of the three you listed to be declined rather than missed.

Taken: the necessary-steps limb. Point (39)(a) requires those providers and deployers to take the necessary steps to comply, whereas the paragraph had them comply, which states an outcome where the provision states a duty to act. I ran a clause-by-clause diff of the paraphrase against the provision before bfdc1ba and let this one through as acceptable compression, so it is three readings rather than two.

Taken although you did not ask: only if. Both Article 111(2) as enacted and its replacement use it, and you are right that my commit message for bfdc1ba had it while the file did not. One word, and no reason to leave it diverging.

Declined: the "Without prejudice to the application of Article 5" opening. Article 5 concerns prohibited practices, and this paragraph exists to say which provisions impose a verification depth, so the reservation would add a cross-reference the paragraph never uses. It also opens Article 111(1) as well as Article 111(2), so carrying it in the one we paraphrase and not in the one we cite would read as a distinction rather than as an omission.

Declined: "before that date of application" for the provision's "date of application of Chapter III referred to in Article 113". Chapter III has five Sections and they do not share one application date. Section 4 applies from 2 August 2025 under Article 113, third paragraph, point (b), Section 5 under the general rule in the second paragraph from 2 August 2026, and Sections 1, 2 and 3 from the two dates point (40)(b) sets. So the provision's own formulation does not resolve to a single date, whereas the sentence before ours names the two dates for the Sections that Articles 11, 12, 15 and 25 sit in, which is what "that date of application" points at. The verbatim form would be less precise here rather than more.

On the numbering: agreed, and it is why the sentence now names the instrument instead of the number alone. I left the contrast as recital 39 against operative text rather than naming point (39)(a), since the paragraph already says Article 111(2) was replaced by the same Regulation, and a clause about which of two things numbered 39 is operative would be about the numbering rather than about the law. Say so if you would rather it were explicit.

Source verification for this comment was AI-assisted. Article 111, Article 113 and the Section structure of Chapter III of Regulation (EU) 2024/1689, and Article 1 point (39)(a) of Regulation (EU) 2026/1744, were read against the Official Journal text.

[carloshvp]

Reviewed exact head eb2a5b3228dda9e0929d3f8aa874e712fa6ca784 as an independent contributor.

I checked the changed claims against the Official Journal text for Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744.

• Article 12(1) requires high-risk systems to support automatic event logging over their lifetime. It imposes no provenance or build-input verification depth.
• Article 1 point (39)(a) supports the Article 111(2) paraphrase: the Article 111(1) exclusion, placed-on-market or put-into-service scope, significant-change condition, and necessary-steps duty by 2 August 2030 all match.
• Recital 39 supplies the type-and-model interpretation. The replacement text for Article 111(2) contains no type-and-model language.
• Article 1 point (40)(b) confirms the 2 December 2027 and 2 August 2028 dates for Chapter III Sections 1 to 3.

The follow-up commits address the earlier review comments by naming Regulation (EU) 2026/1744, restoring the omitted scope clauses, using only if, and preserving the necessary-steps formulation.

Local isolated validation on this head: 1,402 tests passed and one skipped; Ruff, mypy, the repository dash check, and git diff --check passed. The branch merges cleanly with current main at c04d938c697aa3b70f255a31d2ea4be3e5545042. All four commits have valid signatures and DCO trailers.

I found no blocking issue. This approval records independent validation and does not replace the maintainer review required by repository policy.

[lywinged]

Approving exact head eb2a5b3228dda9e0929d3f8aa874e712fa6ca784.

The sentence that could not ship now names the instrument, and I checked the number rather than
taking it. In Regulation (EU) 2026/1744 the phrase "type and model" occurs three times, all
three inside recital 39, and in Regulation (EU) 2024/1689 as published it occurs nowhere.
Recital 39 of the former reads "if at least one individual unit of the high-risk AI system has
been lawfully placed on the market or put into service before the date specified in Article
111(2), other individual units of the same type and model of high-risk AI system are subject to
the grace period provided in that Article 111(2)". Counted against the text of both Regulations
as published in the Official Journal, not against a consolidated version.

Across the two rounds I raised five things: the necessary-steps limb as the ask, the numbering,
and three I listed to be declined rather than missed. You took two, the necessary-steps limb and
only if, declined two with reasons, and answered the numbering by naming the instrument. That
accounting matters only because I wrote "two open items" once and "three" the next time, and
neither was the count.

Both declines are right and I am not re-raising either.

The "Without prejudice to the application of Article 5" opening: your reason holds, and there is
a second one. The phrase occurs twice in Regulation (EU) 2024/1689 as published, opening
Article 111(1) and Article 111(2), so a paragraph that paraphrases 111(2) and cites 111(1)
would carry it in one place and not the other. Weaker than it first looks, since 111(1)'s
wording never appears in the paragraph, and the two openings are no longer word for word: the
replacement reads "Article 113, third paragraph, point (a)" where 111(1) reads "Article 113(3),
point (a)".

"before that date of application": you are right and I was wrong to raise it. Chapter III has
five Sections and they do not share one application date, so the provision's own formulation
does not resolve to one. I should not have called the paraphrase more precise. It is narrower:
the provision's phrase reaches all five Sections and your sentence reaches the two that Articles
11, 12, 15 and 25 sit in, which is the right scope for the sentence and a smaller one than the
provision has.

On the numbering, leaving the contrast as recital 39 against operative text is the right call.
The paragraph already says the same Regulation replaced Article 111(2), so a reader who needs
the distinction has it.

Two things I checked that you did not ask about, because this diff is the reason to check them.

The first is the objection I would expect from someone who reads Annex IV after reading your
paragraph. Point 2(a) requires documenting "recourse to pre-trained systems or tools provided by
third parties and how those were used, integrated or modified by the provider", and the
datasheet point requires "information about their provenance" for the training data sets. So the
Annex uses both of the paragraph's nouns. The sentence still holds, and it holds on a
distinction worth stating rather than leaving implicit: Annex IV requires a provider to describe
its own inputs in its own file, and provenance_depth_verified records how far a verifier
followed someone else's build chain. Documenting what you did is not verifying what you were
given. If you want the paragraph proof against that reading, that is the clause it needs.

The second is the sentence before yours. It says the Regulation moved the application to
2 December 2027 and 2 August 2028, and both dates appear in Article 1 point (40)(b), which
replaces Article 113, third paragraph, point (c). So that sentence rests on operative text and
not on recital 40 beside it, which is the distinction your last sentence draws. Point (40)(b)
also carries "with the exception of Article 6(5)", which the paragraph omits and is right to:
Article 6 sits in Section 1, and the sentence is about the Sections its four Articles sit in.

Checked on this head: Article 12 imposes no verification depth in any of its three paragraphs.
12(1) is the capability to record events over the system's lifetime, 12(2) names the three
purposes the logging must serve, and 12(3) sets a minimum list for Annex III point 1(a) systems.
None of them reaches provenance or build inputs. Article 12 sits in Chapter III Section 2 with
Articles 11 and 15, and Article 25 in Section 3, so the extended list is right. test (3.11),
test (3.12), Analyze (python) and CodeQL are green on this commit and gate is the only
red one. One file changed, docs/verification.md, no normative text and no schema.

What I did not check, so it is not read as covered: the Regulation (EU) 2024/2847 paragraph
below yours, which this diff does not touch, and the characterisations of Article 25(4) and
Article 15(5), which I read against the provisions and did not audit clause by clause.

One thing about the effect rather than the content, so it is not discovered afterwards. The
merge gate reads a fixed list of two accounts and passes when either one approves the current
head, so this approval turns it green on its own. The Project Lead's review asked for the
instrument to be named and the number confirmed. 2ebe592 named it and the count above is the
confirmation, but whether that satisfies his review is his to say and not mine, and it still
stands on this pull request. Approving merges nothing.