Regulation: EU AI Act: Art. 12 record-keeping claims for the append-only, hash-chained training audit log (plus PMM and retention attributed to Art. 12) (incorrect-claim) (TECH-T10-008) #362

Wave 1 · theme D1-11: Other high-severity packages · highest severity High · 24 finding(s) · effort not estimated

Summary

The training audit log is legitimate provider-side evidence (Annex IV 2(g) test logs, Art. 17(1) records, Art. 18 documentation). Calling it the artefact 'mandated by Article 12' tells deployers the Art. 12 duty is covered. It is not: Art. 12 concerns the deployed system's runtime logs, which ForgeLM (not an inference engine) does not produce. Attributing retention to Art. 12 and PMM to Art. 12 omits the governing Arts 19/18 and 72. The SHA-256/HMAC tamper-evidence guarantee itself is unaffected.

Primary finding

TECH-T10-008 — Regulation: EU AI Act: Art. 12 record-keeping claims for the append-only, hash-chained training audit log (plus PMM and retention attributed to Art. 12) (incorrect-claim)

severity Next release

Item. Art. 12 record-keeping claims for the append-only, hash-chained training audit log (plus PMM and retention attributed to Art. 12) · verdict: incorrect-claim · urgency: Next release

State in ForgeLM. docs/reference/audit_event_catalog.md:6 and its TR mirror :6 call audit_log.jsonl 'the append-only, hash-chained record-keeping artefact mandated by EU AI Act Article 12'. README.md:84 and docs/guides/safety_compliance.md:266 label it Article 12, and docs/product_strategy.md:34 maps 'Art. 12 Record-Keeping → audit_log.jsonl'. Post-market monitoring is labelled Article 12 (+17) at forgelm/config.py:1284,1634, config_template.yaml:258, docs/usermanuals/en/reference/configuration.md:281 and tr:282. forgelm/config.py:1533 attributes the 5-year audit-log retention to the 'Article 12 record-keeping obligation'. docs/usermanuals/en/compliance/audit-log.md:8 describes Art. 12 accurately.

State of the ecosystem on 2026-10-01. The Omnibus does not amend Arts 12, 18 or 19. - Art. 12(1): 'High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system'. Art. 12(2) ties those logs to traceability of the system's functioning: risk situations, facilitating the post-market monitoring 'referred to in Article 72', and Art. 26(5) operation monitoring. It prescribes no hash chain and no training-pipeline log. - Art. 19(1): providers keep automatically generated logs for at least six months. - Art. 18: documentation is kept for 10 years. - The PMM system and plan are Art. 72; in the QMS they are Art. 17(1)(h).

Impact. The training audit log is legitimate provider-side evidence (Annex IV 2(g) test logs, Art. 17(1) records, Art. 18 documentation). Calling it the artefact 'mandated by Article 12' tells deployers the Art. 12 duty is covered. It is not: Art. 12 concerns the deployed system's runtime logs, which ForgeLM (not an inference engine) does not produce. Attributing retention to Art. 12 and PMM to Art. 12 omits the governing Arts 19/18 and 72. The SHA-256/HMAC tamper-evidence guarantee itself is unaffected.

Recommendation. Reword to 'training-time event log that supports Annex IV 2(g) and Art. 11/17/18 evidence; runtime Art. 12 logging and Art. 19 retention of the deployed system remain with the provider's/deployer's serving stack (Arts 12, 19, 26(6))'. Re-cite the monitoring block as Art. 72 (with Art. 17(1)(h); Art. 12(2)(b) for the logging that feeds it). Re-cite the retention rationale as Arts 18/19 plus the operator's own policy. Apply to EN+TR.

Sources.

• Regulation (EU) 2024/1689, Arts 12, 17(1)(h), 18, 19, 72 (2024-07-12)
• Regulation (EU) 2026/1744 (no amending point for Arts 12, 18, 19) (2026-07-24)
• Article 12: Record-Keeping (FLI AI Act Explorer) (2026-10-01T13:59:14Z)

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

• DOC-BLEGAL-001 (docs, High) — README.md: misleading — audit_log.jsonl # Article 12 — append-only, hash-chained; 'EU AI Act — … Article 12 audit log, Article 14 human-oversight staging gate (forgelm approve, exit 4)'
  severity High
  Where. README.md:84,117 · type: misleading
  The document says. audit_log.jsonl # Article 12 — append-only, hash-chained; 'EU AI Act — … Article 12 audit log, Article 14 human-oversight staging gate (forgelm approve, exit 4)'
  What the code does. Art. 12(1) requires the high-risk system to allow automatic recording of events over its lifetime, for the Art. 12(2)(a)-(c) purposes. It prescribes no hash chain and no training-pipeline log. Art. 14(1) concerns oversight by natural persons while the system is in use. A pre-release approval of a checkpoint is a provider release control, not Art. 14 oversight. Both articles are unamended by Reg.…
  Proposed correction. Line 84: '# training audit log — append-only, hash-chained (supports Art. 12 traceability evidence)'. Line 117: '… training audit log supporting Article 12 evidence, pre-release human sign-off gate (forgelm approve, exit 4) supporting Art. 14/QMS processes'.

• DOC-BLEGAL-006 (docs, High) — docs/product_strategy.md: false claim — "Audit log with SHA-256 hash chain satisfies record-keeping requirements."
  severity High
  Where. docs/product_strategy.md:68 (Turkish mirror: docs/product_strategy-tr.md:68) · type: false claim
  The document says. "Audit log with SHA-256 hash chain satisfies record-keeping requirements."
  What the code does. AI Act Art. 12(1)-(2) requires the high-risk AI system to log events automatically over its lifetime for Art. 79(1), Art. 72 and Art. 26(5) traceability in operation. A training-run log precedes deployment, does not cover use of the system, and cannot 'satisfy' Art. 12. Art. 12 prescribes no hash chain. The log can support Art. 11/Annex IV and Art. 17/18 records.
  Proposed correction. 'A SHA-256 hash-chained training audit log provides tamper-evident development records (supports Annex IV / QMS evidence; Art. 12 logging of the deployed system remains the provider's).'
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-007 (docs, High) — docs/product_strategy.md: false claim — Audit log with SHA-256 hash chain satisfies record-keeping requirements.
  severity High
  Where. docs/product_strategy.md:68 (Turkish mirror: docs/product_strategy-tr.md:68) · type: false claim
  The document says. Audit log with SHA-256 hash chain satisfies record-keeping requirements.
  What the code does. Art. 12(1)-(2) puts the duty on the deployed high-risk AI system: automatic event logging over its lifetime, for Art. 79(1), Art. 72 and Art. 26(5) traceability. Retention is Art. 19(1)/26(6), at least six months. A training-pipeline log records how the model was produced, not how the system operates, and ForgeLM runs no inference. Art. 12 has no hash-chain requirement. The log can support Annex…
  Proposed correction. An append-only, hash-chained training audit log supports technical documentation and QMS records; it does not replace the runtime event logging a deployed high-risk system needs under Art. 12. / TR: Append-only, SHA-256 zincirli eğitim denetim günlüğü teknik dokümantasyonu ve QMS kayıtlarını destekler; dağıtılmış yüksek riskli sistemin Madde 12 ka…
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-010 (docs, High) — docs/qms/sop_model_training.md: wrong detail — Compliance artifacts retained for minimum 5 years (or as required by regulation)
  severity High
  Where. docs/qms/sop_model_training.md:65 (Turkish mirror: docs/qms/sop_model_training-tr.md:66) · type: wrong detail
  The document says. Compliance artifacts retained for minimum 5 years (or as required by regulation)
  What the code does. For a provider of a high-risk AI system, Reg. (EU) 2024/1689 Art. 18(1) requires the technical documentation (Art. 11), the QMS documentation, the notified-body documents and the EU declaration of conformity to be kept 'for a period ending 10 years after the high-risk AI system has been placed on the market or put into service'. Art. 19(1) sets a separate floor of at least six months for automati…
  Proposed correction. Replace with: '- Technical documentation (Annex IV bundle), QMS documentation and the EU declaration of conformity: retain for 10 years after the model/system is placed on the market or put into service (EU AI Act Art. 18(1)). Automatically generated logs: at least 6 months (Art. 19(1) / Art. 26(6)), longer where other Union or national la…
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-011 (docs, High) — docs/reference/audit_event_catalog.md: false claim — [IS-T10-21] 'audit_log.jsonl, the append-only, hash-chained record-keeping artefact mandated by EU AI Act Article 12'
  severity High
  Where. docs/reference/audit_event_catalog.md:6 (Turkish mirror: docs/reference/audit_event_catalog-tr.md:6) · type: false claim
  The document says. [IS-T10-21] 'audit_log.jsonl, the append-only, hash-chained record-keeping artefact mandated by EU AI Act Article 12'
  What the code does. Art. 12(1): 'High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system'. Art. 12(2) ties those logs to the system's functioning: risk situations, post-market monitoring under Art. 72 and deployer monitoring under Art. 26(5). It mandates neither a training-pipeline log nor hash chaining. Retention is Art. 19(1) (at least six months).…
  Proposed correction. This catalog enumerates every event ForgeLM may append to audit_log.jsonl, an append-only, hash-chained record of the training pipeline. It is supporting evidence for traceability; it does not by itself meet AI Act Art. 12, which requires the deployed high-risk system to log events automatically over its lifetime. TR: 'ForgeLM'in eğitim hattına…
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-013 (docs, High) — docs/reference/compliance_summary.md: misleading — EU AI Act Article 12 record-keeping via append-only AuditLogger (HMAC chain + manifest sidecar).
  severity High
  Where. docs/reference/compliance_summary.md:28 (Turkish mirror: docs/reference/compliance_summary-tr.md:27) · type: misleading
  The document says. EU AI Act Article 12 record-keeping via append-only AuditLogger (HMAC chain + manifest sidecar).
  What the code does. The overall 'evidence that supports compliance' framing and the Art. 9, 10, 11, 13, 15 and GDPR 15/17 attributions are sound. RQ-057 finds two attributions that do not match the text. The Art. 12 one is established: Art. 12 is the deployed system's in-operation logging capability, not a training-pipeline log (RQ-029, TECH:T10:7). The second attribution RQ-057 names is truncated in this unit's inp…
  Proposed correction. - EU AI Act Article 11 / Annex IV 2(g) development-time evidence via the append-only, hash-chained AuditLogger (HMAC chain + manifest sidecar). Article 12 in-operation logging of the deployed system remains the provider's responsibility.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-014 (docs, High) — docs/reference/compliance_summary.md: misleading — | Monitoring + post-market surveillance | Webhook lifecycle (notify_*); safety_trend.jsonl cross-run trend |
  severity High
  Where. docs/reference/compliance_summary.md:55 (Turkish mirror: docs/reference/compliance_summary-tr.md:54) · type: misleading
  The document says. | Monitoring + post-market surveillance | Webhook lifecycle (notify_*); safety_trend.jsonl cross-run trend |
  What the code does. Art. 3(25) defines the post-market monitoring system as activities 'to collect and review experience gained from the use of AI systems they place on the market'. Art. 72(1)-(2) requires a documented system that 'actively and systematically' collects, documents and analyses performance data throughout the system's lifetime. Reg. (EU) 2026/1744 Art. 1(30) replaced Art. 72(3): the PMM plan is part o…
  Proposed correction. | Monitoring + post-market surveillance | Not provided by ForgeLM. Training-time signals (webhook lifecycle, safety_trend.jsonl) can feed the provider's own Art. 72 post-market monitoring system and plan, which the provider must operate on the deployed system. |
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-030 (docs, High) — docs/usermanuals/en/getting-started/first-run.md: misleading — audit_log.jsonl ← Article 12 append-only event log
  severity High
  Where. docs/usermanuals/en/getting-started/first-run.md:166 (Turkish mirror: docs/usermanuals/tr/getting-started/first-run.md:166) · type: misleading
  The document says. audit_log.jsonl ← Article 12 append-only event log
  What the code does. Art. 12(1) requires that 'High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system', for the Art. 12(2) traceability purposes. It prescribes no hash chain and no training-pipeline log. ForgeLM's training audit log supports record-keeping evidence, but it is not the Art. 12 logging capability of the deployed system.
  Proposed correction. '← training audit log (supports Art. 12 traceability evidence; runtime logging of the deployed system remains your duty)'. TR: '← eğitim denetim günlüğü (Madde 12 izlenebilirlik kanıtını destekler)'.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-046 (docs, High) — site/index.html: misleading — "Article 9-17" tag; "Article 9 risk assessment, Article 10 data governance, Article 12 record-keeping — wired in."
  severity High
  Where. site/index.html:374 (tag) and site/js/translations.js:364 (home.why.compliance.body) (Turkish mirror: site/js/translations.js:470 (TR home.why.compliance.body '— bağlandı')) · type: misleading
  The document says. "Article 9-17" tag; "Article 9 risk assessment, Article 10 data governance, Article 12 record-keeping — wired in."
  What the code does. Art. 9(1)-(2) requires a risk management system that is 'established, implemented, documented and maintained' as a 'continuous iterative process ... throughout the entire lifecycle'. A per-run config block can support it but does not constitute it. Art. 12(1) requires the high-risk AI system itself to 'technically allow for the automatic recording of events (logs) over the lifetime of the system'…
  Proposed correction. 'Every run emits evidence for your Annex IV technical documentation: risk-assessment inputs (Art. 9), data-governance records (Art. 10) and a tamper-evident training audit log that supports, but does not replace, Art. 12 logging of the deployed system.' Change the tag to 'Evidence for Arts 9-15 + Annex IV'.

• DOC-BLEGAL-063 (docs, Medium) — config_template.yaml: wrong detail — audit_log_retention_days: 1825 # ~5 years (Article 12 record-keeping baseline)
  severity Medium
  Where. config_template.yaml:270 · type: wrong detail
  The document says. audit_log_retention_days: 1825 # ~5 years (Article 12 record-keeping baseline)
  What the code does. Art. 12 sets no retention period. Retention is Art. 19(1) and Art. 26(6) (logs: at least six months) and Art. 18(1) (documentation: 10 years after placing on the market). No 5-year horizon exists in the AI Act.
  Proposed correction. '# ~5 years (ForgeLM default; AI Act Art. 19(1): logs >= 6 months, Art. 18(1): documentation 10 years)'. Fix the forgelm/config.py:1533 docstring too.

• DOC-BLEGAL-066 (docs, Medium) — docs/design/gdpr_erasure.md: wrong detail — EU AI Act Article 12(2) sets the floor at 6 months; Article 11 (technical documentation) extends to 10 years post-deployment for high-risk systems. GDPR Ar…
  severity Medium
  Where. docs/design/gdpr_erasure.md:103-110 · type: wrong detail
  The document says. EU AI Act Article 12(2) sets the floor at 6 months; Article 11 (technical documentation) extends to 10 years post-deployment for high-risk systems. GDPR Article 30 record-keeping commonly demands ≥3 years.
  What the code does. Art. 12 sets no retention period. The six-month minimum is in Art. 19(1) for providers and Art. 26(6) for deployers. The 10-year period is in Art. 18(1) and applies to documentation, not logs; Art. 11 has no period. GDPR Art. 30 (records of processing activities) sets no retention period at all.
  Proposed correction. '# AI Act Art. 19(1)/26(6) set a floor of 6 months for logs of high-risk systems; Art. 18(1) keeps documentation 10 years. GDPR sets no fixed period (Art. 5(1)(e): no longer than necessary). We default to 1825 days (5 years) as a project choice; operators may lower it to 180 or raise it per their obligations.'

• DOC-BLEGAL-072 (docs, Medium) — docs/guides/gdpr_erasure.md: wrong detail — audit_log_retention_days: 1825 # 5 years (Article 12 record-keeping)
  severity Medium
  Where. docs/guides/gdpr_erasure.md:77 (Turkish mirror: docs/guides/gdpr_erasure-tr.md:77) · type: wrong detail
  The document says. audit_log_retention_days: 1825 # 5 years (Article 12 record-keeping)
  What the code does. AI Act Art. 12 sets no retention period. Log retention is Art. 19(1) for providers and Art. 26(6) for deployers: at least six months, unless other Union or national law provides otherwise. Art. 18(1) requires documentation to be kept for 10 years. Five years is a project choice and corresponds to no AI Act period.
  Proposed correction. Comment: '# 5 years (project default; AI Act Art. 19/26(6) floor for logs is 6 months, Art. 18 keeps documentation 10 years)'. Mirror in the TR file.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-073 (docs, Medium) — docs/guides/getting-started.md: misleading — The audit log records me@workstation instead of a stable identity, breaking EU AI Act Article 12 record-keeping after the operator's machine reboots.
  severity Medium
  Where. docs/guides/getting-started.md:14 (Turkish mirror: docs/guides/getting-started-tr.md:14) · type: misleading
  The document says. The audit log records me@workstation instead of a stable identity, breaking EU AI Act Article 12 record-keeping after the operator's machine reboots.
  What the code does. Art. 12 (unamended) requires the high-risk system to allow automatic event logging over its lifetime for traceability (12(1)-(2)). Its only identity requirement is 12(3)(d), identification of the natural persons verifying results, and that applies only to remote biometric identification systems (Annex III 1(a)). Art. 12 requires no stable operator identity in a training tool's log, so a user@host…
  Proposed correction. 'The audit log records me@workstation instead of a stable identity, which weakens attribution of training decisions in your audit evidence (accountability, ISO 27001 A.5.16 / A.8.15).' Mirror in the TR file.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-099 (docs, Medium) — docs/reference/configuration.md: wrong detail — ## monitoring (Optional — EU AI Act Art. 12+17)
  severity Medium
  Where. docs/reference/configuration.md:360 (Turkish mirror: docs/reference/configuration-tr.md:302) · type: wrong detail
  The document says. ## monitoring (Optional — EU AI Act Art. 12+17)
  What the code does. Post-market monitoring is Art. 72 of Reg. (EU) 2024/1689. Art. 17(1)(h) requires the QMS to include a PMM system 'in accordance with Article 72'. Art. 12 (record-keeping) connects only through 12(2)(b), which requires logging that facilitates Art. 72 monitoring. Reg. (EU) 2026/1744 did not amend 17(1)(h). The correct mapping is Art. 72 + 17(1)(h), with 12(2)(b) supporting.
  Proposed correction. ## monitoring (Optional — supports EU AI Act Art. 72 post-market monitoring / Art. 17(1)(h); logging per Art. 12(2)(b))
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-103 (docs, Medium) — docs/reference/library_api_reference.md: misleading — Append-only Article 12 audit logger.
  severity Medium
  Where. docs/reference/library_api_reference.md:82 (Turkish mirror: docs/reference/library_api_reference-tr.md:82) · type: misleading
  The document says. Append-only Article 12 audit logger.
  What the code does. Art. 12(1) requires that high-risk AI systems 'technically allow for the automatic recording of events (logs) over the lifetime of the system'. The logs serve the purposes in 12(2), and providers keep them for at least six months under Art. 19. Art. 12 prescribes no hash chain and no training-pipeline log. A fine-tuning toolkit's training-time event log is development evidence that fits Annex IV…
  Proposed correction. Append-only, hash-chained training-run audit logger (development-time evidence for the technical documentation; not the Art. 12 in-operation logging capability of the deployed system).
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-110 (docs, Medium) — docs/roadmap/completed-phases.md: wrong detail — The EU AI Act requires machine-readable audit trails, risk classification, and continuous monitoring for high-risk AI systems.
  severity Medium
  Where. docs/roadmap/completed-phases.md:108 · type: wrong detail
  The document says. The EU AI Act requires machine-readable audit trails, risk classification, and continuous monitoring for high-risk AI systems.
  What the code does. Art. 12(1) requires that high-risk systems 'technically allow for the automatic recording of events (logs) over the lifetime of the system'. The Act never qualifies logs as 'machine-readable'; that term appears only for the EU database, the Art. 47 declaration, Art. 48 digital CE marking and Art. 50(2) output marking. 'Risk classification' is not an obligation for high-risk systems: the Art. 6 ru…
  Proposed correction. For high-risk AI systems the EU AI Act requires automatic event logging over the system's lifetime (Art. 12), a risk-management system (Art. 9) and a post-market monitoring system (Art. 72).

• DOC-BLEGAL-116 (docs, Medium) — docs/standards/logging-observability.md: misleading — ## Audit log (EU AI Act Article 12) ... "Append-only JSON Lines audit log for EU AI Act Art. 12 record-keeping."
  severity Medium
  Where. docs/standards/logging-observability.md:85,91 · type: misleading
  The document says. ## Audit log (EU AI Act Article 12) ... "Append-only JSON Lines audit log for EU AI Act Art. 12 record-keeping."
  What the code does. Art. 12(1) of Reg. (EU) 2024/1689, which Reg. 2026/1744 does not amend, requires the high-risk AI system itself to 'technically allow for the automatic recording of events (logs) over the lifetime of the system'. Art. 12(2) ties those logs to Art. 79(1) risk situations, Art. 72 post-market monitoring and Art. 26(5) operation monitoring. A training-pipeline log does not give the deployed model thi…
  Proposed correction. Retitle to '## Audit log (training-pipeline evidence; supports EU AI Act Art. 11 / Annex IV 2(g) and Art. 17)'. Add one sentence: 'Art. 12 logging of the deployed system in operation is the deployer's/provider's runtime responsibility; this log does not provide it.' Change the docstring in forgelm/compliance.py to match.

• DOC-BLEGAL-117 (docs, Medium) — docs/usermanuals/en/compliance/audit-log.md: wrong detail — EU AI Act Article 12 requires high-risk AI systems to maintain logs of operationally relevant events. ForgeLM's audit_log.jsonl is an appen…
  severity Medium
  Where. docs/usermanuals/en/compliance/audit-log.md:8 (Turkish mirror: docs/usermanuals/tr/compliance/audit-log.md:8) · type: wrong detail
  The document says. EU AI Act Article 12 requires high-risk AI systems to maintain logs of operationally relevant events. ForgeLM's audit_log.jsonl is an append-only, SHA-256-anchored sequence of events covering training start, evaluation gates, auto-revert decisions, and model export.
  What the code does. Art. 12(1) requires high-risk systems to 'technically allow for the automatic recording of events (logs) over the lifetime of the system'. The relevance criteria are in 12(2). Keeping logs is a separate duty: Art. 19 for providers and Art. 26(6) for deployers, at least six months. Art. 12 is a design capability of the deployed system, and a training-pipeline log is not that log.
  Proposed correction. EU AI Act Article 12 requires high-risk AI systems to technically allow automatic event logging over their lifetime (retention: Art. 19 / 26(6)). ForgeLM's audit_log.jsonl records the training pipeline — useful for technical documentation and QMS records — and is not the runtime log of the deployed system.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-145 (docs, Medium) — docs/usermanuals/en/reference/configuration.md: wrong detail — enabled: false # Enable Article 12 post-market monitoring
  severity Medium
  Where. docs/usermanuals/en/reference/configuration.md:281 (Turkish mirror: docs/usermanuals/tr/reference/configuration.md:282) · type: wrong detail
  The document says. enabled: false # Enable Article 12 post-market monitoring
  What the code does. AI Act Art. 12 is 'Record-keeping'. Post-market monitoring is Art. 72. Art. 12(2)(b) only asks that logging facilitate 'the post-market monitoring referred to in Article 72', and Art. 17(1)(h) requires the QMS to cover it. Reg. (EU) 2026/1744 replaced Art. 72(3) (guidance and a template due by 2 Sep 2027) and left Art. 12 unchanged.
  Proposed correction. '# Enable post-market monitoring hooks (supports AI Act Art. 72; QMS Art. 17(1)(h))'. Fix forgelm/config.py:1280 and :1284 too. TR: '# Pazar-sonrası izleme hook'larını etkinleştir (AI Act Madde 72; KYS Madde 17(1)(h))'.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-162 (docs, Medium) — site/js/translations.js: false claim — "Default 1825 (5 years) matches EU AI Act guidance."
  severity Medium
  Where. site/js/translations.js:1812 (wizard.retention.audit_log.hint, EN) (Turkish mirror: site/js/translations.js:2207 (TR '... EU AI Act rehberiyle uyumlu'; same in DE/FR/ES/ZH)) · type: false claim
  The document says. "Default 1825 (5 years) matches EU AI Act guidance."
  What the code does. No AI Act provision or Commission guidance sets five years. Art. 19(1) (providers) and Art. 26(6) (deployers) require automatically generated logs to be kept 'for a period appropriate to the intended purpose ... of at least six months'. Art. 18(1) requires documentation to be kept for 10 years. Art. 12 sets no period. Five years is a ForgeLM design choice. Reg. 2026/1744 left these periods unchan…
  Proposed correction. 'Default 1825 days (5 years) is a ForgeLM choice. The AI Act requires operational logs of at least six months (Art. 19/26(6)) and documentation for 10 years (Art. 18); set this to your retention policy.'

• DOC-BLEGAL-175 (docs, Low) — docs/design/wizard_mode.md: wrong detail — monitoring (Article 12 + 17) accordions
  severity Low
  Where. docs/design/wizard_mode.md:99 · type: wrong detail
  The document says. monitoring (Article 12 + 17) accordions
  What the code does. The post-market monitoring system is AI Act Art. 72 ('Providers shall establish and document a post-market monitoring system'). Art. 17(1)(h) only requires the QMS to cover its setting-up, and Art. 12 is record-keeping (logging capability). The other two attributions on the same lines are correct: compliance → Art. 11 + Annex IV §1, and retention → GDPR Art. 5(1)(e) + 17.
  Proposed correction. 'monitoring (Article 72 post-market monitoring; QMS Article 17(1)(h))'.

• DOC-BLEGAL-176 (docs, Low) — docs/guides/air_gap_deployment.md: wrong detail — | cache.populate_models_requested | cache-models | 12 | ... (Article column '12' for all seven cache.populate_* events)
  severity Low
  Where. docs/guides/air_gap_deployment.md:189-197 (Turkish mirror: docs/guides/air_gap_deployment-tr.md:189-197) · type: wrong detail
  The document says. | cache.populate_models_requested | cache-models | 12 | ... (Article column '12' for all seven cache.populate_* events)
  What the code does. Art. 12 concerns logs recorded automatically by the high-risk AI system over its lifetime, serving 12(2)(a)-(c): risk and substantial-modification situations, Art. 72 monitoring, and Art. 26(5) operation. Staging weights and datasets onto an air-gapped host is a development and supply-chain step, better evidenced under Art. 10(2) (data origin) and Art. 11 / Annex IV §2.
  Proposed correction. Change the Article column to '10 / Annex IV §2' (provenance evidence) for the cache.populate_* rows, or retitle the column 'Supports'. Mirror in the TR file and in docs/reference/audit_event_catalog.md if it carries the same mapping.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-248 (docs, Low) — forgelm/config.py: wrong detail — "Art. 12+17: Post-market monitoring hooks."; "Enable Article 12 post-market monitoring hooks."; "EU AI Act Article 12 + 17 post-market monitoring block."
  severity Low
  Where. forgelm/config.py:1280,1284,1634 · type: wrong detail
  The document says. "Art. 12+17: Post-market monitoring hooks."; "Enable Article 12 post-market monitoring hooks."; "EU AI Act Article 12 + 17 post-market monitoring block."
  What the code does. Post-market monitoring is Art. 72. Art. 17(1)(h) requires the QMS to include it, and Art. 12(2)(b) only requires logs that facilitate it. Art. 12 is record-keeping.
  Proposed correction. 'Monitoring hooks supporting Art. 72 post-market monitoring (QMS Art. 17(1)(h); logging per Art. 12(2)(b)).'

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}