What does 12.1 require?

System operators keep logs of system actions and of user actions, so that security compliance, incident investigation and vulnerability remediation have a record to work from.

UK AI Cyber Security Code of Practice 12.1: Log system...

Other controls in Secure maintenance (Principles 11 and 12) – UK AI Cyber Security Code of Practice

11.1 Provide security updates and patches, with contingency where updates are impossible
11.2 Treat major updates as a new version and support operators through model changes (11.2 and 11.3)
12.2 Analyse logs for anomalies, breaches and unexpected behaviour
12.3 Monitor internal states of the AI system where useful for security
12.4 Monitor model and system performance over time for security-relevant change

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All UK AI Cyber Security Code of Practice controls