Providers must keep high-risk AI documentation for ten years

Practical action

Set a ten-year retention class for the technical file, QMS records and conformity documents of each high-risk system.

Who does it apply to?

Providers of high-risk AI systems; retention runs from the date the system was placed on the market or put into service.

Actors

Provider / developer

Sectors

Cross-sector / all sectorsFinancial services and credit

Use cases

AI in finance, credit and insuranceSafety-critical and infrastructure

Applies from: 2 December 2027

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesTechnical measureEngineering lead · continuous
  Automatic event logging and record retention

  Serves 9 recorded duties · evidence: AI system event logs, Log schema and retention standard, Log integrity and retention check

  Retention classes and archive controls for the listed documents.

• supportsProcessProduct or model owner · at launch and on material change
  Technical documentation, model cards and instructions for use

  Serves 14 recorded duties · evidence: Technical documentation file, Model card or deployer information pack, Instructions for use

  Produces the technical file that must be retained.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI System Inventory

  Register · XLSX and DOCX · v6

• EU AI Act Role and Risk Classifier

  Checklist · XLSX · v4

• AI Agent Registry and Permission Matrix

  Register · XLSX and DOCX · v6

• EU AI Act Article 50 Transparency Kit

  Kit · DOCX and XLSX · v44

All 10 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Providers must keep high-risk AI documentation for ten years (EU AI Act)” [AIPT-OBL-0024, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0024 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0024: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

@misc{aipolicytracker2026_providersmustkeephighris,
  author       = {{AIPolicyTracker}},
  title        = {{Providers must keep high-risk AI documentation for ten years (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Design high-risk systems to log events automatically — EU AI Act, European Union
• Providers must retain automatically generated logs under their control — EU AI Act, European Union
• Keep records of consequential decisions influenced by the technology for three years — Colorado ADMT law (SB 26-189), Colorado (United States)