{"slug":"eu-ai-act-art-18-documentation-keeping","id":"AIPT-OBL-0024","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0024","title":"Providers must keep high-risk AI documentation for ten years","short_title":"Documentation keeping","category":"record_keeping","summary":"For ten years after a high-risk AI system is placed on the market or put into service, the provider must keep at the disposal of national competent authorities the technical documentation, the quality management system documentation, any changes approved by a notified body, the notified body's decisions and other documents, and the EU declaration of conformity. Financial institutions keep these as part of their sector record-keeping.\n","practical_action":"Set a ten-year retention class for the technical file, QMS records and conformity documents of each high-risk system.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 18","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider"],"sectors":["cross_sector","financial_services"],"use_cases":["finance_and_credit","safety_critical"],"applicability":[{"description":"Providers of high-risk AI systems; retention runs from the date the system was placed on the market or put into service.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Retention schedule for AI conformity records","description":"Retention class, storage location and disposal date per document type.","artifact_type":"document"},{"title":"Technical file archive index","description":null,"artifact_type":"register"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 7.5.3; Annex A.6.2.7","note":"Control of documented information and technical documentation.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.4","note":"Documentation of governance and risk decisions retained.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"satisfies","note":"Retention classes and archive controls for the listed documents.","confidence_level":"high","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"},{"slug":"technical-documentation-and-model-cards","title":"Technical documentation, model cards and instructions for use","kind":"process","relationship":"supports","note":"Produces the technical file that must be retained.","confidence_level":"high","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}