# Providers must keep high-risk AI documentation for ten years

- **Record type**: Obligation
- **Instrument**: Regulation (EU) 2024/1689 — Artificial Intelligence Act
- **Jurisdiction**: European Union
- **Category**: record_keeping
- **Binding**: Yes
- **Applies from**: 2026-08-02
- **Provision**: Article 18

## What the duty requires

For ten years after a high-risk AI system is placed on the market or put into service, the provider must keep at the disposal of national competent authorities the technical documentation, the quality management system documentation, any changes approved by a notified body, the notified body's decisions and other documents, and the EU declaration of conformity. Financial institutions keep these as part of their sector record-keeping.

## What an organisation does about it

Set a ten-year retention class for the technical file, QMS records and conformity documents of each high-risk system.

## Controls that meet this duty

- Automatic event logging and record retention (satisfies): https://aipolicytracker.org/controls/record-keeping-and-logging
- Technical documentation, model cards and instructions for use (supports): https://aipolicytracker.org/controls/technical-documentation-and-model-cards

## Parent instrument

- Regulation (EU) 2024/1689 — Artificial Intelligence Act
  - Record: https://aipolicytracker.org/policies/eu-ai-act
  - Context file: https://aipolicytracker.org/policies/eu-ai-act.md

## Provenance

- **Record page**: https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping
- **Official source**: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- **Provision**: Article 18
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-09-24
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.