How long should you keep AI records?
There is no single answer, and any specific period offered without knowing your sector, your contracts and your jurisdiction would be arbitrary. A retention period is derived rather than looked up: from the longest period anybody could ask you about, from whatever your contracts and applicable rules require, and from what your systems actually do today, which is usually a vendor default nobody chose. This page describes how to derive it. It is not legal advice, and where a period is imposed on you, it is imposed by the rule or contract that imposes it rather than by any practice described here.
Start from what you would be asked for
The practical floor is the longest backward-looking period somebody might reasonably ask about. An auditor asks about a period that has already ended. A customer's annual review asks what you were doing when they signed. A dispute asks about a specific date, chosen by somebody else.
That gives a period rather than a rule, and it is the part you can work out for yourself. It is also the part organizations most often get wrong in the same direction, by setting retention from how long the records feel useful rather than from how far back the question can reach.
Where an obligation genuinely applies, it comes from a contract, a sector rule or a law, and it comes with its own period. Those override anything derived here, and identifying which apply to you is a question for whoever advises you on them.
Find out what your systems actually do
Almost every organization has a retention position it did not choose. Vendor products age out logs, conversation histories and audit records on defaults set by the vendor, and those defaults differ between products and between plan tiers of the same product.
Do the check before writing the policy, because the two have to agree. A written period the systems do not honor is the version somebody can test you against, and testing it is easy: read the number, ask the system. Writing nothing is not the alternative. The alternative is writing the period you can actually meet, and changing the systems where you cannot.
The other direction is equally common. Keeping everything forever is not a retention position either, and it is rarely as true as it sounds, because something is usually aging out quietly somewhere.
Deletion has to be as deliberate as retention
A deletion that was recorded is one you can account for: you can say what the schedule was and that it ran. A record that is simply gone leaves you reconstructing why, usually for somebody who has already decided the absence matters. Recording the deletion is what makes the account possible. It is not what makes the account sufficient, and whether an absence is acceptable turns on facts about your obligations that no schedule and no self-assessment can settle.
This is also where holds matter. Preservation obligations come from contracts, sector rules and law, and where one applies it overrides whatever schedule you set. When one attaches, and to what, is a question for whoever advises you on them, not something a schedule can determine. What a schedule has to have is a way to be suspended, because one with no hold mechanism will eventually run on something it was supposed to leave alone. The shipped Retention Purge Scheduler suppresses a held class from the purge schedule for that reason.
Common questions
- Is there a standard retention period for AI systems?
- No. Periods that apply to you come from your contracts, your sector and your jurisdiction, and different categories of record within one organization commonly carry different periods. Anybody offering a single number for AI records generally is describing a convention rather than a requirement.
- Does keeping records longer make us safer?
- Not automatically, and it cuts both ways. Longer retention means the record exists when somebody asks, and it also means it exists when somebody asks for something you would rather not still hold. Both directions are real and they point opposite ways, which is why the period is a decision somebody makes and records rather than one that falls out of a vendor default. Neither direction is the safe one in general.
- Is this legal advice?
- No. This describes how organizations derive a retention period and what commonly decides it. Which rules apply to you, and what any of them require, is a question for a qualified adviser who knows your circumstances.
Find out where you stand
The assessment on this site asks up to 24 questions about what makes your evidence stop being reproducible, and returns a score, a verdict and, where a control is short, the one thing to fix first. It names no framework, it takes about ten minutes, and where nobody outside asks, the two questions about somebody else's deadline and somebody else's reader are dropped rather than scored against you.
It is a self-assessment of whether what you can show today would still be showable later, not an audit, not a certification, not a conformity assessment and not legal advice. It says nothing about whether the practice it describes is adequate.
Run the assessment