Art.18

Article 18 — Documentation Keeping

High-Risk Systems SME Relevant ~2 min read · 448 words

Article 18 sets out how long providers of high-risk AI systems must retain the documentation they are required to create. It is a short but practically important article — documentation that cannot be produced when a regulator asks for it is as good as documentation that was never created.

⚠ Medium compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

How Long Must Providers Keep Their Records?

Article 18 establishes the documentation retention obligations for providers of high-risk AI systems. While Articles 11 and 17 define what documentation must be created, Article 18 specifies how long it must be kept — ensuring that the compliance record remains available for regulatory scrutiny throughout the system’s commercial life and beyond.

WHAT IT SAYS

Ten years minimum — from the date of market placement

Providers must keep the technical documentation referred to in Article 11 and the quality management system documentation referred to in Article 17 for a period of ten years after the high-risk AI system has been placed on the market or put into service
Where the provider is no longer in business and has no legal successor, the documentation must be made available to national competent authorities for that same period — obligations survive the company
The ten-year period starts from the date the system is placed on the market or put into service — not from the date it is discontinued
Where EU or national law applicable to the deployers requires longer retention, the longer retention period prevails
Financial institutions subject to sectoral documentation requirements must keep documentation in line with those sectoral rules

WHO IS AFFECTED

All high-risk AI providers — including those who cease trading

All providers of high-risk AI systems — this obligation runs for the full ten years regardless of whether the system is still on the market
Legal successors of providers — if the original provider is acquired or restructured, the documentation obligations transfer
Insolvency practitioners and liquidators dealing with providers who cease trading — they must ensure documentation remains accessible
Providers operating in regulated sectors where sectoral law sets longer retention periods

WHAT IT MEANS FOR SMES

Build your document management infrastructure before you launch

Ten years is a long time — ensure your documentation is stored in a format and location that will remain accessible for a decade, including after staff turnover or system changes
Cloud-based document management is strongly advisable — storing compliance documentation only on local machines or with individual employees creates serious risk
If your startup is acquired, the acquiring entity assumes your documentation obligations — make this explicit in any due diligence or acquisition agreement
The obligation survives company dissolution — if you wind down the business, you must make arrangements for the documentation to remain accessible to authorities
Start building your documentation archive from day one of development — retrofitting ten years of compliance records is not possible

Article 11 — Technical documentation (the primary documentation subject to retention)
Article 17 — Quality management system (QMS documentation also retained under this article)
Article 19 — Automatically generated logs (separate retention obligation for logs)
Article 74 — Market surveillance (authorities may request documentation during this period)

← Back to the Guide