One of the EU AI Acts' key pillars is mandatory record-keeping to ensure transparency, accountability, and traceability throughout the AI lifecycle:
Technical documentation detailing system design, training data, and performance
Quality management procedures covering risk controls and testing protocols
System logs capturing inputs, outputs, and decision-making processes
User consent records, where applicable
And for how long?
Most documentation: 10 years after market release
System logs: minimum 6 months, extendable under other EU laws
Even if a business shuts down, Member States must ensure these records remain accessible to regulators.
Need some help? Ask our experts for free, no-obligation advice.
The EU AI Act does not use the term “immutability” explicitly in its core articles, but it strongly implies the need for tamper-proof, traceable, and auditable records.