EU AI Act Art. 18 — Documentation keeping
Article 18 says providers must keep the technical documentation and related records for 10 years after a high-risk system is placed on the market — and member states must keep the records usable even if the provider goes out of business.
At a glance
What this article requires
- Technical documentation and records must be kept for at least 10 years after market placement or putting into service.
- Records include the technical documentation, QMS documents, notified body decisions, and the EU declaration of conformity.
- Member states set rules so the documentation survives provider insolvency or closure.
Scope
Who this applies to
Providers of high-risk AI. Deployers should mirror the logic — keep deployment records and logs so they can prove compliant use.
Obligations
What you must actually do
Set a 10-year retention policy
Store technical documentation, QMS records, notified body decisions, and declarations of conformity for the full window.
Plan for the worst case
If the provider could be wound down, the records must still be reachable — consider escrow or transfer arrangements.
Keep records current
Retention is not a static archive: updates after substantial changes belong in the same record chain.
Action plan
Practical first steps
- 1
Add a retention schedule to your documentation system with a 10-year minimum.
- 2
Version every document so authorities can see the history, not just the latest state.
- 3
Nominate a records owner and test retrieval in an audit drill.
Penalty exposure
Documentation-retention failures sit in the general tier: up to €15 million or 3% of global annual turnover.
FAQ
Questions about Art. 18
Does the 10-year clock reset on every update?
The clock runs from the placing on the market or putting into service of each version. Substantial modifications can start a fresh assessment — and with it, a fresh retention obligation for that version's records.
What exactly counts as 'documentation' under Article 18?
The technical documentation (Art. 11 + Annex IV), QMS records (Art. 17), notified body decisions, and the EU declaration of conformity (Art. 47).
Sources
Citations & further reading
Related
More article explainers
Wondering which articles apply to your AI?
Describe your system in the free Risk Scanner and get a preliminary risk read with the obligations that likely apply — in seconds.
Check my use casePreliminary EU AI Act clarity summary. Not legal advice.