Documentation Keeping for AI Systems

Legal Framework

Documentation keeping for AI systems under the AI Act is governed primarily by Article 11, Article 18, and Article 22. Article 11 establishes the substantive obligation: technical documentation for high-risk AI systems must be prepared before market placement and maintained on an ongoing basis.

"The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date."
— AI Act Art. 11

The documentation must demonstrate compliance with the requirements set out in the relevant Section of the Act and provide national competent authorities and notified bodies with the information necessary to assess that compliance.

Article 18 imposes the core retention obligation on providers, covering five categories of documentation: technical documentation under Article 11, quality management system documentation under Article 17, notified-body change approvals, notified-body decisions, and the EU declaration of conformity under Article 47. The retention period runs for ten years from market placement or putting into service.

"The provider shall, for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the national competent authorities"
— AI Act Art. 18

Article 18(2) addresses continuity where a provider or authorised representative goes bankrupt or ceases activity before the ten-year period expires, leaving Member States to determine the conditions under which documentation remains accessible. Article 18(3) provides a carve-out for financial institutions already subject to internal governance requirements under Union financial services law, permitting them to maintain technical documentation within their existing regulatory documentation frameworks.

For providers established outside the EU, Article 22 requires appointment of an EU-based authorised representative who must verify that documentation has been properly drawn up and retain it for the same ten-year period.

"verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider"
— AI Act Art. 22

Key Developments

No enforcement decisions or court rulings have yet emerged interpreting the documentation-keeping obligations. The AI Act entered into force on 1 August 2024, with obligations for high-risk AI systems becoming applicable from 2 August 2026. Practical thresholds will be shaped by the first conformity assessments, harmonised standards, and initial enforcement actions by national competent authorities.

Status of the Debate

This topic is developing — no dominant doctrinal pattern has emerged. The statutory text is clear on retention periods and the categories of required documentation, but open questions persist regarding the level of detail demanded in technical documentation for continuously learning systems, how the "kept up-to date" obligation in Article 11 interacts with model retraining, and how Member States will implement the bankruptcy continuity provisions in Article 18(2). Resolution will likely come through implementing acts, harmonised standards, and the first wave of conformity assessments conducted by notified bodies.

Practical Guidance

• Establish a documentation governance framework covering all five categories listed in Article 18(1), with version control and update triggers tied to system modifications and retraining cycles.
• Maintain technical documentation contemporaneously — Article 11 requires it to be drawn up before market placement and kept current, meaning documentation must be updated whenever the AI system undergoes material changes.
• Plan for the 10-year retention period from the date of market placement or putting into service, and ensure business continuity arrangements address the bankruptcy scenarios contemplated by Article 18(2).
• For non-EU providers, appoint an authorised representative under Article 22 whose mandate explicitly empowers verification and retention of documentation for the full ten-year period.
• Financial institutions should map AI Act documentation requirements against existing regulatory documentation frameworks to leverage the integration permitted by Article 18(3).