EU AI Act retention periods, by article: logs at least 6 months, technical documentation 10 years.

Article 12: record automatically, over the lifetime of the system. High-risk AI systems must technically allow for the automatic recording of events, called logs in the Regulation, over the lifetime of the system. Article 12 creates the recording duty and the traceability purpose. It does not itself set the retention period. The periods live in the articles below, which is the detail most summaries get wrong.

Article 19(1): providers keep the logs for at least 6 months. Providers of high-risk AI systems must keep the Article 12 logs, to the extent those logs are under their control, for a period appropriate to the intended purpose of the system, of at least six months, unless applicable Union or national law provides otherwise, in particular Union law on the protection of personal data. Six months is a floor, not a ceiling: appropriate to the purpose can mean longer, and other law can set a longer period.

Article 26(6): deployers keep the logs for at least 6 months. Deployers of high-risk AI systems carry the mirror duty for the logs under their control: a period appropriate to the intended purpose, of at least six months, with the same unless-other-law-provides wording. If your small team uses a high-risk system rather than building one, this is most likely your article.

Article 18: technical documentation for 10 years. The provider must keep the technical documentation, the quality management documentation, the certificates and related material at the disposal of the national competent authorities for a period ending 10 years after the high-risk AI system was placed on the market or put into service. This is the ten year figure people repeat. It applies to documentation, not to the Article 12 logs.

Article 47: the EU declaration of conformity for 10 years. The provider draws up the declaration for each high-risk system and keeps it at the disposal of the authorities for 10 years after the system was placed on the market or put into service. Same clock family as Article 18, different document.

Per-call work records and receipts: keep at least 6 months, and longer where a client contract, a dispute window, or sector law needs it. Six months matches the Act log floor and covers most client dispute timelines. If a record supports an invoice, keeping it until the invoice dispute and tax windows close is the practical rule many teams use. Decide the number per record class, write it down, and apply it the same way every time.

Technical and system documentation: if you are a provider of anything near the high-risk line, plan on 10 years. That is the Article 18 clock, and it is cheaper to keep documentation that long from the start than to reconstruct it.

Personal data inside records: the clock can cut the other way. Both Article 19 and Article 26(6) carve out Union law on the protection of personal data. Keeping personal data longer than needed creates its own exposure. The schedule should name, per record class, what personal data it holds and why the chosen period is the right one.

Deletion is part of the schedule. A retention period nobody enforces is just accumulation. Put the review and deletion step on a calendar, and keep a note of what was deleted and when. That note is itself a record worth keeping.

How long must EU AI Act logs be kept?

For high-risk AI systems, at least six months. Article 19(1) sets that floor for providers, for the automatically generated logs under their control, and Article 26(6) sets the same floor for deployers. Both say a period appropriate to the intended purpose, of at least six months, unless other Union or national law provides otherwise. Six months is the minimum, not a recommended maximum.

Does the EU AI Act require keeping logs for 10 years?

No. The 10 year period in Article 18 applies to technical documentation and related material that the provider keeps at the disposal of the authorities, counted from when the system was placed on the market or put into service. Article 47 sets the same 10 years for the EU declaration of conformity. The logs themselves carry the six month floor in Articles 19 and 26(6). Mixing the two numbers up is the most common error in summaries of the Act.

Do these retention duties apply to my small team if we just use AI tools?

Only if the tools are high-risk AI systems under the Act and you deploy them, in which case Article 26(6) is the deployer duty. Most everyday agent and office AI use is not in the high-risk category. Many teams still adopt the six month log floor voluntarily, because customers ask for it in contracts and because dispute and audit questions rarely arrive inside six months of the work.

When do the EU AI Act record duties start applying?

The Regulation applies from 2 August 2026 under Article 113, with some chapters applying earlier and Article 6(1) obligations from 2 August 2027. The record duties described here are part of the high-risk regime that follows that timetable. Check the current EUR-Lex text and your legal advice for any later amendments before relying on a date.

What should a small team write in its retention policy?

One line per record class: what the record is, which duty or contract it answers, the period, where it is kept, and when it is deleted. For AI work records, a workable default is at least six months for per-call logs and receipts, longer where client contracts or dispute windows require, and 10 years for provider technical documentation if the Article 18 duty applies to you.