SKIP TO CONTENT
AI AGENTS6 minAgents in Production / Ep. 8 · Stage 8-3

AI Audit Log Retention: How Long to Keep Agent Records

Six months or six years? How long you keep an agent’s audit records depends on the rule behind each record, not on the AI.

XIN

IN 30 SECONDS

A retention class is the rule, stored on each record, that sets how long it must be kept. No period applies to every record: each rule has its own conditions.

KEY TAKEAWAYS · 3

  • Retention depends on the record category and the rules that apply. Article 19 describes a conditional six-month minimum; SEC Rule 17a-4 has several periods, not one universal six-year rule.
  • Store a retention class on every row; your legal and records team picks the rule.
  • Append, never edit (my proposed design, not a standard): a log that can be changed in place isn’t an audit trail.
On this page

How long you have to keep it

IN SHORT No retention period is a default for every record: each comes from a specific rule with its own conditions.

6
MONTHS MINIMUM
EU AI Act Article 19 log retention

Conditional: automatically generated logs of high-risk systems, under the provider’s control, unless other law says otherwise.

WORDS TO KNOW

Retention class
A label stored on each record that names the rule setting how long the record must be kept.
Broker-dealer
A person or firm whose business is trading securities for others or for its own account.

The Retention class A label stored on each record that names the rule setting how long the record must be kept. See the glossary is the field engineers leave until there’s an emergency. Deletion is the only step in this system you can’t undo. Once every copy is gone, nobody can inspect it.

So deletion should be a policy decision stored on the row, not a hurried script. A Legal hold A duty to keep records relevant to a pending or expected lawsuit or investigation, even past their normal period. See the glossary can keep a record past its period.

WATCH OUT

Which clock applies is a legal question. Your legal and records team sorts each record by what it supports, not by what produced it.

STEP BY STEP

Decide: How long do you keep an agent audit record?Decision tree: How long do you keep an agent audit record? If the system is high-risk under the EU AI Act, then At least six months. If the record supports a broker-dealer book or record, then At least six years, first two easily accessible. If it is a business communication or another record listed in Rule 17a-4(b), then At least three years, first two easily accessible. If a broker-dealer keeps covered records on rewritable storage, then Keep a complete time-stamped audit trail instead.DECIDEHow long do you keep an agentaudit record?If the system is high-riskunder the EU AI ActAt least six monthsArticle 19: automaticallygenerated logs under theprovider’s control, for aperiod fit for the intendedpurpose, at least sixmonths, unless Union ornational law saysotherwise.If the record supports abroker-dealer book orrecordAt least six years,first two easilyaccessibleSpecified categories only.Have the records ownerclassify the record; notall AI output inherits thisperiod.If it is a businesscommunication or anotherrecord listed in Rule17a-4(b)At least three years,first two easilyaccessibleA shorter tier, so a secondretention class in yourschema.If a broker-dealer keepscovered records onrewritable storageKeep a completetime-stamped audittrail insteadRule 17a-4(f)(2)(i): anon-rewriteable,non-erasable format, or afull audit trail ofchanges, deletions and,where applicable, who madethem.

Step 1. High-risk AI. High-risk AI system: Article 19 of the EU AI Act, from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).

Pick a step to see it move
  1. High-risk AI High-risk AI system: Article 19 of the EU AI Act, from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).
  2. Broker-dealer record A listed broker-dealer record: Rule 17a-4(a).
  3. Other listed record Another listed record: Rule 17a-4(b).
  4. Rewritable storage Covered records on rewritable storage: Rule 17a-4(f).
Assign an approved retention class and document how overlapping obligations, privacy limits and legal holds are resolved. This diagram lists examples, not a complete decision procedure.

Read the rules in the original, not a vendor summary: EU AI Act Article 19 for the six-month floor, and SEC Rule 17a-4 for the periods that apply to a Broker-dealer A person or firm whose business is trading securities for others or for its own account. See the glossary.

Coming up next: Is all this record-keeping worth what it costs?

What the record costs, and what it buys

IN SHORT Plan for what reliable logging costs: capture, storage, access control, integrity checks and recovery.

People often say the record is heavy. I don’t think so, and the cost isn’t where they expect.

The observability version

A typical setup: sampled traces, a 30-day retention window and a dashboard you can backfill. Great for debugging, not for an outsider’s question.

The audit version

My proposed design: one append-only record per action, complete for the actions in scope, retention set by the applicable rule, and a hash chain checked against signed checkpoints.

IN PLAIN WORDS

Not compliance theatre: the ability to answer one specific question about one specific action, on demand, months later.

For a buyer, the practical test: can the team investigate one specific failure? Keep sources, versions and decisions, so the answer can be examined, not defended with an average score.

ITEM GET

Append, never edit

In my proposed design, a correction is a second record, never an edit of the first.

FAQ

Your legal and records team sets it per category, with access, deletion and legal holds. Article 19 covers logs a high-risk provider controls, with exceptions; Rule 17a-4 sets a period per category. Check scope and dates; don’t keep everything for the longest period.

Only as later corroboration, labelled as such. As the agent’s evidence, it won’t survive scrutiny: it proves a plausible source exists, not that the agent used it. Capture the evidence when it’s found, with the document’s hash and exact span, before any answer.

Append-only records plus protected signed checkpoints, since anyone who can replace the whole log can recompute a bare hash chain. Keep old values and who changed them where rules require it. These checks are evidence; alone, they don’t prove full Rule 17a-4 compliance.

STAGE CLEAR

What you now know

  • Why each retention period comes from a specific rule with its own conditions.
  • Why deletion should follow a policy stored on the row.

Check yourself

Tap or click a question to see the answer.

Illustrative case: a record is a broker-dealer’s business communication, not a main book or record. Does it inherit the six-year period?

Not automatically. Rule 17a-4(b) sets a shorter tier of at least three years, the first two easily accessible. Have the records owner classify it.

Next episode:Which parts of the EU AI Act technical file can come from each release, and which need a named person?6 min
Adam Boudjemaa
Adam Boudjemaa

Former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft. Building production AI and regulated Web3 systems.

Have a project to ship or a role to fill?

Discuss your project or role
LinkedInTwitterGitHub
Follow the engineering notes

Get new articles on production AI and smart contracts by email.