AI Act Technical File: How Long to Keep It and Key Dates
An auditor asks, in year nine, for the documentation behind one number. Can you hand over the right version?
IN 30 SECONDS
The retention period of the EU AI Act technical file is 10 years under Article 18, after the system is placed on the market or put into service. Article 72 has applied since 2 August 2026; Article 11 applies from 2027 or 2028, depending on the system.
KEY TAKEAWAYS · 3
- Resolve the output to its release tag, then render the file for that tag.
- Logs: at least six months unless other law says otherwise (Article 19). Technical documentation: 10 years (Article 18).
- Article 72 has applied since 2 August 2026; Article 11 applies from 2027 or 2028, depending on the system.
On this page
When someone asks for the file, and for how long
IN SHORT When someone asks, you resolve their output to its release tag and render the file for that tag.
WORDS TO KNOW
- Technical documentation
- The file Article 11 asks a provider to draw up and keep up to date.
- High-risk AI system
- A system the Act classes as high-risk. Whether yours is one is a legal question.
- Release tag
- A version-control label, like 1.4.0, that marks one release.
An auditor, a notified body or a client’s risk team asks: show me the docs for the version that made this number.
A request for the technical file is a quick lookup only if the output names its version.
STEP BY STEP
Step 1. The request. One number, one question: which version made it?
- The request One number, one question: which version made it?
- Resolve the tag The audit record links that output to its tag.
- Render that version The build checks out the tag and renders the nine points from one commit. Some evidence lives outside the repo, and people still review the file.
- Hand it over The asker gets one dated document for that exact version.
- No tag Without a release tag, you can hand over a document, but not prove it describes the system behind the number.
Keep two clocks apart:
- Logs the system writes by itself: at least six months (Article 19), unless other Union or national law says otherwise.
- Documents: 10 years after the system is placed on the market or put into service (Article 18).
For those 10 years, Article 18 keeps these open to “national competent authorities”:
- the Technical documentation The file Article 11 asks a provider to draw up and keep up to date. See the glossary;
- your quality management system papers;
- records of changes notified bodies approved, where applicable;
- notified body decisions and documents, where applicable;
- the Article 47 EU declaration of conformity.
WATCH OUT
In finance: providers that are financial institutions under EU financial services law keep the technical documentation in the files that law already requires.
ITEM GET
The tag is the thread
Which dates apply: Article 72 now, Article 11 later
IN SHORT Article 72 already applies and points at the Annex IV file; Article 11 itself applies later.
Article 11 sits in Chapter III, Section 2. The consolidated Article 113 starts Sections 1 to 3 of Chapter III, except Article 6(5), on one of two dates. The date depends on how the system is classed.
Article 72 sits in Chapter IX, which was not postponed, so it has applied since 2 August 2026. Its third paragraph says: “The post-market monitoring plan shall be part of the technical documentation referred to in Annex IV.”
The Commission is due to adopt guidance, with a template for that plan, by 2 September 2027.
IN PLAIN WORDS
Article 72’s monitoring duty already runs. Article 11’s file duty starts in 2027 or 2028, depending on the system.
What that overlap means for a given system is a question for a lawyer. I don’t answer it. Which branch covers a High-risk AI system A system the Act classes as high-risk. Whether yours is one is a legal question. See the glossary, if either does, is a legal classification too.
Sources: consolidated AI Act text (EUR-Lex), Regulation (EU) 2026/1744 (Official Journal), AI Act Service Desk on Article 11, Annex IV and Article 18. The Desk still showed old wording when I checked, so I used the amending law; unofficial trackers can lag too.
FAQ
From 2 December 2027 (Article 6(2), Annex III) or 2 August 2028 (Article 6(1), Annex I). Which branch covers a system, if either does, is a question for a qualified lawyer.
For 10 years after the system is placed on the market or put into service (Article 18). Logs are separate. They are kept at least six months, unless other Union or national law says otherwise (Article 19).
No. It doesn’t tell you if the law applies to you, if your system is high-risk, or how a regulator would read it. Ask a lawyer.
STAGE CLEAR
What you now know
- The audit record links a number to its release; the tag links the release to its file.
- Logs and the technical file run on different clocks, and which date applies to a system is a legal classification.
Check yourself
Tap or click a question to see the answer.
A team keeps its agent logs for seven months, then deletes them. Has it covered Article 18 for the technical file?
No. Six months is Article 19’s floor for logs, unless other law says otherwise. The 10 years of Article 18 apply to the technical documentation and the other listed documents.
Former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft. Building production AI and regulated Web3 systems.
Have a project to ship or a role to fill?
Discuss your project or roleFollow the engineering notes
Get new articles on production AI and smart contracts by email.