Buried inside the EU AI Act's technical requirements is one of the most demanding obligations for enterprise AI teams: mandatory log retention. For high-risk AI systems, this is a statutory requirement — and the retention periods are longer than most organisations expect.
What the Law Actually Says
Article 12 of the EU AI Act requires that high-risk AI systems automatically generate logs enabling post-hoc monitoring. Article 18 specifies retention periods. The headline number is 10 years for technical documentation, but for operational logs themselves, the period is tied to the system's intended purpose.
For most enterprise high-risk AI systems, the practical minimum is 7 years — aligning with EU financial record-keeping norms, general product liability timelines, and the Act's own risk framework for AI systems affecting employment, credit, or significant individual decisions.
What Must Actually Be Retained
The logs the EU AI Act requires are not standard application logs. They are decision-level records that allow a regulator, auditor, or affected individual to reconstruct what the AI system did, when, on what inputs, and with what confidence. Specifically, compliant retention must cover input data processed at each inference event, the output or decision produced including probability scores, timestamps with sufficient precision, the model version active at time of decision, human overrides or interventions applied, and anomaly records — logs of when things went wrong, frequently the most important evidence in post-incident investigations.
The Integrity Problem
Retention duration is only half the challenge. The EU AI Act requires retained logs to be tamper-evident. A log that exists for 7 years but can be modified at any point provides no compliance value. Most enterprise logging infrastructure is not designed for tamper-evidence. Standard database logs can be edited by administrators; log aggregation platforms can be reconfigured to overwrite older records; file-based logs can be modified with root access without audit trail. Tamper-evidence is structural to what the regulation requires.
WORM Storage as the Retention Foundation
Write-Once Read-Many (WORM) storage is the technically sound approach to 7-year compliant retention. WORM is the same infrastructure used for financial records under SEC Rule 17a-4 and healthcare records under HIPAA — a mature, auditable technology regulators recognise as providing the tamper-evidence the AI Act demands. Implementing WORM for AI logs requires cryptographic hashing of each entry at write time, hash chaining to prevent sequence reordering, and periodic integrity verification proving records are unmodified.
Retention Periods by System Type
HR and recruitment AI: 7 years minimum. Employment decisions are subject to extended challenge periods across EU member states. Credit scoring AI: 7–10 years. Financial conduct regulations often require longer retention and the AI Act adds to sector-specific obligations. Medical device AI: Minimum 10 years from market placement under MDR 2017/745. Critical infrastructure AI: 10 years as a prudent minimum given the risk profile.
The Cost of Getting This Wrong
The EU AI Act includes fines up to €15M or 3% of global turnover for technical requirement violations. But the financial penalty may be the lesser concern. Inability to produce required retention records during a regulatory investigation is evidence of systemic non-compliance — triggering broader enforcement and reputational consequences that dwarf the penalty itself. Regulators investigating an adverse AI decision will immediately request logs. If those logs cannot be proven unmodified from their original form, the organisation faces a presumption of inadequate controls that is extraordinarily difficult to rebut after the fact.