Article 18

Documentation keeping

1.   The provider shall, for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the national competent authorities:

(a)

the technical documentation referred to in Article 11;

(b)

the documentation concerning the quality management system referred to in Article 17;

(c)

the documentation concerning the changes approved by notified bodies, where applicable;

(d)

the decisions and other documents issued by the notified bodies, where applicable;

(e)

the EU declaration of conformity referred to in Article 47.

2.   Each Member State shall determine conditions under which the documentation referred to in paragraph 1 remains at the disposal of the national competent authorities for the period indicated in that paragraph for the cases when a provider or its authorised representative established on its territory goes bankrupt or ceases its activity prior to the end of that period.

3.   Providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the technical documentation as part of the documentation kept under the relevant Union financial services law.

Frequently Asked Questions

Companies must keep documents related to high-risk AI systems for at least ten years after placing the system on the market or putting it into use; these documents help authorities check whether systems are safe, properly managed and still comply with rules, even a long time after their initial release to customers.
Providers have to store technical documents explaining how an AI system works, quality management system records, information on approved changes to the system, decisions from official testing institutions (notified bodies), and a formal statement confirming these AI systems meet EU regulations.
If a company shuts down or goes bankrupt before the ten-year documentation period ends, EU countries must have rules ensuring documentation still remains available, so authorities can access necessary information even if the original company no longer exists or no longer operates.
Financial institutions already have strict documentation standards under separate EU financial rules; therefore, they must keep documentation related to high-risk AI within those existing records and management structures required by financial laws to avoid duplication and streamline compliance responsibilities.

AI literacy

Get Started within 24 hours.

Once you have submitted your details, you’ll be our top priority!