Does the EU AI Act specify a maximum retention for Article 12 logs?

Article 12 does not specify a maximum. Article 19 sets the floor at six months. The Commission's implementing acts will set more specific requirements. Best practice sets retention at the AI system's lifetime plus a period sufficient to cover post-deployment audits and investigations. Supervisory authorities in France, Germany, and Ireland have suggested 10 years post-decommission as a working floor.

Can I retain LLM audit logs in a hyperscaler bucket like S3 or GCS?

Object storage with versioning and object-level immutability satisfies the tamper-evident properties for many regulatory regimes. HIPAA and SOX both accept object storage when the account controls prevent modification of the records after creation. The EU AI Act does not prescribe the storage medium. The retention policy has to include the object lock configuration and the compliance mode that prevents deletion during the retention period.

What happens if a GDPR erasure request applies to data in a SOX-retention record?

The Article 17 exception for compliance with a legal obligation applies. The controller can refuse the erasure request to the extent the SOX retention obligation applies. The refusal has to be documented and communicated to the data subject with the reason. Best practice includes a retention justification document the controller can produce on request.

Do the logs have to be replicated across regions for disaster recovery?

The retention obligation does not require multi-region replication, but the survival obligation typically does. If the record's regional storage layer fails and the record is not recoverable, the retention obligation is unmet. Multi-region replication or off-site backup is common. GDPR restricts personal data transfers to third countries, so replication has to stay within lawful transfer paths.

How do I handle retention when I change AI providers?

The retention obligation attaches to the record, not to the AI provider. When the operator switches from OpenAI to Anthropic, the existing records retain for their full retention period. The new provider's records start their own retention period. The record series remains a continuous timeline the audit team samples across the provider switchover.

LLM Audit Log Retention: What Each Regulation Actually Demands and How Long the Records Have to Survive

The retention period for LLM audit logs turns on which regulation the deployment falls under, and most enterprise deployments fall under more than one. The EU AI Act Article 12 sets the retention floor at the lifetime of the AI system. HIPAA sets 6 years on required records. SOX Section 802 sets 7 years on records material to financial statements. GDPR requires retention only as long as necessary for the processing purpose, then erasure. FINRA Rule 4511 sets 6 years on communications records. When the deployment straddles multiple regimes, the operator has to reconcile the retention rules in a single policy.

I want to walk through each regulation's actual retention rule for AI decision records, the maximum-of-applicable-floors rule most compliance teams end up applying, the interaction with the GDPR erasure obligation, and the tamper-evident storage properties the records need to survive the retention period.

EU AI Act Article 12: retention for the lifetime of the AI system

Article 12(1) requires high-risk AI systems to enable the automatic recording of events (logs) over the lifetime of the system. The regulation does not set an explicit maximum retention. Article 19 (record-keeping obligations) requires the provider and the deployer to keep the logs for at least six months, and longer where required by Union or national law.

The Commission's implementing acts under Article 12(3) will set more specific technical requirements. The current best practice sets retention at the AI system's lifetime plus a further period sufficient to cover any post-deployment audit or investigation. Ten years from the last day the AI system was in operation is a common floor in supervisory authority guidance.

The market surveillance authority under Article 74 can require the logs during an investigation. The authority's request has to be answered even after the AI system is decommissioned. The deployer's retention policy has to survive the AI system's operational life.

HIPAA: 6 years on required records

HIPAA at 45 CFR 164.316(b)(2) requires covered entities and business associates to retain required documentation for six years from the date of its creation or the date when it last was in effect, whichever is later. The required documentation includes access logs and audit records of protected health information.

An LLM audit record that captures the identity of the user, the timestamp, the input containing PHI (or the classifier verdict that flagged the input as PHI), and the disposition (permit, redact, deny) falls within the required documentation. The record retains for six years from the last day the AI system was in operation for the covered entity.

The HIPAA audit standard (45 CFR 164.312(b)) requires audit controls to record and examine activity in information systems that contain or use electronic protected health information. The LLM audit record satisfies this standard when the record captures the AI system's activity on PHI-classified requests.

SOX Section 802: 7 years on financial records

SOX Section 802 (18 U.S.C. § 1520) requires the retention of records relevant to the audit of an issuer's financial statements for seven years from the end of the fiscal period in which the audit was concluded. The retention obligation covers records that are material to the audit.

An LLM audit record becomes SOX-material when the AI system participates in a process that affects the financial statements. Common scenarios: AI-assisted revenue recognition (contract classification, deferred revenue calculations), AI-assisted expense classification, AI-assisted vendor payment approvals, AI-assisted internal financial reporting.

The seven-year clock runs from the end of the fiscal period. An AI decision made in Q1 of a fiscal year retains through the end of the seven-year period following that fiscal year's audit.

GDPR: retention only as long as necessary

GDPR Article 5(1)(e) (storage limitation) requires personal data to be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. The retention period for LLM audit records that contain personal data has to match the purpose.

The purpose analysis for the log records typically identifies three purposes: compliance with the applicable regulatory retention obligation (EU AI Act, HIPAA, SOX), security and fraud detection, and defense against legal claims. Each purpose has its own necessary retention.

The compliance purpose retention matches the applicable regulatory floor. The security and fraud detection purpose retention is typically 12 to 24 months based on the operator's threat model. The legal claims defense retention matches the applicable limitation period (six years is common in commercial contexts).

The GDPR erasure obligation under Article 17 can conflict with a longer regulatory retention. The GDPR position (EDPB Guidelines 5/2019 on the criteria of the right to be forgotten) is that Article 17 does not override a legal obligation the controller is subject to. The retention obligation under HIPAA, SOX, or the EU AI Act qualifies as a legal obligation the controller can invoke to reject an erasure request.

FINRA Rule 4511: 6 years on communications

FINRA Rule 4511 requires member firms to preserve books and records for the period required under the Securities Exchange Act, generally six years for communications records. When a broker-dealer deploys an LLM in customer-facing communications (chatbot, AI-generated advice), the resulting communication becomes a record subject to the retention rule.

The LLM audit record has to capture the full conversation, the customer identity, the associated person handling the interaction (if any), and the AI system version. The record retains for six years from the last date the customer relationship was active or the communication was made.

FINRA's 2024 guidance on generative AI extends the existing books-and-records rules to AI-generated communications. The member firm's supervisory policy has to include the AI system's operation, and the audit record has to enable the supervisor's review.

The maximum-of-applicable-floors rule

Most enterprise deployments fall under multiple regulatory regimes. The compliance team's retention policy usually sets a single retention period per record class, and that period equals the maximum of the applicable regulatory floors.

For a healthcare AI deployment that also touches financial reporting: HIPAA 6 years, SOX 7 years, EU AI Act lifetime plus 10 years. The retention policy sets 10 years post-decommission as the floor, and the record survives all three obligations.

For a broker-dealer AI deployment operating in the EU: FINRA 6 years, EU AI Act lifetime plus 10 years. The retention policy sets 10 years post-decommission.

For a general enterprise LLM deployment without HIPAA, SOX, or FINRA exposure: EU AI Act (if high-risk) applies. If the system is not high-risk under Annex III, GDPR sets the retention based on purpose necessity, and the policy typically sets 24 to 36 months.

The record-per-record retention with per-regulation classification is possible but rarely implemented. The operational overhead of running distinct retention windows per record exceeds the storage cost of the maximum retention.

The tamper-evident storage properties records need

The retention obligation is not just an obligation to keep the records. The obligation is to produce records that survive an audit as authentic and complete.

The record has to be produced outside the application's control. The application that made the AI request cannot be the sole author of the audit record the regulator samples. The write path has to go to storage the application cannot modify.

The record has to carry a cryptographic integrity signature and a hash chain pointer. The signature confirms the record has not been modified after creation. The hash chain pointer catches retroactive modification across the record series.

The record has to be indexed for the queries the audit will run: by user identity, by time range, by AI system, by decision type. The storage layer that supports the retention period also has to support the query patterns the audit uses.

The storage layer has to survive infrastructure migrations. A 10-year retention period will span multiple generations of storage technology. The retention policy has to include the migration approach that preserves the record's integrity signature across the migration.

DeepInspect

The DeepInspect gateway produces the per-decision audit record at request time and writes it to tamper-evident storage the deploying organization controls. The record carries the user identity, the timestamp, the model and version, the input fingerprint, the response classifier outcome, the applied policy, and the decision. The record's integrity signature and hash chain pointer support the tamper-evident properties the retention period expects.

The storage layer supports retention windows from 24 months to 10-plus years and answers the query patterns HIPAA, SOX, EU AI Act, and FINRA audits use. The record's indexing lets the audit team resolve a specific request in seconds even at the end of a decade-long retention window.

If your team is designing an AI audit log retention policy against multiple regulatory floors, take the AI readiness self-assessment at deepinspect.ai/ai-readiness.