Post-Decommission Monitoring Schedule The post-decommission monitoring schedule documents the continuing obligations after shutdown: the ten-year archive verification schedule (annual accessibility checks), the downstream decision monitoring cadence and duration, the post-withdrawal incident reporting responsibility and named person, the GDPR data subject rights process, and the historical PMM data analysis capability. The schedule assigns a named owner for each obligation and specifies the expiry date (calculated from the date the system was placed on the market plus ten years). The AI Governance Lead reviews the schedule annually to confirm obligations are being met and to close obligations whose expiry date has passed. Key outputs

• Five continuing obligations documented with named owners
• Annual review by AI Governance Lead
• Expiry dates calculated per Article 18
• Module 12 AISDP evidence