10-Year Document Retention The ten-year documentation retention obligation runs from the date the system was placed on the market, not from the date of decommission. The post-decommission obligations register calculates the expiry date. The archived AISDP, evidence pack, conformity assessment records, Declaration of Conformity, PMM reports, and serious incident records must all remain retrievable for the full period. The AI Governance Lead assigns a named owner for the post-decommission archive, ensuring that organisational changes (mergers, restructuring, personnel turnover) do not leave the archive orphaned. Annual verification checks confirm that the archive remains accessible and that the storage service has not expired or been inadvertently deleted. Key outputs
- Ten-year retention from date placed on market
- Expiry date calculated in post-decommission obligations register
- Named archive owner assigned
- Annual accessibility verification
GDPR Data Subject Rights Data subjects retain their GDPR rights even after the system is decommissioned. A data subject who submits an access request under Article 15 must receive a response, even if the system no longer exists. The organisation maintains the capability to respond to such requests for as long as it retains personal data related to the system. The DPO Liaison defines the post-decommission process for handling data subject requests and communicates it to the relevant team. Where personal data has been deleted, the response confirms deletion. Where aggregated or anonymised data remains, the response explains that individual-level data is no longer held. Where personal data is retained under the ten-year archival obligation (inference logs within the 90-day retention window at decommission time), the response provides the data and explains the retention justification. Key outputs
- Data subject rights persist after decommission
- Post-decommission request handling process defined by DPO Liaison
- Response capability maintained for duration of personal data retention
- Module 4 AISDP documentation
Post-Withdrawal Incident Reporting (Art. 73) If serious incidents come to light after withdrawal (affected persons report harm that occurred while the system was in service), the provider must still report them under Article 73. The Article 73 reporting obligation is not limited to incidents discovered during the system’s operational period; it applies whenever the provider becomes aware of a serious incident, regardless of the system’s current status. The post-decommission obligations register notes this continuing obligation. The AI Governance Lead ensures that a named person remains responsible for receiving and triaging post-withdrawal incident reports. The incident triage process and reporting execution process remain available, drawing on the archived evidence pack for investigation. Key outputs
- Article 73 reporting obligation persists after withdrawal
- Named person responsible for post-withdrawal incident triage
- Triage and reporting processes remain available
- Archived evidence pack supports investigation
Historical PMM Data Analysis The provider may be required to analyse historical monitoring data in response to post-withdrawal investigations, complaints, or competent authority requests. The archived PMM data (aggregated metrics, PMM reports, alert logs) must be retrievable and analysable for the retention period. Historical analysis may reveal patterns that were not detected during the system’s operational period: slow fairness drift that only becomes apparent over a longer time horizon, or downstream decision impacts that emerge years after the system was decommissioned. The post-decommission monitoring plan defines the scope and duration of proactive historical analysis; reactive analysis in response to external requests may be required at any point during the retention period. Key outputs
- Archived PMM data retrievable and analysable
- Proactive historical analysis per post-decommission plan
- Reactive analysis capability for external requests
- Module 12 AISDP evidence