Applicable Articles (Art. 3(16–17), 16, 18, 20, 49/71, 72, 73, 79) The EU AI Act addresses system end-of-life through several provisions. Article 3(16) defines recall as any measure aiming to achieve the return, taking out of service, or disabling of an AI system already made available to deployers. Article 3(17) defines withdrawal as any measure preventing a system in the supply chain from being made available on the market. These are distinct: withdrawal prevents new deployments; recall retrieves or disables systems already in deployers’ hands. Article 16 requires providers to maintain compliance throughout the system’s time on the market; when compliance can no longer be maintained, Article 20’s corrective actions apply. Article 18 imposes ten-year documentation retention from the date the system was placed on the market, persisting after withdrawal or recall. Articles 49 and 71 require the EU database registration to be updated to reflect the system’s changed status. Article 72’s PMM obligations do not cease at decommissioning; historical monitoring data may be required for post-withdrawal investigations. Article 73 requires serious incident reporting even for incidents discovered after withdrawal. Article 79 empowers market surveillance authorities to order withdrawal or recall, with a 15 working-day backstop. Every system will eventually reach end-of-life. The AISDP must document the end-of-life process, planned during the design phase and refined as the system matures. Key outputs

• Eight regulatory provisions mapped to end-of-life obligations
• Distinction between recall and withdrawal understood
• Ten-year retention persisting after decommission
• Post-withdrawal incident reporting obligation

ISO Standards (42001 A.6.2.6, 23894 Annex C) ISO/IEC 42001 Annex A Control A.6.2.6 requires that the AI management system address decommissioning as a defined lifecycle stage. The organisation must define and document processes for safely phasing out the AI system while addressing residual impacts. ISO/IEC 23894 Annex C reinforces this by mapping risk management activities to every lifecycle stage, including retirement, requiring assessment and treatment of risks arising from withdrawal from service. These standards ensure that decommissioning is treated as a planned lifecycle event, not an ad hoc response. A system decommissioned without a structured process risks leaving orphaned data, unnotified deployers, active credentials with no owner, and regulatory obligations that no one tracks. The AISDP’s end-of-life documentation satisfies both the EU AI Act’s Article 18 retention requirements and the ISO standards’ lifecycle management requirements simultaneously. Key outputs

• ISO 42001 A.6.2.6 decommissioning as defined lifecycle stage
• ISO 23894 Annex C retirement-stage risk management
• Structured process preventing orphaned data and obligations
• Module 12 AISDP documentation