EU AI Act Article 18: Keeping Documentation for 10 Years

You drew up a flawless Annex IV technical file in 2026, shipped the system, and three years later the compliance lead has left, the file is on a decommissioned laptop, and the Finnish market surveillance authority has just asked to see it. That is the scenario Article 18 of Regulation (EU) 2024/1689 is built to prevent. It places a distinct, ongoing duty on the provider of a high-risk AI system: keep the specified documentation at the disposal of national competent authorities for 10 years after the system is placed on the market or put into service.

This is the keeping obligation — separate from drawing up the technical file (Article 11) and establishing the quality management system (Article 17). This guide covers what Article 18 requires, the five-item disposal package, when the clock starts and why it does not stop, and how the duty differs from the Article 12/19/26 log-retention regime.

---

What Article 18 Requires: The Documentation-Keeping Duty

Article 18(1) is about custody and availability over time, not initial creation. Article 11 makes you draw up the Annex IV technical documentation; Article 17 makes you establish and maintain the QMS; Article 18 makes you keep a defined set of documents available to authorities for a decade. The three are sequential, not interchangeable.

"At the disposal of" national competent authorities means available on request — not proactively filed. Authorities can demand the package at any point in the 10-year window, which ties to the access and inspection powers around Article 21 and the market-surveillance regime of Article 74. You must be able to produce it, complete and current, on demand.

Article 18 is the long-tail evidence obligation that makes the entire high-risk file enforceable years after launch — a perfect file that no longer exists when an authority asks is a breach. Non-compliance sits in the €15 million or 3% of total worldwide annual turnover tier, whichever is higher, under Article 99(4); Article 99(6) caps companies and start-ups at the lower of the fixed sum or the percentage.

---

What Must Be Kept: The Five-Item Disposal Package

Article 18(1) enumerates exactly what must be kept available — broader than the technical file alone, and the point where the obligation diverges most clearly from Article 11.

• (a) The Annex IV technical documentation drawn up under Article 11.
• (b) The documentation concerning the quality management system under Article 17.
• (c) Where applicable, the documentation on the changes approved by notified bodies.
• (d) Where applicable, the decisions and other documents issued by notified bodies — for example conformity certificates and assessment reports.
• (e) The EU declaration of conformity drawn up under Article 47, the contents of which are specified in Annex V.

Items (c) and (d) depend on a notified body having been involved — typically under the Annex VII third-party route. Most stand-alone Annex III providers self-assess under Annex VI, so for them only (a), (b) and (e) exist. One boundary to note: continuously-learning systems and substantial modifications mean the kept file must reflect the system as it actually evolved, not a frozen 2026 snapshot.

---

The 10-Year Clock: When It Starts and Why It Does Not Stop

The clock runs for 10 years from the date the high-risk system is placed on the market or put into service — whichever applies — not from the date any document was created. Drawing up the technical file early does not start the clock early; placement does.

There is one carve-out. For a high-risk AI system that is a safety component of a product covered by the Annex I sectoral legislation, the retention period follows the relevant product law rather than the flat 10-year rule, so check the sectoral act first.

The duty also survives decommissioning. Withdrawing the system from service or sunsetting the commercial line does not end the 10-year obligation — retention outlasts the product's commercial life. Practically, that means version-controlled, access-controlled storage and a written retention policy that outlives staff turnover and reorganisation.

Note on the deadline. The statute originally set the deadline for stand-alone high-risk Annex III obligations at 2 August 2026. The Digital Omnibus — adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026 — defers stand-alone high-risk to 2 December 2027, pending Official Journal publication as a formality. Plan against 2 December 2027. Either way, Article 18's clock attaches to each system's own market-placement date.

---

Insolvency, Cessation, and Transfer to the Authorised Representative

The 10-year keeping duty does not evaporate if the provider ceases trading, is acquired, or becomes insolvent. It attaches to whoever holds the provider role for that system — the duty follows the role, not the original legal entity.

Where the provider is established outside the Union, Article 22 requires an authorised representative established in the EU. Article 18(3) provides that the authorised representative keeps the documentation at the disposal of authorities where the obligation cannot be enforced against the non-EU provider directly. In practice the non-EU provider still assembles the file, but the EU-based representative is the point from which authorities can demand it.

Role transfer is the other live route. Under Article 25, a distributor, importer, deployer or other third party that puts its name or trademark on the system, makes a substantial modification, or changes the intended purpose to a high-risk one becomes the provider — and inherits the Article 18 keeping duty. Documentation custody should therefore be assigned explicitly in the QMS accountability framework and in any M&A or wind-down planning, so the file does not become orphaned.

---

Article 18 vs Article 12/19/26 Logs: Two Different Retention Regimes

A common confusion: Article 18 documentation retention is not the same obligation as automatically-generated log retention. They have different subject matter and different periods, and a provider can satisfy one while breaching the other.

• Article 18 governs the static documentation package — technical file, QMS records, notified-body decisions, EU declaration — kept for 10 years.
• Article 12 requires the system to be technically capable of automatically recording events (logs) over its lifetime — the design requirement underpinning the logging regime.
• Article 19 requires the provider to retain the logs under its control for a period appropriate to the intended purpose, tied to post-market monitoring under Article 72.
• Article 26 requires deployers to retain the logs they control for at least six months, unless other Union or national law provides otherwise.

So "retention" splits into two tracks: static compliance documentation (Article 18, 10 years) versus operational event logs (Articles 19 and 26). A provider that keeps perfect logs but lets the technical file or declaration lapse is non-compliant with Article 18 — and the reverse holds too.

Worked example: NordCredit Oy

NordCredit is a 60-person Helsinki provider of a consumer creditworthiness-scoring model — high-risk under Annex III point 5(b). It self-assesses under Annex VI. It must keep its Annex IV file (item a), its Article 17 QMS documentation (item b) and its Article 47 declaration (item e) at the disposal of the Finnish market surveillance authority until 10 years after placement; because no notified body was involved, items (c) and (d) do not apply. Separately, it retains operational inference logs under Article 19 linked to its post-market monitoring.

When NordCredit is acquired in year 4 and the buyer puts its own trademark on the system, the acquirer becomes the provider under Article 25 and inherits the remaining six-plus years of the Article 18 duty. Because NordCredit wrote documentation custody into its QMS accountability matrix, the handover is clean.

---

How Confir helps

Keeping a five-item disposal package available, current and exportable for a decade — across staff changes, reorganisations and acquisitions — is exactly the kind of long-tail obligation that quietly decays. Confir holds the conformity package as structured, version-controlled records: the Annex IV technical file, the Article 17 QMS documentation and the Article 47 declaration sit in one audit-log system with defined custody, version history and export for an authority request. The engine is deterministic and rule-based — no model inference, no hallucination.

---

Frequently asked questions

How long must documentation be kept under Article 18?

Ten years. Article 18(1) requires the provider of a high-risk AI system to keep the specified documentation at the disposal of national competent authorities for 10 years after the system is placed on the market or put into service. The clock runs from market placement or entry into service, not from when the documents were created, and it does not stop when the system is decommissioned. For high-risk AI embedded in an Annex I regulated product, the retention period follows the applicable sectoral product legislation instead of the flat 10-year rule.

What documents does Article 18 require a provider to keep?

Five items, set out in Article 18(1): (a) the Annex IV technical documentation drawn up under Article 11; (b) the documentation on the quality management system under Article 17; (c) where applicable, documentation on changes approved by notified bodies; (d) where applicable, decisions and other documents issued by notified bodies; and (e) the EU declaration of conformity under Article 47. Items (c) and (d) apply only where a notified body was involved — typically under the Annex VII conformity route. The first two and the declaration apply to every high-risk provider.

Is Article 18 the same as the log-retention rules?

No. Article 18 governs static compliance documentation — the technical file, QMS records, notified-body decisions and the EU declaration — kept for 10 years. Logs are a different regime: Article 12 requires systems to be capable of automatic event logging; Article 19 requires the provider to retain the logs under its control, tied to post-market monitoring under Article 72; and Article 26 requires deployers to keep logs they control for at least six months. A provider can satisfy one regime and breach the other, so both must be managed separately.

What happens to the duty if the provider goes insolvent or is acquired?

The 10-year keeping duty does not disappear. It attaches to whoever holds the provider role for that system. If another company takes the system over and puts its own name on it, makes a substantial modification, or changes the intended purpose, Article 25 makes that company the provider and it inherits the remaining Article 18 obligation. Because the file can outlast the original company, documentation custody should be assigned explicitly — in the Article 17 accountability framework and in any acquisition or wind-down planning — so the package is not orphaned.

Who keeps the documentation if the provider is outside the EU?

The authorised representative. Article 22 requires a provider established outside the Union to appoint an authorised representative established in the EU before placing a high-risk system on the market. Article 18(3) provides that this authorised representative keeps the documentation at the disposal of national competent authorities. In practice the non-EU provider still assembles and maintains the file, but the EU-based representative is the point of availability authorities can demand it from, and the mandate should make custody and access explicit.

What is the difference between Article 11 and Article 18?

Article 11 is the duty to draw up the Annex IV technical documentation before the system is placed on the market — the creation obligation. Article 18 is the duty to keep that documentation, plus the QMS records, any notified-body decisions and the EU declaration of conformity, available to authorities for 10 years afterwards — the retention and availability obligation. One produces the file; the other governs how long it must survive and stay accessible. Both fall on the provider, and a complete-but-discarded file fails Article 18.

What is the penalty for breaching Article 18?

Failure to keep the required documentation available is non-compliance with a provider obligation and falls in the tier under Article 99(4): administrative fines up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For companies and start-ups, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. Beyond fines, an inability to produce the file on request can trigger market-surveillance action under Article 74 and undermine the system's continued lawful availability.

---

Related guides

• drawing up the Annex IV technical documentation
• the quality management system documentation
• the EU declaration of conformity
• automatic logging and the separate log-retention regime
• managing AI compliance documentation