Data & Information ยท DAT-06
Records management for AI
Retention and records rules cover what AI systems take in and produce, including prompts, outputs and the decisions they supported, and are applied in practice.
Why it matters
AI creates new kinds of information that may need to be kept as evidence of a decision, disclosed on request, or deleted on time. If records rules do not cover them, the organisation can neither explain past decisions nor show it is not keeping data longer than it should.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No one has considered whether AI inputs and outputs are records; retention depends on product defaults. |
| 2 Developing | Some rules exist for some AI systems, but prompts, outputs and AI-supported decisions are not consistently covered. |
| 3 Defined | Records and retention rules cover AI inputs, prompts, outputs, supported decisions and system logs, and are applied to every use of AI. |
| 4 Managed | Application of the rules is checked, including retention settings in bought tools, and failures such as unretrievable records or late deletion are caught and fixed. |
| 5 Optimising | Records handling for AI is largely automated, and the rules are refined from requests for information, audits and changes in how AI is used. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- DAT-06.1 Records and retention rules state how AI inputs, prompts, outputs and supported decisions are classified, kept, made retrievable and deleted.
- DAT-06.2 The rules cover system logs and keep them for at least as long as the law requires.
- DAT-06.3 The rules are applied to every use of AI.
Assessment questions
- Are prompts and outputs from your AI tools treated as records, and under which rules?
- If asked to show how an AI-supported decision was reached a year ago, what could you retrieve?
- Who checks that retention settings in bought AI tools match your rules?
- Retention schedule or records policy entries covering AI inputs, outputs and decisions
- Configuration records showing retention settings in AI tools
- Results of a retrieval or deletion check
- Retention settings for AI system logs
How to reach Level 3
- Extend the records and retention schedule to cover AI inputs, prompts, outputs and the decisions they supported.
- Set for each how it is classified, how long it is kept, how it can be retrieved and how it is deleted.
- Include system logs, kept at least as long as the law requires (see RSK-04 for the obligations).
- Apply the rules to every use of AI and check that retrieval works in practice.
Common pitfalls
- Keeping AI outputs but not the prompts or inputs that produced them, so decisions cannot be reconstructed.
- Leaving supplier-held logs outside the rules.
Starter artefacts
- AI records and retention schedule
- Retrieval test record
Cross-references
| AI Cyber Security Code of Practice | 2.3 partial; 12.1 partial; 13.2 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Development data specification partial; Tier 2 Operational data specification direct |
| EU AI Act | Art 26(6) direct; Art 86 partial; Art 17 partial |
| ISO/IEC 42001 | 7.5 partial; A.5.3 partial; A.6.2.8 partial |
| JSP 936 Part 1 | para 162 partial; para 190 partial |
| MITRE AI Maturity Model | P1.2 direct |
| NIST AI RMF 1.0 | GOVERN 1.7 partial |
| UK Data and AI Ethics Framework | Privacy 7 partial; Privacy 11 direct; SAT 4.2 direct; SAT 4.8 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.