Log retention policy for deployed high-risk AI systems

Deployers of high-risk AI systems should define and document a policy for the retention periods for logs automatically generated by its high-risk AI systems. The retention period must be appropriate for the system's intended purpose and last for a minimum of six months, unless other applicable laws require a different period. This policy ensures that logs are available for auditing and incident investigation as required.

The policy should define and document a process for managing the retention of logs from these systems to ensure logs are technically stored according to the defined retention policy, for at least six months or as required by other regulations. The process should cover how logs are collected, stored securely, and disposed of after the retention period.