← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act Article 18: keeping documentation for ten years

Article 18 requires the provider of a high-risk AI system to keep certain documents at the disposal of national authorities for ten years after the system is placed on the market or put into service: the technical documentation, the quality management system documentation, and other listed records.

Ten years is longer than your stack

Models are deprecated, libraries are yanked and vendors disappear. A record that only verifies with your original infrastructure may be unverifiable in year eight.

Design for verification later

Prefer self-describing files: an append-only ledger whose hash chain and signatures can be checked with a public key and a small, open algorithm. Keep the public keys and the protocol description with the archive.

Gaps to state honestly

Article 18 is about documentation, and Article 19 covers automatically generated logs separately. See our guide on provider log retention for that distinction.

How Vetro helps

Vetro writes every model call, tool call and policy decision to a hash-chained, ed25519-signed ledger that anyone can verify with the public key. Vetro Attest verifies a ledger or OTLP GenAI trace for free and, for 29 USD, issues a counter-signed report mapping the evidence to the EU AI Act, including an explicit list of what the log cannot show. This is technical evidence, not legal advice.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.