How long do you have to keep AI agent logs? A retention reference

How long must you keep the record of what a system did?

If an automated system, an AI agent included, takes actions that affect people, money, or regulated data, you are usually required to keep a record of what it did, and to keep it for a defined period. The period is not one number. Depending on the regime it ranges from six months to ten years, and some records come with criminal penalties for altering them.

This is a practical reference, with sources. It is general guidance, not legal advice, and the exact obligation varies by jurisdiction, sector, and the specific system. Confirm your own requirements with counsel. What follows is the shape of the landscape and, at the end, the part most teams miss: keeping the record is only half the job.

The periods, and what triggers them

EU AI Act. For high-risk AI systems, Article 19 requires providers to retain the logs the system automatically generates for at least six months, unless other Union or national law says otherwise, and Article 26 places the same duty on deployers for the logs under their control. Separately, Article 18 requires the technical documentation and conformity records to be kept available to authorities for ten years after the system is placed on the market. So the same system can carry both a six-month log duty and a ten-year documentation duty.

PCI DSS. Requirement 10.5.1 of version 4.0 says audit log history must be retained for at least twelve months, with at least the most recent three months immediately available for analysis. The standard describes the outcome, not a specific product, so a tiered store (hot for three months, archived for the rest) is a normal way to meet it.

SOC 2. There is no statutory retention number. A Type II examination covers a period, commonly six to twelve months, and the evidence has to cover that whole period, so in practice you retain at least the audit period and usually longer because the next audit builds on the last. Your auditor's expectations, under AICPA attestation standards, set the real bar.

HIPAA. The Security Rule, at 45 CFR 164.316(b)(2)(i), requires the mandated documentation to be kept for six years from the date it was created or last in effect, whichever is later. Retire a policy and you still keep the old version for six years from its retirement.

SOX. Section 802, codified at 18 U.S.C. 1520, requires auditors to retain audit and review workpapers for seven years after the end of the fiscal period in which the audit concluded.

MiFID II. Article 16 requires firms to keep records of their services and activities for five years, and a competent authority can require them to be kept for up to seven.

Keeping it is only half the job

Every rule above assumes the record you keep is the record of what actually happened, and that it has not quietly changed in the meantime. That assumption is doing a lot of work. A log file or a database row can be edited, back-dated, or restored from a different version, and most retention stores cannot prove, years later, that they were not.

The law is blunt about this. The same Sarbanes-Oxley provision that sets the seven-year period also makes it a federal crime, under 18 U.S.C. 1519, to knowingly alter, destroy, or falsify a record to obstruct an investigation, punishable by fines or up to twenty years. Retention is not just about storage duration. It is about being able to show, at the end of the window, that the record is intact.

That is the hard part for automated systems. An AI agent can act thousands of times a day across tools and services whose logs were never designed to be read together, let alone proven unaltered six years on.

How Quox helps

Quox records every agent action as a structured, witnessed event and seals it into an append-only, hash-chained ledger, with a content-free receipt chain that can be verified independently and offline. The point, for retention specifically, is integrity over time: whatever window you have to keep a record for, you can also prove at the end of it that the record was not altered, by recomputing the chain and checking the signatures on a machine that never talked to Quox.

The record is also portable. Evidence is exported as a bundle you can store wherever your retention policy requires, hot for the first few months and archived after, on-premises if that is the rule, without losing the ability to verify it. That maps cleanly onto the tiered duties above (for example PCI DSS's three-months-available-then-archived shape) and onto the long ones (a bundle that still verifies years later).

To be precise about what this is and is not: Quox is not a storage service and does not promise to hold your logs for ten years. How long you retain, and where, is your operational and legal decision. What Quox provides is the record that stays tamper-evident and independently verifiable for the whole period, so that when a regulator or an auditor asks, you answer with proof rather than assurance. The compliance surfaces that build on these records are on the compliance suite; the European framing is on the EU AI Act page; and how the trail is sealed and checked is covered in cryptographic audit trails for AI agents.

Sources

General guidance only, not legal advice; periods vary by jurisdiction and sector, and the regimes are updated over time. Verify your own obligations.

• EU AI Act, Articles 18, 19 and 26 (Regulation (EU) 2024/1689).
• PCI DSS v4.0, Requirement 10.5.1, PCI Security Standards Council.
• SOC 2: AICPA attestation standards (SSAE 18 / AT-C); the retention bar is the audit period and the auditor's requirements, not a statute.
• HIPAA Security Rule, 45 CFR 164.316(b)(2)(i).
• Sarbanes-Oxley Act, Section 802, 18 U.S.C. 1520 and 18 U.S.C. 1519.
• MiFID II, Article 16 (Directive 2014/65/EU); ESMA guidance on record-keeping.