EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Article 18

Documentation keeping

Artificial Intelligence Act · UE 2024/1689

Documentation keeping

1.   The provider shall, for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the national competent authorities:

(a)

the technical documentation referred to in Article 11;

(b)

the documentation concerning the quality management system referred to in Article 17;

(c)

the documentation concerning the changes approved by notified bodies, where applicable;

(d)

the decisions and other documents issued by the notified bodies, where applicable;

(e)

the EU declaration of conformity referred to in Article 47.

2.   Each Member State shall determine conditions under which the documentation referred to in paragraph 1 remains at the disposal of the national competent authorities for the period indicated in that paragraph for the cases when a provider or its authorised representative established on its territory goes bankrupt or ceases its activity prior to the end of that period.

3.   Providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the technical documentation as part of the documentation kept under the relevant Union financial services law.

Luxembourg specificity
règlement (UE) 2024/1689 et future loi luxembourgeoise de mise en oeuvre du AI Act (désignation de l'autorité de surveillance du marché en cours)

In Luxembourg, the AI market surveillance authority foreseen by the Regulation has not yet been formally designated; the CNPD remains competent for the personal data dimension of AI systems, and the CSSF remains the prudential regulator for the financial institutions covered by paragraph 3. Paragraph 2 expressly defers to national law to set retention conditions in case of bankruptcy or cessation of activity: until the Luxembourg implementing law settles this point, a contractual documentary escrow clause is the only enforceable guarantee.

Luxgap practice: set up an eIDAS escrow deposit of your Article 18 dossier now and, for CSSF entities, map the AI technical documentation onto your existing prudential obligations to avoid any contradictory double archive.