Records management · Retention

Model decision record retention

Retention policies usually specify how long to keep records. The harder question is what state those records need to be in when someone finally reads them.

Different regimes set different clocks. EU AI Act Article 18 requires technical documentation to be kept for ten years after a high-risk system is placed on the market. Financial recordkeeping obligations commonly run five to seven years. Litigation holds extend whatever the baseline is.

What the clocks share is a gap between when a record is made and when it is finally read. Over that gap, the environment changes in ways that quietly damage the record's usefulness.

Four things that decay

System context. The model that made the decision has been retrained several times. The feature pipeline was rewritten. Reconstructing the original behaviour is no longer possible.
Storage custody. The database migrated, the vendor changed, the export format shifted. Chain of custody becomes a narrative rather than a fact.
Institutional memory. The people who could attest to how the system worked have left.
Cryptographic assumptions. Signatures made with today's algorithms are protecting records that will be challenged under tomorrow's capabilities.

What a durable record contains

A record designed to be read years later should stand alone. That means capturing, at decision time: the system identity and version, the decision and its inputs or commitments to them, the oversight status, and a signature and timestamp that a third party can check without the institution's help.

The test is simple. Hand the record to someone who does not trust you and has no access to your systems. Can they confirm it is what it says it is?

Check it yourself

Every Rubric attestation resolves publicly, with no account and no API key, and every anchor resolves to a public ledger message you can read without our cooperation.

HCS topic 0.0.10416909 · ML-DSA-65 signatures

Verify an attestation · Read the ledger ↗

Cryptographic durability

For a ten-year horizon, algorithm choice is a retention decision rather than a security preference. Rubric signs with ML-DSA-65, a NIST-standardized post-quantum signature algorithm, so the record's integrity guarantee is not scheduled to expire partway through its retention period.

Volume discipline

Retention cost scales with what you keep. Attestation lets an institution separate the two questions: keep operational logs under ordinary retention policy, and attest the narrow set of records whose authenticity may actually be contested.

See a live attestation Talk to us