Purpose of the Template
You need a clear, documented answer to three questions every auditor will ask: what logs do you keep, why those retention periods, and can you prove you're following it? This retention matrix provides that answer.
ISO/IEC 27001 A.5.31 and A.5.33 require you to protect records according to legal, regulatory, and contractual requirements. ISO/IEC 42001 A.6.2.8 requires event logs at least while your AI system is in use, with defined retention. The EU AI Act sets a minimum of six months for high-risk system logs, longer if other laws require. Your task is to reconcile all these into one schedule that covers organizational events and AI lifecycle events together.
This template does that. It's structured as a retention matrix you can customize to your regulatory obligations, copy into your ISMS documentation, and present to your auditor during Clause 7.5 review.
Prerequisites
Before using this template, you need three inputs:
Your legal and regulatory register. Every law, standard, and contract you're bound to implies retention obligations. You can't set defensible periods without knowing whether GDPR, state breach laws, sector lending rules, or cyber insurance terms apply to you.
Your AI system inventory. If you're operating AI systems, you need to know which ones are high-risk under the EU AI Act (Annex III classification), which ones fall under ISO/IEC 42001 scope, and which ones make consequential decisions about people. Different systems require different evidence.
Your limitation periods. In most US jurisdictions, contract claims survive for six years; employment claims for three to four. Know the longest period someone can sue you for each event category, then add a margin. That's your retention floor.
If you don't have these three, start there. A retention schedule without legal grounding is just a guess, and guesses don't survive audits.
The Retention Matrix Template
Copy the table below into your ISMS documentation. Each row defines an event category, the evidence it produces, and how long you keep it.
EVENT CATEGORY | KEY EVENTS | EVIDENCE TO KEEP | RETENTION PERIOD | MAIN DRIVERS
Corporate Governance | Formation, board approvals, AI policy adoption, risk appetite statements | Signed minutes, resolutions, policy approval records | Permanent (life of entity) | State corporate law; M&A due diligence; ISO/IEC 27001/42001 Cl. 5
Finance and Tax | Transactions, audits, revenue recognition | Ledgers, audit workpapers, approvals | 7 years | IRS; SOX §802 (if public)
Contracts and Customers | Signature, amendments, SLA breaches, termination, data return | Executed contracts, change history, notices, deletion certificates | Contract end + 7 years | Limitation periods; customer audit clauses
People (Joiner, Mover, Leaver) | Hire, [screening](/glossary/screening), role change, privileged role grant, termination | HR records, screening results, acknowledgments, offboarding checklists | Termination + 4-7 years | FLSA; IRS; EEOC; ISO/IEC 27001 A.6.1, A.6.5
Identity and Access | Account creation, privilege elevation, access reviews, removal | IAM audit logs, review sign-offs, break-glass records | 3 years (reviews); 1 year minimum (raw logs) | ISO/IEC 27001 A.5.18, A.8.2, A.8.15; PCI DSS 10.5.1
Security Monitoring | Authentication, admin actions, alerts, data egress | SIEM events, alert triage notes | 12 months hot, archive to 3 years | ISO/IEC 27001 A.8.15-8.17; PCI DSS; cyber insurance
Change and Configuration | Production changes, emergency changes, policy-as-code updates | Tickets, approvals, diffs, rollback records | 3 years | ISO/IEC 27001 A.8.32; ISO 42001 A.6.2.5
Risk and Compliance | Risk assessments, risk acceptances, SoA versions, audit findings, management reviews | Versioned registers, signed acceptances, CAPA records | Superseded + 3 years | ISO/IEC 27001/42001 Cl. 6, 9, 10
Vendors and AI Suppliers | Onboarding, due diligence, reassessment, offboarding | Questionnaires, SOC 2/ISO reports, DPAs, exit evidence | Relationship end + 7 years | ISO/IEC 27001 A.5.19-5.22; ISO 42001 A.10; GDPR Art. 28
Privacy | Consent, DSARs, DPIAs, transfers | Consent records, request logs, DPIA versions | Consent: processing period + limitation; CCPA requests: 24 months | GDPR Arts. 5, 7, 30, 35; CCPA
Incidents and Breaches | Detection, triage, notification, closure | Timeline, forensic evidence, notifications, lessons learned | Closure + 7 years | ISO/IEC 27001 A.5.24-5.28; state breach laws; EU AI Act Art. 73
AI Governance Records | AI inventory entries, impact assessments, technical documentation, conformity | Versioned AIIAs, model cards, declarations | 10 years after placing on market (high-risk); retirement + 3 years otherwise | EU AI Act Art. 18; ISO 42001 A.5.3, A.6.2.7
AI Decisions | Consequential outputs about people: credit, hiring, insurance, access | Decision record: input reference, model version, output, human reviewer, override | At least 6 months; in practice 3-7 years per governing sector rule | EU AI Act Arts. 12, 19, 26(6); sector lending and employment rules
AI Operations | Agent tool calls, permission grants, retrieval, guardrail blocks, drift alerts | Metadata-only event logs; minimize prompt/response content | 6 months to 3 years by risk tier | ISO 42001 A.6.2.6, A.6.2.8
AI Model and Data Provenance | Training data sourcing, evaluation, bias testing, release, retraining, decommissioning | Dataset lineage, eval reports, version registry, retirement record | Life of model + 10 years (high-risk); + 3 years otherwise | ISO 42001 A.6.2.4, A.7.5
Customizing the Matrix
Step 1: Add your sector rules. If you're in financial services, healthcare, or another regulated industry, some rows will lengthen. Broker-dealer firms keep trade records for six years. HIPAA-covered entities keep medical records per state law, often six to ten years after the last service. Lending records follow the loan term plus limitation periods. Insert a note in the "Main Drivers" column and adjust the retention period.
Step 2: Classify your AI systems. Not every AI system owes the same evidence. If you're deploying high-risk systems under the EU AI Act (Annex III: employment, credit, law enforcement, critical infrastructure), the 10-year technical documentation and conformity record period applies. If your systems are lower-risk or internal-only, retirement plus three years is defensible. Update the "AI Governance Records" and "AI Model and Data Provenance" rows accordingly.
Step 3: Tier your AI operations logs. The "AI Operations" row is intentionally vague. You'll want to break it into tiers based on consequence. Decision-making agent actions and guardrail violations deserve longer retention than routine retrieval metadata. Define your tiers, assign retention to each, and document the rationale.
Step 4: Reconcile with your data minimization obligations. GDPR Article 5(1)(e) requires you to keep personal data no longer than necessary. If a retention period in this matrix conflicts with a minimization rule, the shorter period wins unless you have a legal obligation or legitimate interest that overrides it. Document the conflict and your resolution in a footnote.
Step 5: Get legal sign-off. This matrix is a technical starting point, not a legal opinion. Have counsel review the final version, especially the limitation period assumptions and any sector-specific rows you added.
Validation Steps
Once you've customized the matrix, validate it before you commit to it in your ISMS:
Map it to your event catalog. Every key event in your organization should appear in one row of this matrix. If you're logging something that isn't here, either add a row or stop logging it. Logs without a retention rule are a liability.
Audit your current state. Pull a sample of logs from each category and check how long you're actually keeping them. If your SIEM is set to 90 days but this matrix says 12 months, you have a gap. If you're keeping access reviews for seven years but the matrix says three, you're over-retaining.
Test the automation. Your retention schedule is only as good as the systems that enforce it. Configure your log management platform, SIEM, and document repositories to match these periods. Set calendar reminders for manual reviews (board minutes, vendor offboarding evidence) that can't be automated.
Schedule the next review. Retention obligations change when laws change, when you enter new jurisdictions, and when you add new AI systems. Review this matrix annually, or whenever your legal register updates. Treat it as a living document, not a one-time exercise.
If an auditor asks for your retention schedule and you hand them this matrix with your customizations documented, you've answered the question. If they ask whether you're following it and you can show enforcement evidence, you've closed the finding before it opens.
