Retention and control gaps

Logs kept for "an appropriate period" is the phrase the Regulation uses, and it is deliberately not a number. The design question is what an appropriate period means for your system, and what controls make the logs usable rather than merely present.

Set the period deliberately

Retention is set by the risk profile of the system and the questions you need to answer after the fact — not by whatever the platform default happens to be. Write the number down with the reason.

Control gaps block readiness

A duty you cannot evidence is a duty you will fail. The common gaps are not missing logs; they are logs nobody can read, retention nobody set, and review nobody recorded.

What to ask the provider

What the system exposes automatically, confirmed rather than assumed, and what happens to those logs when the model or prompt changes.

How the tool frames it

It lists the events to capture and the retention themes, then names the gaps it finds. It does not manufacture a logging architecture from a job title.

Decision-support drafting only — not legal advice. Confirm the duty set against the current consolidated text of Regulation (EU) 2024/1689.