PubLedge

Beginning January 1, 2027, a deployer of covered automated decision-making technology must retain its compliance documentation for at least three years. The retention floor is what makes the notice, explanation, and review duties auditable by the Attorney General after the fact.

What Counts

• Retaining the consumer notices, explanations, and human-review records generated under the Act
• A retention period of three years or longer measured from the record's creation
• Records held in a form that can be produced on request

What Does Not Count

• Purging compliance records on a shorter operational retention schedule
• Retaining only aggregate statistics rather than the underlying compliance records
• Relying on a vendor's retention without an enforceable route to the records

Implementing Legal Instruments