Guides & Educational Resources
Records worth keeping before anyone asks
5 min read · Updated 2026-11-08
Write it down in the week you decide
Six months later, nobody remembers why a tool was allowed or who was supposed to review its output. A short note at the time is enough: the decision, the date, the person, and the limit you set. Store it where the tool record lives, not in a private inbox.
You are not building an archive for its own sake. You are leaving a trail a colleague can follow if you are away, and a trail you can show if a customer, an auditor, or a regulator asks what you did. Whether anyone has the right to ask depends on your sector and your countries. The note is still useful inside the organization either way.
The small set that covers most questions
Keep the inventory, the one-page record for each approved tool, the vendor answers you relied on, the rule staff are asked to follow, and the notes from incidents and the change you made afterward. That set answers "what do you use," "who is responsible," and "what happened last time."
Keep personal data out of these notes unless you need it. An incident note can describe the kind of mistake without pasting the original customer text.
Throw away the performance
A folder of every prompt anyone ever typed is not a governance record. It is a new store of sensitive text. Decide a retention period for prompts and outputs, matching the vendor settings you chose, and stick to it. Keep the decisions longer than you keep the raw chats.
This is general education, not legal advice. Some industries have fixed retention duties. Those duties, where they exist, override a general habit described here.
This article is general education, not legal advice. ComplianceEU Alliance is an independent private initiative, not a regulator or certification body.