Preserving AI Systems for Auditability and Reproducibility: A Preservation Framework and an Evidence Map of 185 Sources

1. Introduction

A public agency uses an AI system to rank benefit applications. Five years later an applicant appeals, and the agency must show what the system did with that application. The decision record is in the records system. The model was a hosted service that has since been retired. The prompt template has changed four times. The logs were kept for the minimum period. Can the agency still explain the decision? The honest answer is that nobody has written down, in one place, what it should have kept.

The problem is not a lack of rules. It is that the rules sit in four places that do not read one another. Archives issue guidance on AI records. Regulators impose documentation and logging duties. Standards bodies define fields for model cards, bills of materials and traces. Researchers propose provenance schemes and replay methods. Each covers part of the system, and their timelines differ. The EU Artificial Intelligence Act shows how. For high-risk systems, which it covers from 2 December 2027 (Annex III systems) or 2 August 2028 (Annex I systems) [EU 2024, Art. 113(c)], it asks the provider to keep the technical documentation for “a period ending 10 years after the high-risk AI system has been placed on the market or put into service” (Art. 18(1)), and asks providers and deployers to keep the logs under their control for “at least six months”, unless other Union or national law, in particular data-protection law, provides otherwise (Arts. 19(1), 26(6)). These duties fall on different parties and different records. Whoever must later explain a particular decision, often the deployer, cannot count on either clock: the documentation describes the system, not the case, and the logs that describe the case may be gone. Hosted models do not last the decade either: in a sample of biomedical publications, 42% of paper-model mentions involved a model retired or due to retire within two years, with a median of 538 days from publication to retirement [Wolfrath et al. 2026].

This paper asks what must be preserved of an AI system so that it stays interpretable, auditable and, where possible, re-runnable later, according to archival guidance, regulation, standards and research, and answers with an evidence map. Every requirement found is coded by the system component it concerns (from model weights to generated decisions) and by the preservation capability it supports (from keeping the bits to keeping the decision context). The map, named the AI System Preservation Matrix (Section 3.4), shows which cells the sources fill, which only research fills, and for which no qualifying source was found.

This paper does five things. It applies a reproducible scoping protocol to four source families, with a blind second pass and released decisions. It publishes the 1,519-statement evidence table and a gap matrix that readers can rebuild from the released data. It uses that map to propose a three-tier preservation framework, a minimum evidence checklist and a machine-readable profile. It turns the findings into nine recommendations, each tied to a cell or count and its cost drivers. Finally, a worked example shows the evidence needed to explain one AI-assisted decision and which fields existing standards already provide.

Section 2 places the review against the work it builds on. Section 3 gives the method, Section 4 the results, Section 5 answers four analysis questions and draws implications for eight research communities, Section 6 gives the preservation framework, the recommendations and their feasibility, and Section 7 what remains to be tested. Limitations, the conclusion and the worked example (Appendix A) follow.

2. Related Work

Earlier research has examined what should be kept of an AI system, but usually from one perspective at a time. Four groups of work cover different parts of the problem.

Records and archives. The InterPARES Trust AI study “Preserving AI Techniques as Paradata” asked directly how much of an AI system should be preserved when AI supports archival or recordkeeping work, and answered with paradata: information about the procedures and tools used to create and process records and the people who carried them out [InterPARES Trust AI 2026]. Its published synthesis identifies the documentation and paradata needed across data preparation, model development, deployment, monitoring and retirement, from a survey, literature reviews, a regulatory review and four use cases [Franks 2026]. Earlier work in the same program read AI laws and frameworks in five jurisdictions for records duties [Cameron et al. 2025], framed paradata for AI processual documentation [Cameron et al. 2023] and proposed paradata for real-time AI agents [Cameron and Hamidzadeh 2024]. This review takes that work as its starting point and extends it in three ways: by adding regulation, standards and the computing literature as source families beside archival guidance; by stating each requirement against a fixed grid of components and preservation capabilities; and by a search protocol with a blind second pass whose decisions are released as data.

AI documentation. Model cards, datasheets and data cards define what to record about models and data [Mitchell et al. 2019; Gebru et al. 2021; Pushkarna et al. 2022]. A review of 36 documentation approaches against European regulatory objectives named the need “to widen the focus from algorithms and data to AI systems as a whole” [Micheli et al. 2023]. Measurements of what public repositories document now run to tens of thousands of model cards [Liang et al. 2024] and bills of materials [Erfan et al. 2026], and a curatability study of open language-model artifacts derives a minimal record for digital libraries [Lu et al. 2026]. These works ask what is described. They do not ask what must survive for a later audit or re-run.

Running agents. Five 2026 reviews cover how agents externalize capability into memory, skills and protocols, how agent memory is designed and governed, how executions are traced, and what persistent state an always-on agent accumulates [Zhou et al. 2026; Du 2026; Lam et al. 2026; Wang et al. 2026; Ding et al. 2026], and a benchmark measures how deployed agents degrade over time [Zhu et al. 2026]. All of them study the agent while it runs; none treats a retired agent as an object to be preserved.

Reproducibility over time. Hosted models change behavior between versions [Chen et al. 2023], and settings meant to be deterministic do not give repeatable outputs [Atil et al. 2024]. Models retire on the provider’s schedule [Wolfrath et al. 2026], and when they do, an estimated 82% of open-source applications migrate only after the shutdown date [Kim 2026].

The missing piece is a source-traceable map that puts all four families against the same components and preservation capabilities. That map must also show where the review found no qualifying requirement.

The closest predecessor is the InterPARES Trust AI report on paradata. It asks what contextual evidence of AI use should survive. This review asks how four families of sources address those needs across 28 component and capability combinations, where nothing qualifying was found, and it releases the data to reproduce the map. Table 1 compares this review with its closest predecessors.

3. Method

The review followed a protocol fixed and timestamped before any source was screened or coded; two dated amendments are reported below. Reporting follows PRISMA-ScR [Tricco et al. 2018]. All searches ran on 2026-10-06.

3.1. Source Families

Each source was assigned to exactly one family, based on its issuer.

Guidance (G): material issued by an archive, library, records authority or professional preservation body.

Regulation (R): a binding instrument, or official framework or regulator guidance from a government body, that sets documentation, logging, record-keeping or retention duties for AI.

Standards (S): a specification, schema, profile or documentation framework published for others to adopt.

Research (P): a peer-reviewed paper, a preprint on a moderated server, or a research-project report.

Guidance, regulation and standards are called the normative sources below: documents that set or recommend requirements. A requirement in such a document is not evidence that organizations implement it.

3.2. Searches

Guidance. Bodies fixed in advance: the national archives or records authorities of the United States, the United Kingdom, Canada, Australia, New Zealand and Ireland; the Library of Congress; the Digital Preservation Coalition; the National Digital Stewardship Alliance; the Open Preservation Foundation; the International Council on Archives; and the New Zealand Government’s records guidance for AI. For each, the guidance index was read and one site-restricted web search run. Regulation. Jurisdictions fixed in advance: the European Union, the Council of Europe, the United States (federal), Canada (federal), the United Kingdom, Australia (Commonwealth), New Zealand and Singapore; the AI instruments in force or published by the search date were found from the issuers’ sites and one web search per jurisdiction. Standards. A list fixed in advance (preservation, packaging, provenance, bill-of-materials, documentation-card, telemetry, content-provenance and model-format specifications) plus one web search. Paywalled standards (for example ISO/IEC 42001) were recorded and excluded as not publicly readable. Every guidance, regulation and standards document was read in full from the document itself; pages that block automated clients were read in a browser.

Research. Eight OpenAlex title-and-abstract queries, publication dates 2016-01-01 to 2026-10-06, the first 60 records of each by relevance; the same eight concepts on the arXiv API, the first 30 of each; one level of backward citation chasing from the three closest works [Franks 2026; Cameron et al. 2025; Micheli et al. 2023]; and the items known from the novelty search. The query strings are in the released query logs. This gave 721 unique candidates.

3.3. Eligibility

A source was included when it met four conditions: its subject was an AI system or one of its components or uses, rather than AI used as a tool on other material; it stated, proposed, required or tested what must be created, kept, documented, logged, packaged or described; the purpose was later interpretation, audit, accountability, evidence, reproduction or re-use; and it was publicly readable in English and dated on or before 2026-10-06.

Exclusions were applied in this order: AI applied to archives or records (the reverse direction); privacy or security techniques with no keeping requirement; methods or applications whose logs are incidental; opinion or news without a requirement; not publicly readable; duplicate. Amendment A1, made before screening, counts “unclear” as include at the title-and-abstract stage and moves the decision to full text. Amendment A2, made after title-and-abstract screening and therefore a deviation, excludes self-deposits on general repositories without moderation (31 records), so that every research source passed an editorial or moderation step. The same amendment records as duplicates five research records that are the same document as a guidance, regulation or standards candidate (the model card, datasheet and data card papers and the two NIST AI risk management documents); each is counted once, in its own family.

3.4. Screening, Extraction and Coding

Screening and coding were each done in two independent passes working from the written rules; the second pass never saw the first. Every disagreement was adjudicated under written rules; for coding, the adjudication saw the two codings under shuffled labels. An independent reviewer recruited by the author, not an author, verified a selected sample of 40 statements blind. The sample was deliberately selected to challenge the paper’s central findings, not to estimate an error rate for the entire evidence table: it covered all four source families (6 guidance, 15 regulation, 10 standards and 9 research statements), the 11 statements that could fill an empty cell under a broader reading and one control, ten statements from cells with many sources, eight on the reading of behavior, six audit-trail cases and four research proposals. The reviewer saw each passage with its source title and year, the four definitions of the codebook and two fixed questions, and no codes. For the preservation level, the independent reviewer agreed with 37 of 40 coded answers (kappa 0.86, treating “unclear” as its own category). The remaining three answers were unclear; none directly contradicted a yes or no. On whether the passage is a requirement, the reviewer disagreed with the coding for 3 of 40 (raw agreement 0.93; kappa is 0.00 because every sampled passage had been coded as a requirement, so it is not informative here). The three disagreements describe this selected sample only. They cannot be used as a corpus-wide error rate: the sample intentionally overrepresents difficult cases, and its strata are too small for weighting. Removing the three statements that the reviewer did not accept as requirements would lower two research counts of the matrix by one and change no cell of the normative families. The sheet, the key and the scoring script are in the data record. Agreement is Cohen’s kappa [Cohen 1960] per family, with raw agreement beside it.

The unit of extraction is a requirement statement: the smallest passage that names something to create, keep, record, log, document or describe. Statements from public-domain or openly licensed sources (US federal works, legislation and treaties, Open Government Licence, CC BY, Apache 2.0, IETF, W3C) are quoted verbatim, and every verbatim quote was checked against the source text. Statements from other sources are paraphrases of at most 45 words, checked to share no run of ten or more consecutive words with the source.

Each statement was coded against a grid fixed before coding.

Components: C1 model weights and configuration; C2 prompts and system text; C3 inference environment (software stack, settings, and the model-version string of a hosted model); C4 retrieval stores and embeddings; C5 agent tools and state (tool schemas, permissions, memory); C6 logs and traces; C7 generated records and decisions. A statement naming none of these, for example training data, evaluation results or risk assessments, is coded X, outside the grid.

Preservation capabilities (levels): L1 bits by fixity, the item is kept intact; L2 loadable, the item is kept usable or what is needed to load it is kept; L3 behavior within a stated tolerance, outputs or behavior can be reproduced or tested; L4 decision context, the item serves to explain, trace, audit or reconstruct a decision or use. A statement that only says “keep” or “log” is L1; one that keeps an item for traceability, accountability, audit or oversight is L1 and L4. The four are separate capabilities, not a ladder. Loading and re-running presuppose kept bits, but decision context can survive when a system can no longer be loaded or re-run, and a model that still loads does not by itself preserve the context of a past decision.

One reading of the codebook matters for the numbers. Both coding passes and the adjudication read an item named as an “audit trail” or “audit log” as serving decision context (L4) even where the statement states no purpose. Without that reading, 23 statements lose L4; Table 4 reports the matrix both ways.

The AI System Preservation Matrix. I use the seven-component, four-capability grid to code the 185 sources. I also propose it as a structure that later studies can reuse: the AI System Preservation Matrix, version 1.0. For each component its four columns ask whether the evidence is retained and its integrity checkable (L1), whether the retained component can still be loaded (L2), whether its behavior can be tested against a stated tolerance (L3), and whether a later reviewer can reconstruct the decision context (L4). The matrix can be applied to other sources, other jurisdictions and other classes of AI system. The counts in this paper describe the 185 sources as of 6 October 2026; they are not properties of AI systems in general. The matrix has not been validated as an assessment instrument for organizations, and this paper does not claim that it is one. The framework built on it is described in Section 6.1. The 28 cells are released as matrix.csv and the figure as matrix.svg, each with its version, as-of date and attribution line.

The matrix differs from the NDSA Levels of Digital Preservation, version 2.1 of March 2026 [NDSA 2026]. The Levels help practitioners build or assess a digital preservation program for digital content in general, across functional areas and at ascending levels. The matrix is specific to AI systems, its rows are components of the system in use, and its four capabilities are separate and not ordered. The two answer different questions: the Levels ask how well an organization preserves what it keeps, and the matrix asks what an AI system leaves to be kept.

A separate sensitivity pass (Section 4.4) tests the four empty cells under broader readings of “behavior” and “loadable”.

Each cell counts sources, not statements. An empty cell means that this search and its coding rules found no qualifying source. It does not prove that a relevant requirement or practice exists nowhere. A count measures documentary coverage, not legal authority or how mature an implementation is: a binding article and a recommendation count the same. The released source list gives each source an authority class; of the 17 regulatory texts, 5 are binding or mandatory for the bodies in their scope and 12 are voluntary frameworks or guidance.

3.5. Use of AI Tools

AI assistants supported evidence collection and processing, as well as manuscript preparation. I made the research and publication decisions and am responsible for the content.

The two passes of screening, extraction and coding were made by separately instructed AI assistants. Each worked from the written rules alone, and the second never saw the first’s decisions. The passes are independent in instruction and in blindness, not in kind: both are AI assistants and may share errors that their agreement does not reveal. A selected sample of the coded statements was verified by an independent human reviewer (Section 3.4); the remaining decisions were not.

4. Results

4.1. The Evidence Base

Of 721 research candidates, 242 passed title-and-abstract screening. Amendment A2 then removed 36 of them before full text: 31 self-deposits on unmoderated repositories and 5 duplicates of guidance, regulation or standards candidates. The remaining 206 reached full text, and 135 were included. The released screening file shows each step per record. Full-text exclusions were 41 records with no publicly readable full text, 28 methods or applications without a requirement, and 2 other records (206 - 71 = 135). The 41 unread records are listed by identifier in the supplementary data.

Of 59 guidance, regulation and standards candidates, 50 were included: 10 guidance documents, 17 regulatory texts and 23 standards. Together, the 185 sources yielded 1,519 requirement statements: 79 from guidance, 308 from regulation, 331 from standards and 801 from research.

Agreement was high throughout (Table 2). For regulation, 16 of 17 documents were included by both passes; with one disagreement and almost no exclusions, kappa is 0.000 although raw agreement is 0.941, the known prevalence effect of kappa [Feinstein and Cicchetti 1990].

Of the 1,519 statements, 1,135 were coded identically by both passes. The adjudication sided with one pass in 169 rows and with the other in 172, and combined both in 43, so neither pass dominated.

4.2. What the Sources Ask for

Most statements include a retention requirement. Of the 1,519 statements, 1,436 (94.5%) require an item to be kept or recorded (L1), 530 (34.9%) tie it to decision context (L4), 245 (16.1%) require it to remain loadable (L2), and 139 (9.2%) include a requirement that behavior be reproduced or tested (L3). The categories may overlap, since one statement can carry several capabilities; a statement counted under L3 usually counts under L1 as well. The share requiring reproducible behavior is similar in guidance (5 of 79), regulation (18 of 308) and standards (17 of 331), and higher in research (99 of 801).

A substantial share of the requirements concerns material outside the system in use. 649 statements (42.7%) name only items outside the grid: training and evaluation data, evaluation results, risk and impact assessments, governance documents. The share is 56% in regulation (174 of 308), 48% in standards (158 of 331), 39% in guidance (31 of 79) and 36% in research (286 of 801).

4.3. The Gap Matrix

Table 3 counts the sources supporting each cell, by family. Research covers all 28 cells. The other families leave gaps: 13 cells have no guidance source, seven have no standard and five have no regulatory source.

For four cells no qualifying source was found in the reviewed guidance, regulation or standards; only research proposals speak to them: re-runnable prompts and system text (C2-L3), loadable retrieval stores (C4-L2), re-runnable retrieval stores (C4-L3) and re-runnable agent tools and state (C5-L3). A bounded check of the full texts of all 50 included normative documents found no statement that the per-document caps had left out for these cells. Retrieval stores are the thinnest component outside research: one guidance document, two regulatory texts and three standards mention them at all. Figure 1 shows the same matrix by the number of normative families, guidance, regulation and standards, that reach each cell.

Table 4. The audit-trail reading. Cells whose counts change when “audit trail” items without a stated purpose are not read as decision context (L4); all other cells are unchanged, and no cell becomes empty.

cell	family	with the reading	without
C1-L4	research	43	41
C2-L4	regulation	7	6
C2-L4	research	23	21
C3-L4	regulation	4	3
C4-L4	research	14	13
C5-L4	research	25	22
C6-L4	research	55	54
C7-L4	research	59	55

Table 4. The audit-trail reading. Cells whose counts change when “audit trail” items without a stated purpose are not read as decision context (L4); all other cells are unchanged, and no cell becomes empty.

cell	family	with the reading	without
C1-L4	research	43	41
C2-L4	regulation	7	6
C2-L4	research	23	21
C3-L4	regulation	4	3
C4-L4	research	14	13
C5-L4	research	25	22
C6-L4	research	55	54
C7-L4	research	59	55

4.4. Robustness of the Four Evidence Gaps

The four empty cells are the central measured gap in this review. Whether they remain empty depends on what counts as “behavior” or “loadable”. Table 5 names the four missing capabilities and states each at three strengths of reading. Under the strict reading, the codebook’s, a statement counts only if it asks that behavior be reproduced, re-run or tested against a reference, or that what is needed to load an item be kept. Under an intermediate reading, behavior means tested against a stated reference or tolerance, and none of the 71 statements from guidance, regulation and standards that name prompts, retrieval stores or agent tools and state states a reference or a tolerance. Under a broad reading, B1 counts any requirement to evaluate, audit or monitor the item’s operation as behavior, and B2 counts any requirement to identify the source of a retrieval store as loadable. Monitoring is not reproducible behavior, and naming a source is not keeping a store loadable.

A further pass checked the broader readings against the 71 relevant statements instead of recoding the entire table. It followed written rules but was neither blind nor adjudicated. Its result is bounded to the reviewed normative documents: no qualifying source asks for re-runnable prompts, retrieval stores or agent tools, or for reloadable retrieval stores. Under looser readings these cells are thinly filled by monitoring and identification requirements, not by reproducibility requirements. The independent verification of Section 3.4 agrees: of the 12 statements around these cells the reviewer answered yes to none that the coding had judged not to meet the definition. Two other definitions do not reach these cells. A stricter reading of “requirement” could only remove statements, since the codebook already counts a documentation field as one. “Decision context” applies to L4, and Table 4 tests its one ambiguous reading.

5. Analysis

5.1. Standards Are Ahead of Guidance on the Running System

The first difference is in coverage of the running system. Technical standards address capabilities that archival guidance does not. Seven cells have at least one standard and no guidance source: agent tools and state at L1, L2 and L4 (five, two and five standards); the inference environment at L3 and L4; and logs at L2 and L3. The standards that fill them are concrete. The OpenTelemetry conventions for generative AI define spans for agent invocations and tool calls [OpenTelemetry 2026]; PROV-O and the Provenance Run Crate profile record agents, activities and the software that ran [W3C 2013; Workflow Run Crate 2024]; the SPDX 3.0.1 AI profile records whether the system can act without human involvement [SPDX 2024]. Guidance has nothing in the agent row: the National Archives of Australia lists specialized agent prompts and activity logs as agentic records but says that its advice “does not currently provide specific guidance on managing agentic AI records” [NAA 2026].

The reverse also exists. Three cells have guidance or regulation and no standard: prompts kept loadable (C2-L2, one regulatory text), retrieval stores in decision context (C4-L4, two regulatory texts) and generated outputs whose behavior can be checked (C7-L3, two guidance and three regulatory texts). For C4-L4, the EU AI Act requires the logs of remote biometric identification systems to record “the reference database against which input data has been checked by the system” (Art. 12(3)(b)) [EU 2024]. The field exists in one standard: the OpenTelemetry conventions offer an opt-in attribute for the documents a retrieval step returned [OpenTelemetry 2026]. It is not recorded by default and carries no stated audit purpose, so no standard in the sample ties retrieved material to a kept output for later review.

Guidance is never ahead of regulation: every cell with a guidance source also has a regulatory one.

5.2. No Reviewed Guidance, Regulation or Standard Asks for Re-Runnable Prompts, Retrieval or Agents

The clearest missing capability is behavioral reproducibility. Across guidance, regulation and standards, only 24 of 50 sources state any behavior-level requirement, and none does so for prompts, retrieval stores or agent tools and state. Models are the exception: C1-L3 appears in one guidance document, two regulatory texts and two standards.

This creates a practical gap. An organization can satisfy the stated keeping requirements for prompts, retrieval stores and agent tools and still be unable to show that the preserved system behaves the same way. Research goes further: 11 research sources address re-runnable prompts, 3 retrieval stores and 6 agent tools and state. Any such test needs an explicit tolerance, because settings meant to be deterministic do not give repeatable outputs [Atil et al. 2024].

Coverage and authority. A count of sources measures coverage, not legal force, so Table 6 splits the findings by authority: the five regulatory texts that are binding or mandatory for the bodies in their scope, all 50 guidance, regulation and standards documents, and the research proposals. The shortfall in behavior-level requirements holds in every view of the normative sources, at 7.1% of the statements in binding texts and 5.6% of all normative statements, against 12.4% in research. What binding texts leave out is broader: 12 of 28 cells have no qualifying source in them, and seven in ten of their statements (69 of 99) concern items outside the system in use. Across all official guidance, regulation and standards, four cells are empty, and research covers every cell.

5.3. Regulation and Archival Guidance Set Different Log Requirements Under Different Scopes

There is no single log-retention rule for every AI system. The regulatory and archival documents apply to different systems, actors and periods, so Table 7 shows each rule together with its conditions.

These are different requirements for different systems, not opposite defaults for one artifact. The Act sets minimum periods for the logs of high-risk systems, held by the provider or the deployer, and a ten-year period for the provider’s technical documentation (Art. 18(1)). The Australian guidance advises an agency which records of AI use to keep as records, by risk and by reliance. Neither is a rule for the other’s scope. What an organization must keep to explain a past decision is decided by neither alone: it depends on its own records schedule, on data-protection limits, and on which evidence the decision needs. For an organization that runs both kinds of system, that is a design question for the evidence it keeps, not a conflict in which one source overrides the other.

5.4. Two Standards and One Regulatory Text Address Hosted Models

For hosted models whose weights cannot be kept, the reviewed sources provide limited direction: two standards, one regulatory text and no archival guidance address the issue. When a model is a hosted service, its identity at the time of use is one thing the user can still record. Two standards require it: the OpenTelemetry conventions record “the name of the model that generated the response” and require that, for a vendor-supplied model, the value be “the exact name of the model actually used” [OpenTelemetry 2026]; the UK Algorithmic Transparency Recording Standard asks for the API provider and the model version [DSIT 2025]. The EU General-Purpose AI Code of Practice asks providers for evidence of a model’s authenticity, such as “the URL endpoint in the case of a service” [European Commission 2025]. No guidance source asks users to record which hosted model version produced an output, although guidance is where records of AI use are defined.

A recorded name has limits. It can be an alias, and the model behind it can change or be retired. The same conventions also define a response identifier and the request settings of each call, which, kept together with timestamps, narrow what the name stood for at the time. None of them shows that the model can still be called, and a retired hosted model cannot be re-run, whatever was recorded about it.

5.5. Research Implications Across Eight Fields

The findings also raise specific, testable questions for eight research communities.

Digital preservation. Of the statements, 94.5% include a retention requirement and 9.2% a requirement to reproduce or test behavior (Table 3). What would a preservation level that adds behavior to fixity look like, and can it be checked without the original system?

AI governance. Of the statements, 34.9% tie an item to decision context, and 42.7% name only items outside the system in use, such as training data and risk assessments; in regulation the share is 56%. Which evidence of a past decision should a governance duty name, as distinct from documentation of the system?

Reproducibility of language-model results. A stored model name, prompt and settings do not establish that behavior can be reproduced: names can be aliases (Section 5.4), settings meant to be deterministic do not give repeatable outputs [Atil et al. 2024], and no qualifying normative source asks for re-runnable prompts. Which tolerance makes a re-run of a hosted model meaningful, and for how long after its release?

AI agents. Tool schemas, permissions, memory, state and execution traces are the least covered component: archival guidance has no source in any agent cell, and re-running agent tools and state has no qualifying normative source. What must be recorded at the moment an agent is retired so that its actions can later be explained?

Retrieval-augmented generation. Retrieval corpora, embeddings, indexes and source-document identifiers form the thinnest row: no normative source covers loading or re-running a retrieval store, and the one standard field for retrieved documents is opt-in and carries no stated audit purpose. Which snapshot, chunking and index information is the minimum for a retrieval store to be reloaded?

Software engineering. Hosted models change or disappear: 42% of biomedical paper-model mentions involved a retired or soon-retired model [Wolfrath et al. 2026], and only two standards and one regulatory text ask users to record which hosted model was used. How should a system be built so that the model’s identity and settings reach every kept output without storing its content?

Archival science. Guidance leaves 13 of 28 cells empty and is never ahead of regulation, while standards are ahead of guidance on the running system (Section 5.1). Which parts of the technical standards should records guidance adopt as record types?

Records management and law. Retention duties attach to different actors under different conditions (Section 5.3), and only five of the 17 regulatory texts are binding for the bodies in their scope. Which retention schedule applies to a decision made with an AI system, for an organization that is a provider, a deployer or both?

6. A Preservation Framework and Recommendations

The matrix shows what the sources cover and where they stop. This section uses those findings to propose a preservation framework and nine actions for closing the gaps.

6.1. A Preservation Framework Derived from the Map

The AI System Preservation Framework, version 1.0, has five parts: the matrix (Section 3.4); an assignment of each of its 28 cells to one of three tiers (Table 8 and Table 9); a minimum evidence checklist for one decision (Section 6.2); a machine-readable profile, preservation_profile.json, which carries the tiers, the ten evidence elements and their status for each reference configuration; and the worked package of Appendix A.

Status. This is a proposed framework, not an operationally validated assessment tool. The matrix was tested through the coding of 185 sources and agreement between two passes. The framework was checked against three reference configurations on paper. Neither test establishes that it works as an organizational assessment instrument.

What the tiers are. The tiers are a proposed preservation strategy, not legal obligations or a validated maturity scale. They separate two questions: how many normative source families cover a capability, and how useful that capability is for explaining a retained decision. A requirement appearing often does not automatically make it important, feasible or essential.

Tier rules. Tier 1 is the proposed minimum evidence for explaining a retained AI-assisted decision. Its nine cells are every capability-1 cell, the items kept intact, and the decision-context cells of logs and traces (C6-L4) and of generated records (C7-L4). They are selected for their role in linking the output, the system, its inputs and the execution, not because a number of sources mention them; each also happens to have a qualifying source in at least two normative families. Tier 2 adds the 12 further cells with support in at least two normative source families, although a corresponding technical standard does not necessarily exist. Tier 3 holds the seven advanced or research-stage capabilities: cells with a qualifying source in at most one normative family, which may nevertheless be necessary for future reproducibility. Four of them, C2-L3, C4-L2, C4-L3 and C5-L3, have none, and for these the framework offers proposals: behavior-level testing of prompts, retrieval stores and agent tools, and a loadable retrieval store. Full preservation, where feasible, is the combination of the applicable tiers 1 to 3; it does not imply that every organization must retain every component.

Hosted models. The evidence floor includes keeping model weights intact (C1-L1), but that is unavailable to users of a hosted service. They can record model identity and version (E02, E03) instead. That helps explain which service was used; it does not preserve the weights or make the model re-runnable.

Table 10. The tiers and capabilities beside the NDSA Levels of Digital Preservation [NDSA 2026]. The reading is the author’s, at the level of concepts, and is not an official mapping; the requirements of the Levels were not coded in this review.

framework	closest concern of the Levels	difference
L1 bits kept intact (tier 1)	integrity and fixity of kept content	the framework keeps the items of an AI system and the link between an output and its execution
L2 loadable (tier 2)	content kept in usable, openable formats	for models, retrieval stores and agents, loadable includes dependencies, environment and configuration
L3 behavior (tiers 2 and 3)	none	the Levels concern content, not the behavior of a running system
L4 decision context (tiers 1 and 2)	descriptive and contextual metadata	the framework ties kept items to a decision and its reviewer
three tiers	four ascending levels of program maturity	the tiers order evidence, not the maturity of a program, and the capabilities are not a ladder

Table 10. The tiers and capabilities beside the NDSA Levels of Digital Preservation [NDSA 2026]. The reading is the author’s, at the level of concepts, and is not an official mapping; the requirements of the Levels were not coded in this review.

framework	closest concern of the Levels	difference
L1 bits kept intact (tier 1)	integrity and fixity of kept content	the framework keeps the items of an AI system and the link between an output and its execution
L2 loadable (tier 2)	content kept in usable, openable formats	for models, retrieval stores and agents, loadable includes dependencies, environment and configuration
L3 behavior (tiers 2 and 3)	none	the Levels concern content, not the behavior of a running system
L4 decision context (tiers 1 and 2)	descriptive and contextual metadata	the framework ties kept items to a decision and its reviewer
three tiers	four ascending levels of program maturity	the tiers order evidence, not the maturity of a program, and the capabilities are not a ladder

6.2. The Checklist and the Reference Configurations

Appendix A defines ten evidence elements for a single AI-assisted decision. Table 11 turns them into a practical checklist. An element is mandatory for the example when all three scenarios of the desk check need it, recommended when two need it, and conditional when only one does. The last column separates what a reviewed standard already defines from what this paper proposes.

Table 11. Minimum evidence checklist. R: required in the scenario; O: optional; –: not applicable. Established: a field exists in a reviewed standard. Partly: a field exists for part of the element; the rest is a local extension in the example.

element	status for the example	hosted model	retrieval-augmented	agentic	defined by a reviewed standard
E01 decision or output identifier	mandatory	R	R	R	established
E02 provider and actual model identity	mandatory	R	R	R	established
E03 model version, endpoint, request configuration	mandatory	R	R	R	established
E04 prompt or prompt-template identity	mandatory	R	R	R	partly: prompt content, no template identifier or version
E05 input or source-document identifiers	recommended	R	R	O	established
E06 retrieval corpus, index, embedding configuration	conditional: retrieval	–	R	O	partly: source names only, no snapshot, chunking, embedding or index field
E07 agent tools, permissions, state	conditional: agents	–	–	R	partly: tools and authority, no memory or state
E08 the decision or generated output	mandatory	R	R	R	established
E09 evidence linking output to inputs and execution	mandatory	R	R	R	established
E10 checksums, dates, retention rules	mandatory	R	R	R	established

Table 11. Minimum evidence checklist. R: required in the scenario; O: optional; –: not applicable. Established: a field exists in a reviewed standard. Partly: a field exists for part of the element; the rest is a local extension in the example.

element	status for the example	hosted model	retrieval-augmented	agentic	defined by a reviewed standard
E01 decision or output identifier	mandatory	R	R	R	established
E02 provider and actual model identity	mandatory	R	R	R	established
E03 model version, endpoint, request configuration	mandatory	R	R	R	established
E04 prompt or prompt-template identity	mandatory	R	R	R	partly: prompt content, no template identifier or version
E05 input or source-document identifiers	recommended	R	R	O	established
E06 retrieval corpus, index, embedding configuration	conditional: retrieval	–	R	O	partly: source names only, no snapshot, chunking, embedding or index field
E07 agent tools, permissions, state	conditional: agents	–	–	R	partly: tools and authority, no memory or state
E08 the decision or generated output	mandatory	R	R	R	established
E09 evidence linking output to inputs and execution	mandatory	R	R	R	established
E10 checksums, dates, retention rules	mandatory	R	R	R	established

The three reference configurations differ in what the reviewed standards can supply. A hosted-model decision needs eight elements, and standards define fields for seven of them and part of the eighth (the prompt template); what no record can supply is the ability to call the model again once its provider retires it. A retrieval-augmented decision needs nine: standards cover seven, and the retrieval corpus, chunking, embedding model and index have no field, which is the cell for loadable retrieval stores with no qualifying source. An agentic workflow needs eight: standards cover six, and agent memory and state have no field, which is the cell for re-runnable agent tools and state. The checklist is bounded to the desk check of Appendix A; it is not tested on running systems (Section 7).

Table 12 applies the tier assignment of Section 6.1 to three reference configurations, beside the cost drivers of Section 6.4. The configurations are building blocks, not exclusive classes of system. A real system combines them by one rule: it takes the union of the components, cells and evidence elements of the configurations it contains, so a retrieval-augmented agent inherits the retrieval cells (C4) and the agent cells (C5) and needs every element of both. For a hosted model, C1 is the identity and version of the model, since the weights cannot be kept, and C1-L1 is a partial substitute (Section 6.1). The counts are of cells; the last two columns repeat the desk check above.

Table 12. The tiers applied to three reference configurations and to their composition. Tier 3 cells in brackets have no qualifying source in guidance, regulation or standards.

reference configuration	components	cells	tier 1	tier 2	tier 3	elements needed / fully defined by standards	what costs most
hosted model	C1 (identity and version), C2, C3, C6, C7	20	7	10	3 (1)	8 / 7	instrumentation of each kept call; the model can retire whatever is recorded
retrieval-augmented	C1, C2, C3, C4, C6, C7	24	8	10	6 (3)	9 / 7	as hosted, plus identifiers and checksums of retrieved documents; a profile for the retrieval store is standards work
agentic	C1, C2, C3, C5, C6, C7	24	8	12	4 (2)	8 / 6	as hosted, plus a manifest of tools and permissions; agent memory and state have no field
retrieval-augmented agent (union of the two)	C1 to C7	28	9	12	7 (4)	10 / 7	the costs of both

Table 12. The tiers applied to three reference configurations and to their composition. Tier 3 cells in brackets have no qualifying source in guidance, regulation or standards.

reference configuration	components	cells	tier 1	tier 2	tier 3	elements needed / fully defined by standards	what costs most
hosted model	C1 (identity and version), C2, C3, C6, C7	20	7	10	3 (1)	8 / 7	instrumentation of each kept call; the model can retire whatever is recorded
retrieval-augmented	C1, C2, C3, C4, C6, C7	24	8	10	6 (3)	9 / 7	as hosted, plus identifiers and checksums of retrieved documents; a profile for the retrieval store is standards work
agentic	C1, C2, C3, C5, C6, C7	24	8	12	4 (2)	8 / 6	as hosted, plus a manifest of tools and permissions; agent memory and state have no field
retrieval-augmented agent (union of the two)	C1 to C7	28	9	12	7 (4)	10 / 7	the costs of both

The retrieval-augmented configuration carries more tier 3 cells and more cells without a source than the hosted model, because its row of the matrix is the thinnest. The hosted model has the fewest, and its floor can be met by configuring existing telemetry.

6.3. Recommendations

The nine recommendations below turn the measured gaps into actions. Each rests on its own row of the trace table and is bounded to what the review measured: what sources in the sample require, not what organizations actually do. None asks for every prompt, output, log or tool record to be kept; each names the smallest evidence that closes its gap.

Table 13. Recommendations.

#	who	with what	first step	success is checked by	evidence
1	National archives and records authorities	their AI records guidance; the OpenTelemetry agent and tool-call spans and PROV-O as field lists	Add an “agent records” section naming tool schemas and versions, delegated permissions, memory or state snapshots and action traces as record types to appraise	The next published revision names at least these four item types	Guidance has no source in any agent cell (C5, 0 of 10); standards 6, regulation 3 (T26)
2	Owners of AI systems built on hosted models	the OpenTelemetry generative-AI conventions: response model, response identifier, request settings	Record, for every call whose output is kept, the response-model name, the provider’s response identifier, the timestamps and the request settings, and state in the record that these identify the model but do not make it re-runnable	In a sample of 20 kept outputs, each links to these four items and to the stated limit	Only 2 standards and 1 regulatory text address hosted-model identity; no guidance source (T27, T42)
3	Organizations that must explain AI-assisted decisions, including deployers of high-risk systems under the EU AI Act	their records schedule, the log provisions that apply to them (for example Arts. 19(1) and 26(6)) and data-protection law	For one decision type, assess which information is needed to explain a decision, which records the law requires and for how long, whether a structured evidence record can replace full logs, and which content must be excluded, masked or separately protected; set retention and deletion per category	The assessment is approved by the records and privacy owners, and a sample of past decisions can be explained from the kept record alone	Documentation and logs fall on different actors with different periods, both log provisions subject to other law (T03, T06, T33, T35, T36)
4	National archives with AI guidance, together with regulators	the AI Act’s log duties and the archives’ log disposal advice	Publish a joint note stating which AI logs are records for high-risk systems and which are transitory for assistants	The note exists and both bodies’ guidance links to it	Different log requirements under different scopes, not yet reconciled for organizations in both (T07, T08, T10; T05)
5	Archivists writing AI records guidance	PREMIS environment entities, the Provenance Run Crate profile and the OpenTelemetry conventions	Map each item of the agency’s AI records checklist to a field in one of these standards, and record items with no field	Every checklist item has a field or a recorded gap	7 cells have a standard and no guidance source (T24a)
6	Standards bodies for AI documentation and telemetry (OpenTelemetry, SPDX, CycloneDX, RO-Crate profiles)	their extension processes	Propose a field set for a behavior reference: a fixed input set, the recorded outputs and the tolerance used to compare them, for prompts, retrieval stores and agent configurations	A released version contains the fields, and one public example uses them	No qualifying source in the reviewed guidance, regulation or standards for C2-L3, C4-L3, C5-L3; 24 of 50 normative sources state any behavior-level requirement (T23a, T25)
7	Standards bodies for packaging and provenance (RO-Crate, PROV-O)	the RO-Crate profile mechanism; the retrieval fields of Appendix A as a starting list	Draft a profile entity for a retrieval-store snapshot: corpus version or checksum, chunking procedure, embedding-model identifier, index type and parameters	A published profile with a validator test that loads a snapshot	No qualifying source in the reviewed guidance, regulation or standards for C4-L2; 7 research sources (T23b)
8	Owners of retrieval-augmented systems whose outputs inform decisions	the OpenTelemetry opt-in attributes for the data source and the retrieved documents	Turn the attributes on for calls whose outputs are kept as decision records, and keep the identifiers and checksums of the retrieved documents with the output rather than their full text; this serves traceability of what was retrieved, and restoring the content needs the content version to be kept as well	In a sample of 20 kept outputs, each carries the identifiers of the documents retrieved for it	C4-L4 has 2 regulatory texts and no standard; the one standard field is opt-in with no stated purpose (T24b, T28)
9	Owners of deployed AI systems	the seven components of this paper’s grid and their existing model and data documentation	For one production system, list where each of the seven components is kept and for how long	Each component has a named store and retention period, or a recorded decision not to keep it	43% of statements concern items outside the system in use; documentation duties center on development (T21)

Table 13. Recommendations.

#	who	with what	first step	success is checked by	evidence
1	National archives and records authorities	their AI records guidance; the OpenTelemetry agent and tool-call spans and PROV-O as field lists	Add an “agent records” section naming tool schemas and versions, delegated permissions, memory or state snapshots and action traces as record types to appraise	The next published revision names at least these four item types	Guidance has no source in any agent cell (C5, 0 of 10); standards 6, regulation 3 (T26)
2	Owners of AI systems built on hosted models	the OpenTelemetry generative-AI conventions: response model, response identifier, request settings	Record, for every call whose output is kept, the response-model name, the provider’s response identifier, the timestamps and the request settings, and state in the record that these identify the model but do not make it re-runnable	In a sample of 20 kept outputs, each links to these four items and to the stated limit	Only 2 standards and 1 regulatory text address hosted-model identity; no guidance source (T27, T42)
3	Organizations that must explain AI-assisted decisions, including deployers of high-risk systems under the EU AI Act	their records schedule, the log provisions that apply to them (for example Arts. 19(1) and 26(6)) and data-protection law	For one decision type, assess which information is needed to explain a decision, which records the law requires and for how long, whether a structured evidence record can replace full logs, and which content must be excluded, masked or separately protected; set retention and deletion per category	The assessment is approved by the records and privacy owners, and a sample of past decisions can be explained from the kept record alone	Documentation and logs fall on different actors with different periods, both log provisions subject to other law (T03, T06, T33, T35, T36)
4	National archives with AI guidance, together with regulators	the AI Act’s log duties and the archives’ log disposal advice	Publish a joint note stating which AI logs are records for high-risk systems and which are transitory for assistants	The note exists and both bodies’ guidance links to it	Different log requirements under different scopes, not yet reconciled for organizations in both (T07, T08, T10; T05)
5	Archivists writing AI records guidance	PREMIS environment entities, the Provenance Run Crate profile and the OpenTelemetry conventions	Map each item of the agency’s AI records checklist to a field in one of these standards, and record items with no field	Every checklist item has a field or a recorded gap	7 cells have a standard and no guidance source (T24a)
6	Standards bodies for AI documentation and telemetry (OpenTelemetry, SPDX, CycloneDX, RO-Crate profiles)	their extension processes	Propose a field set for a behavior reference: a fixed input set, the recorded outputs and the tolerance used to compare them, for prompts, retrieval stores and agent configurations	A released version contains the fields, and one public example uses them	No qualifying source in the reviewed guidance, regulation or standards for C2-L3, C4-L3, C5-L3; 24 of 50 normative sources state any behavior-level requirement (T23a, T25)
7	Standards bodies for packaging and provenance (RO-Crate, PROV-O)	the RO-Crate profile mechanism; the retrieval fields of Appendix A as a starting list	Draft a profile entity for a retrieval-store snapshot: corpus version or checksum, chunking procedure, embedding-model identifier, index type and parameters	A published profile with a validator test that loads a snapshot	No qualifying source in the reviewed guidance, regulation or standards for C4-L2; 7 research sources (T23b)
8	Owners of retrieval-augmented systems whose outputs inform decisions	the OpenTelemetry opt-in attributes for the data source and the retrieved documents	Turn the attributes on for calls whose outputs are kept as decision records, and keep the identifiers and checksums of the retrieved documents with the output rather than their full text; this serves traceability of what was retrieved, and restoring the content needs the content version to be kept as well	In a sample of 20 kept outputs, each carries the identifiers of the documents retrieved for it	C4-L4 has 2 regulatory texts and no standard; the one standard field is opt-in with no stated purpose (T24b, T28)
9	Owners of deployed AI systems	the seven components of this paper’s grid and their existing model and data documentation	For one production system, list where each of the seven components is kept and for how long	Each component has a named store and retention period, or a recorded decision not to keep it	43% of statements concern items outside the system in use; documentation duties center on development (T21)

6.4. Feasibility and Cost Drivers

The recommendations have different cost drivers. Some require changes to documentation; others may need new instrumentation. This review measured requirements, not implementation costs or savings. Four kinds of cost are kept apart: storage, instrumentation, privacy review and maintenance. Only storage is measured, in the constructed example of Appendix A; instrumentation, privacy review and maintenance were not measured and are named in Table 14 as drivers, not quantities. Table 14 names the dominant cost drivers under stated assumptions.

Table 14. Feasibility of the recommendations.

recommendation	kind of change	reuses	dominant cost driver	verification effort	maintenance trigger
1, 4, 5	documentation only	existing guidance and the field lists of published standards	staff time to draft and agree text	review of the published text	new standard versions; new kinds of AI system
3, 9	assessment and records schedule	records schedules, privacy assessments, system inventories	time of records, privacy and system owners per decision type	sample test: explain past decisions from the kept record	change of system, model or law
2, 8	new instrumentation, often configuration of existing telemetry	OpenTelemetry instrumentation where present	storage of one structured record per kept decision; protection of sensitive content	sample of kept outputs checked for complete links	model or tool changes; telemetry convention versions
6, 7	standards work	existing extension and profile processes	committee effort; reference examples	a validator and a public example	each release of the standard

Table 14. Feasibility of the recommendations.

recommendation	kind of change	reuses	dominant cost driver	verification effort	maintenance trigger
1, 4, 5	documentation only	existing guidance and the field lists of published standards	staff time to draft and agree text	review of the published text	new standard versions; new kinds of AI system
3, 9	assessment and records schedule	records schedules, privacy assessments, system inventories	time of records, privacy and system owners per decision type	sample test: explain past decisions from the kept record	change of system, model or law
2, 8	new instrumentation, often configuration of existing telemetry	OpenTelemetry instrumentation where present	storage of one structured record per kept decision; protection of sensitive content	sample of kept outputs checked for complete links	model or tool changes; telemetry convention versions
6, 7	standards work	existing extension and profile processes	committee effort; reference examples	a validator and a public example	each release of the standard

In the constructed design, evidence storage scales with the number of decisions retained rather than with all the logs the system produces. With N kept decisions, a structured record of size e per decision and shared configuration of size c kept once per version, the evidence takes about N × e + c, plus the source documents, which usually stay in the records system already. In the worked example of Appendix A, the per-decision records take 1,848 bytes and the shared configuration 1,361 bytes; full prompt and response content is not included. These figures describe one constructed example and are not an estimate for any organization.

7. What Remains to Be Tested

The matrix leaves seven questions that this review cannot answer.

• Behavior equivalence for prompts, retrieval stores and agents. Four cells have no qualifying normative source at the behavior or loadable level. What counts as “the same behavior” for a prompted, retrieval-augmented or agentic system, and which tolerance makes the test meaningful given nondeterminism, is open.
• A loadable retrieval store. No normative source in the sample defines what must be kept for a retrieval store to be loadable again: the corpus snapshot, the chunking procedure, the embedding model and the index state, and in what form.
• The retired agent. The agent reviews of 2026 study agents while they run; no source in the sample specifies the record of an agent’s tools, permissions and memory at the moment it is retired.
• Log retention across regimes. Regulation and archival guidance set different log requirements under different scopes. Which logs carry evidential value for which decisions, and for how long, needs an evidence base rather than a default.
• Hosted models. When weights cannot be kept, which evidence of behavior can stand in for them (recorded outputs on a fixed input set, version strings, response identifiers, provider retirement notices) and how long that evidence remains useful is untested.
• From development documentation to the system in use. Over two fifths of the requirements found concern training data, evaluation and risk documentation. How these link to the records of the system in use, so that one can be found from the other years later, is not specified by any source in the sample.
• Tests on running systems, and an operational reconstruction test. Appendix A checks the reviewed fields against three scenarios on paper and builds one constructed package. Whether such a package lets an independent reviewer reconstruct a real hosted-model decision, a retrieval-augmented decision and an agent’s actions, and at what effort and storage, needs tests on running systems with acceptance criteria set in advance. The planned next study is an operational reconstruction test. For a set of decisions made on each reference configuration, an independent reviewer receives the evidence package only, without access to the system, and is asked to reconstruct the model identity and version, the prompt template and settings, the retrieved sources, the tools that acted and the person who approved. The study records what is reconstructed, what fails, the time taken and the bytes kept, and compares the package with a store of full logs. The acceptance criteria are set before the first decision is chosen. It belongs to the journal version of this work.

8. Limitations

The search ran on one day (2026-10-06) and in English. The guidance family covers six national archives and five preservation bodies; other jurisdictions may say more. The regulation family covers eight jurisdictions and excludes paywalled standards and texts without an official English version.

Of the 206 research records that reached full text, 41 had no publicly readable full text and were not coded. They include 13 SSRN papers behind a bot-verification page and other papers behind publisher paywalls. Three belong to the paradata line of work this review builds on: Cameron, Franks, Huvila and Mooradian (2025) [Cameron et al. 2025], Cameron and Hamidzadeh (2024) [Cameron and Hamidzadeh 2024] and Davet, Hamidzadeh and Franks (2023) [Davet et al. 2023]. Their requirements are therefore not coded in the evidence table; the account of that line rests on Franks (2026) and the RP04 report, both read in full. The research family is bounded by the first 60 records per OpenAlex query and 30 per arXiv query.

Amendment A2 was made after screening. Screening and coding were done in two passes under written rules, with agreement measured and disagreements adjudicated under written rules; a selected sample of 40 of the 1,519 statements was verified blind by an independent human reviewer (Section 3.4), and the other adjudicated decisions were not. The three disagreements in 40 are the rate observed in that sample, which oversamples the cases most likely to be disputed; it cannot estimate the error rate of the corpus, and the sample is too small to test every statement that could fill the four empty cells. For the 12 statements around those cells the reviewer never answered yes where the coding had said no (one answer was unclear), so the four cells stay empty. The codebook leaves room for judgment in places; the audit-trail reading is reported separately in Table 4. Extraction capped long documents at 30 to 40 statements. That can undercount provisions in very long texts; a bounded check found no capped provision that would have filled one of the four empty cells. The sensitivity pass on those cells was made once, not blind and not adjudicated, and rests on the author’s definitions of the two broader readings. Several statements can come from one source, which is why cells count sources rather than statements.

Counts measure documentary coverage. They do not weigh legal authority, scope or applicability: a binding article, a voluntary framework and a research proposal count the same, and the EU AI Act’s high-risk duties do not yet apply. They do not measure implementation: a requirement in a document says nothing about whether organizations meet it.

The framework is proposed. Its tiers follow a stated rule applied to the matrix, and it has been checked only by classifying sources and by a desk check on three reference configurations. It has not been validated in operation, and it is not an assessment instrument.

The main findings concern gaps that remain visible across many of the reviewed sources, rather than small differences between counts. The search limits and coding judgments still matter when interpreting how widely those gaps apply.

9. Conclusions

The evidence gap is measurable. Across 185 reviewed sources, requirements say much more about keeping AI material and documenting model development than about preserving the system in use. Under the study’s coding rules, four of 28 cells have no qualifying guidance, regulation or standards source for re-running prompts, retrieval stores or agent tools, or for reloading a retrieval store. Archival guidance also leaves every agent cell empty.

The AI System Preservation Matrix and the proposed three-tier framework give archives, standards bodies, regulators and researchers a common way to test new sources against those gaps. The immediate step is narrower: for each consequential AI-assisted output, keep the output itself, its identifier, the model identity, the prompt template and request settings, retrieved-source and tool identifiers, the links between them, and the checksums and retention rules. Keep this evidence for the period needed to explain the decision, with the applicable retention and privacy duties assessed before deciding which raw logs it can replace. In the constructed example, that record is small; operational costs have not yet been measured.