How long should you keep AI chat logs, transcripts and prompts? A GDPR retention schedule for small EU businesses
What you get: a finished retention schedule for the data your AI tools keep, with seven rows already filled in (chatbot chats, call transcripts, staff prompts, uploaded files, saved outputs, high-risk system logs and supplier copies). Each row has the purpose, a suggested period to adjust, where to delete it, who checks and the next check date. Plus the privacy-notice line to copy.
The short answer
The GDPR sets no fixed number of days. It says personal data must not be kept in a form that identifies people for longer than the purpose needs (Article 5(1)(e)), and Recital 39 says you should set time limits for erasure or for a periodic review. So for each kind of data your AI tools keep, pick a period, write down the reason, tell people (Article 13(2)(a)), put it in your records (Article 30(1)(f)), and set the tool to delete by default where it can (Article 25(2) covers the period of storage).
The retention schedule (adjust the periods to your business)
| Data | Purpose | Period | Where to delete | Who checks | Next check |
|---|---|---|---|---|---|
| Customer chats with your website AI chatbot | Answer the question; handle follow-ups and complaints | [e.g. 90 days], then delete; keep longer only if a complaint is open | Chatbot admin settings / auto-delete | [name] | [date] |
| AI call or meeting transcripts and recordings | Write notes and actions from the call | [e.g. 30 days] for the raw recording and transcript; the agreed notes go into the client file under its own period | Note-taker settings; shared drive | [name] | [date] |
| Staff prompts and chat history in AI assistants | Do the work task | [e.g. 30 days] or history switched off for work accounts; never paste customer files you do not need | Workspace admin retention / history setting | [name] | [date] |
| Files uploaded to AI tools (CVs, invoices, contracts) | One task, e.g. summary or extraction | Delete from the tool when the task is done; the original stays in your own system under its own period | Tool's file list; supplier deletion on request | [name] | [date] |
| AI outputs saved in the client or customer file | Part of the service record | Same period as the client file, e.g. [the period your tax, accounting or contract law requires] | Your file system | [name] | [date] |
| Logs of a high-risk AI system you deploy (EU AI Act) | Monitoring and incident follow-up | At least six months unless other Union or national law says otherwise (AI Act Article 26(6)), and no longer than you need under GDPR | System log export | [name] | [date] |
| Data the supplier holds after you stop using the tool | None after the contract ends | Deleted or returned at your choice, existing copies deleted (Article 28(3)(g)); ask for written confirmation | Supplier contract and deletion confirmation | [name] | [date] |
The periods in brackets are examples, not legal rules. Your national tax, accounting, employment or sector law may require a minimum period for some records, and an open complaint or legal claim can justify keeping specific items longer. Write the reason next to any period you choose.
Copy this privacy-notice line
We keep chats with our website assistant for [90 days] and call transcripts for [30 days], then delete them automatically, unless you have an open complaint, in which case we keep the relevant messages until it is closed. Our AI suppliers delete the data when our contract ends.
Do this week
- List each AI tool and what it stores: chats, transcripts, prompts, files, outputs
- Open each tool's admin settings and note its default retention and history setting
- Pick a period for each row and write the reason
- Switch on auto-delete or shorter history where the tool allows it
- Add the periods to your privacy notice and your Article 30 records
- Put a review date in the calendar, at least once a year
This schedule is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5(1)(e), 13(2)(a), 14(2)(a), 25(2), 28(3)(g) and 30(1)(f), Recital 39) and Regulation (EU) 2024/1689, the EU AI Act (Article 26(6)). National rules can add obligations. Checked on 22 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
You already know the statutory periods for books and records. Clients often forget that their AI tools quietly keep copies of the same documents. Go through this schedule with them next to their client AI inventory, and stay inside your professional rules.
Keep the schedule next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep the signed schedule as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then fill this schedule. Related: Article 30 records sheet · erasure and objection request sheet · AI meeting note-taker setup sheet · AI Act record-keeping logs.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 5(1)(e), 13(2)(a), 14(2)(a), 25(2), 28(3)(g), 30(1)(f), Recital 39
- Regulation (EU) 2024/1689 (EU AI Act): Article 26(6)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.