GOV-23: Evidence retention
In short: Keep agent logs, approvals and review records for a defined period that meets legal and contractual requirements. Evidence that has been deleted cannot answer an auditor or a regulator. The EU AI Act requires deployers to keep high-risk system logs for at least six months.
1GOV-23
What does GOV-23 require?
Keep agent logs, approvals and review records for a defined period that meets legal and contractual requirements.
Why does it matter?
Evidence that has been deleted cannot answer an auditor or a regulator. The EU AI Act requires deployers to keep high-risk system logs for at least six months.
How do you test it?
- Ask for the written retention period for agent evidence.
- Retrieve a log entry from the oldest date the policy covers.
- Confirm records cannot be edited after writing.
Which platforms document GOV-23?
No platform in the register documents this control in full.
- 7.30Cyera Identity partly documentedSource: Oasis Agentic Access Management, read
- 9.10NewCore not found in public materialChecked: NewCore: Discover; NewCore: Secure; NewCore: Govern; NewCore: Identity foundation; NewCore emerges from stealth; NewCore on AWS Marketplace, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- EU AI ActArticle 19(1) and Article 26(6): Automatically generated logs must be kept for a period appropriate to the intended purpose, of at least six months. Source: Regulation (EU) 2024/1689, the AI Act, on EUR-Lex
Which controls are related?
Glossary: audit trail, evidence retention, ai act.
Reviewed by The Register desk