Decision Custody

The institutional counterpart to decision sovereignty — and the one question the accountability literature has not asked explicitly.

1. Two clocks that do not agree

When an institution makes a decision that matters — grants a licence, registers a title, approves a loan — two clocks start ticking at the same moment.

The first clock measures how long the decision matters. Call it the consequence clock. A licence granted today will still be relied on in twenty years. A refusal will still be shaping someone's career in ten. A land title will still be the proof of ownership long after everyone who handled it has died. This clock runs for as long as anyone can still rely on the decision, challenge it, or be harmed by it.

The second clock measures how long the institution can still show how the decision was made. Call it the evidence clock. It runs only as long as the records survive and still make sense: the logs, the rules that were applied, the data that was used, and the memory of the people who were there.

For most of history, the two clocks kept the same time without anyone trying. The same paper file both recorded the decision and explained it. It sat in a registry or an archive, and nobody threw it away. If a question came fifty years later, someone fetched the file.

That is no longer true, and the gap is not small.

The consequence clock has not changed — decisions matter for exactly as long as they ever did. Licences, registrations, entitlements and credit decisions are the ordinary output of registries, regulators, licensing bodies, insurers, lenders and public authorities: the institutions that exist precisely because somebody needed decisions to outlast the people who made them.

The evidence clock, however, has collapsed. The AI systems now making or shaping these decisions are replaced within a year or two of being deployed; the providers publish the retirement schedules (reference 29). Suppliers merge or move on. Reference tables are overwritten in place. Configuration changes with every release. And a retired model rarely announces itself as a problem — the system keeps producing answers while the machinery underneath quietly becomes something else. Meanwhile, the legal minimum is being treated as a target: under the European AI Act, the logs of a high-risk system need be kept for as little as six months — and even that floor is not yet in force, its application having been deferred to December 2027 by the Digital Omnibus of July 2026. Other jurisdictions do not even set a number: Canada's proposed Artificial Intelligence and Data Act died on the order paper, and the United States regulates retention sector by sector and, increasingly, state by state: Colorado's 2026 statute on automated decision-making, which applies to decisions made from 1 January 2027, has deployers keep compliance records for three years after a consequential decision (reference 25). The longest AI-specific retention rules the author has found are therefore a six-month European floor and a three-year state rule, neither yet in force. Ordinary records law — public-records schedules, sector rules — sits alongside these and can run far longer, where it applies.

Six months of evidence for a decision whose consequences run for sixty years is not a control. It is an accounting convention.

The regulator's six months is written in system time — the lifetime of the software. The citizen's question arrives in consequence time — the lifetime of the decision. An institution that clears the legal floor believes it has done something> which means, it has answered the wrong clock.

One more thing should be said about the consequence clock before the paper relies on it. It is set per decision — by the class of decision and the consequences that follow from it — never by a single retention setting applied across a system, and never by the lifetime of the software. Records schedules have long worked at this grain, setting retention by function and activity; the software now making the decisions seldom does. Two decisions made by the same model on the same afternoon can carry horizons a generation apart. Any instrument that measures custody has to measure it at that grain, which is what the instruments in §6 and §7 do.

2. Custody is not a metaphor

Custody sounds like a borrowed metaphor. This section shows it is not: it is a working concept in a profession far older than computing, one that has had to answer the same question at every change of medium, and that AI has now reopened — how do you stay responsible for something you no longer hold?

The word being reached for right now, across security vendors and governance blogs, is custody. That reaching is not wrong, but it is shallow. It borrows the forensic image — the evidence signed from collection to courtroom — and stops there, producing another logging feature with a better name.

Custody has a deeper and far more useful history, and it belongs to archival science rather than forensics. Hilary Jenkinson put it at the centre of the archive in 1922: records kept in the unbroken custody of those responsible for them, and of their legitimate successors, because that continuity was the guarantee of their authenticity. Theodore Schellenberg, at mid-century, drew the line elsewhere: records stay with the office that made them, and become archives only once they are judged to have lasting value and selected for an archival institution (reference 20). In 1981 Gerald Ham challenged the settled conception directly, arguing in The American Archivist that the custodial posture — archivists as caretakers of what they physically hold — had become untenable as electronic records multiplied beyond any institution's capacity to take them in, and naming what followed the post-custodial era. Terry Cook developed the argument through the 1990s. Jay Atherton proposed a continuum in place of the life cycle in the mid-1980s (reference 19); Frank Upward gave it structure a decade later with the records continuum model, which charts the many ways an entity can claim custody of a record it does not possess.

The important part, for our purposes, is what post-custodial theory did not say> It did not say custody ends. The professional literature is explicit that post-custodial is not non-custodial: the obligation persists but detaches from possession.

The institution remains answerable for records it does not hold, and discharges that obligation through oversight, specification, and involvement in how such records are made and kept, rather than through physical control of them.

That reading is contested, and the paper should say so. The custodial school holds the opposite view: that the authenticity of records is protected only when they pass into the custody of an archival institution independent of the body they hold to account. Luciana Duranti's “Archives as a Place” is the standard statement (reference 21). The dispute is about where records should rest once the office that made them no longer needs them. It does not touch what this paper takes from the post-custodial literature, which is narrower> the duty to keep a record trustworthy is not discharged by a change in who holds it.

Nor did the idea stay theoretical. Digital preservation codified it: ISO 14721, the Open Archival Information System reference model, makes it a mandatory responsibility of any archive that claims conformance to obtain sufficient control of information to ensure its long-term preservation, and to keep that information independently understandable to a designated community — without the assistance of the people who produced it. The standard exists and is decades mature, as is its records-management counterpart, ISO 15489 (reference 27). Neither is often read as applying to the decisions software now makes.

That is a close description of where the typical organisation now stands in relation to its decision machinery. It does not hold the weights. It does not hold the training data. It frequently does not hold the inference logs, the model version, the reference tables, or the vendor. It rents most of it, on terms and timelines it does not set. Enterprise architecture has tended to treat this as a novel problem of AI governance. It is a well-worked problem in a neighbouring profession, and that profession reached a conclusion worth importing wholesale: losing possession does not discharge the obligation, it changes its form>.

This is also why ‘custody’ is the right word and traceability, auditability and observability are not. Those are properties a system either has or lacks. Custody is a relationship between an institution and a record — one that has to survive changes of possession, of technology, of supplier and of staff, because that is the only condition under which it means anything.

One caution on the word, for readers from the archival profession. In archival usage custody is the narrower term: guardianship of records, physical and legal. Custody alone does not keep records intelligible — a ledger can sit safely in a vault for a century and be unreadable for want of the key to its codes — and the work of keeping records authentic, ordered and usable over time is called preservation. Decision custody, as defined in the next section, is deliberately wider than archival custody. It asks for the ability to reproduce, explain, defend and answer for a decision, and that takes preservation as well as guardianship. The word is kept for two reasons. The failure this paper describes begins as a failure of custody: the institution lets go of the evidence without noticing that it has. And custody names a party who answers, which preservation does not.

3. Defining decision custody

Here is the definition this paper stands on. The rest of the section takes it apart, one word at a time.

Decision custody is an institution's demonstrated ability to reproduce, explain, defend, and answer for every consequential decision made in its name — human or machine — for as long as the consequences last.

Four verbs and one clause do the work, and each is chosen against a weaker alternative.

One boundary should be drawn clearly. Decision sovereignty is a different and already-defined concept, developed principally in the context of state and military authority (Wei and Shu, reference 12), which asks where the decision boundary sits and whether a supplier has come to control it. That question is prior and it is not this one. Decision custody is the institutional counterpart: it asks what happens afterwards, and who is still standing to answer. Sovereignty concerns the moment of decision; custody concerns its whole life.

4. What sits beneath custody

Custody does not replace the existing accountability tools — logging, provenance, review. It sits above them and depends on them. Five layers are worth separating, because most institutional failures happen at the boundary between two layers rather than inside any one. Figure 1 shows the whole stack.

• Layer 0 :: the record. That a decision was made: when, by what, affecting whom. Almost every organisation has this, and almost every organisation mistakes it for the whole problem.
• Layer 1 :: provenance. How the decision was made: the chain of inputs, the nature of the processing, and the flow-on effects through the pipeline. This is well-founded ground. Singh, Cobbe and Norval set it out as decision provenance and it remains the strongest technical basis available for exposing decision pipelines in service of oversight, audit and redress. Nothing here competes with it; everything here assumes it.
• Layer 2 :: reviewability. Whether the decision, as a socio-technical process rather than a model output, can actually be examined by someone with standing to examine it. This layer is the subject of the next section, because it is the one most likely to be mistaken for custody.
• Layer 3 :: custody. Who is obliged to hold layers 0 to 2, for how long, against what future demand, and under whose signature. This layer is usually absent, because it is not a system property and therefore has no natural owner in a technology organisation.
• Layer 4 :: covenant. Why the institution exists and what it undertook to the people it serves (the service covenant of reference 13). Custody without covenant is archiving for its own sake; covenant without custody is a promise with no receipt.

Provenance and reviewability are properties of a system and a process. Custody is a property of an institution, and it is the only one of the three with a clock in it.

A third term from the accountability field belongs in the same picture. Joshua Kroll's traceability (2021) is the principle that a system's behaviour should be attributable to the human decisions and processes that produced it, so that accountability has somewhere to land. Read against the stack: traceability is the principle, provenance is the mechanism that serves it, reviewability is the test that a particular decision meets it — and custody is the duration for which the whole arrangement must hold, and the office that holds it. Kroll's principle, like reviewability, is stated without a clock. That is not a criticism of it; a principle need not carry one. An institution does>

That distinction is not academic. An organisation can hold a complete, signed, tamper-evident provenance record of a decision, structured for review by a competent regulator — and still have no custody of it.

This is because the pipeline belongs to a supplier whose contract runs three years against a consequence that runs thirty; because the log retention was set by a platform team optimising storage cost; because the model version identifier resolves to nothing; or because the reference data that made the record interpretable was refreshed in place and the prior state was never kept. Every one of those is a custody failure occurring in the presence of good provenance and adequate reviewability.

5. What reviewability asks, and what it does not

Readers who know the accountability field will have a question ready: has this not already been done, under the name reviewability? It deserves a direct answer, because it is the strongest objection available — and because the difference comes down to one word: time.

Jennifer Cobbe and Jatinder Singh introduced reviewability in 2020 (reference 26) and, in 2021, with Michelle Seng Ah Lee, set it out as a framework for the accountability of automated decision-making. They made the right move and they made it first. They treated automated decision-making as a socio-technical process involving both human and technical elements, beginning before a decision is made and extending beyond the decision itself. They broke that process into its technical and organisational parts in order to determine what record-keeping each part contextually requires. And they drew the method from administrative law's approach to reviewing human decision-making, which is exactly the right place to have looked, because administrative law has been answering “was this decision properly made” for a century longer than computer science has existed.

Anyone building the record layer this paper depends on should start with that work rather than with this. I am not proposing an alternative to it. I want to be exact about what remains, because it is one thing and not a list.

Reviewability asks whether a decision can be examined. Custody asks how long it will remain examinable — and who is obliged to keep it so.

The gap is temporal, and it runs through the whole field rather than through one paper. The literature on algorithmic accountability is, for the most part, written in the present tense>. A framework is satisfied at the moment of assessment: the records are adequate, the process is decomposable, the review can proceed. Nothing in that assessment tells you whether the same will be true in year twelve, after two supplier generations, a platform migration, a reference-data refresh, and the retirement of everyone who was in the room. Reviewability has no clock, and it does not claim to. Custody is the clock.

One recent paper comes closest to the clock, and approaches it from the other side. Chappidi, Cobbe, Norval, Mazumder and Singh (2025) surveyed a hundred practitioners on record-keeping for AI accountability and documented what happens when it over-reaches: records kept because someone might ask, collisions with storage limitation, organisations reshaped around their own logs, and resistance from the people asked to keep them — accountability capture, in their phrase. That is the counter-pressure to everything argued here, and it is real. Custody does not answer it by recording more. It answers it by being exact about what must survive and for how long — the subject of §7A — and by insisting that the duration be set by the consequence rather than by caution. A record kept because nobody dared delete it is not custody. It is the capture they describe.

Three consequences follow, and each is a place where an institution with excellent reviewability still fails.

• Duration is unowned. Reviewability determines what to record. It does not determine for how long, because "how long" is not a property of the process — it is a property of the consequence, which sits outside the system entirely and is usually known only to the general counsel.
• Decay is invisible. A record that was reviewable on the day can cease to be reviewable without anything being deleted. Reference data refreshed in place, a schema retired in a migration, a configuration treated as settings rather than as evidence — none of these is a records incident, and all of them end reviewability silently. The preservation field has a name for the property being lost: ISO 14721 requires preserved information to remain “independently understandable” to its designated community, without the help of those who produced it — a test most decision records would fail within two supplier generations.
• Answerability has no successor. A review needs someone to review. Over a long enough horizon> the reviewing party, the accountable party, and the institution itself will change. Reviewability assumes a standing forum; custody has to survive its dissolution.

Custody, then, is not a rival framework. It is the question you ask after reviewability has been answered well: for how long does that answer hold, and whose name is against it.

6. The first instrument: the custody gap

The first instrument turns custody from a principle into a number.

The custody gap is the difference between the consequence horizon of a decision and the evidence horizon of the system that produced it.

The consequence horizon is how long the decision can still be relied upon, challenged, or cause harm. It is a legal and social question, not a technical one, and it is usually answerable by a general counsel in an afternoon. Limitation periods bound when a claim can be brought. They do not bound how long a decision is relied on or how long it can do harm, and the horizon is the longest of the three.

The evidence horizon is subtler, and this is where most assessments go wrong. It is not the log retention period. It is the shortest of every dependency the record has: log retention, contract term, supplier solvency, model or version availability, reference and lookup data as it stood, configuration versioning, key and signature validity, format and schema readability, and the institutional memory of the people who could interpret any of it. The evidence horizon is a minimum function over that list — whichever dependency expires first sets it — and an institution that measures only the first term is measuring the one it happens to control. The list is not fixed. A sealed evidence slice (§7A) takes terms off it — the model, the supplier, the live reference table — and the horizon is then the minimum over what remains.

Set the two side by side, per decision class — Figure 2 shows the shape for a single decision; the table below shows the portfolio view, with indicative figures except where marked — and the exposure becomes visible without any new instrumentation.

† Sourced. The six-month figure is the floor for automatically generated logs of high-risk AI systems under the EU AI Act (Article 19 for providers, Article 26(6) for deployers), deferred and not yet in force (see §9). It applies only to high-risk systems — those listed in Annex III and those embedded in regulated products under Annex I. Creditworthiness and public-benefit eligibility are listed in Annex III; land registration, professional licensing and content moderation are not (‡), and for those classes the evidence horizon is whatever the institution's own retention setting happens to be. The ten-year figure is the technical-documentation obligation under Article 18, running from the system's placing on the market or putting into service; it attaches to documentation about the system rather than to the record of any decision — a distinction easily lost in a compliance mapping and expensively lost in a hearing. The 25-month figure is the record-preservation requirement for consumer credit applications under the US Equal Credit Opportunity Act (Regulation B, 12 CFR 1002.12). Unmarked figures are indicative and should be replaced with your own.

Every organisation's own version of this table can be built in a workshop, and the workshop usually does more governance work than the artefact it produces, because it is the first time the legal horizon and the retention setting have been spoken aloud in the same room.

A custody gap is not a compliance finding. It is an unfunded liability with no line on the balance sheet.

Two properties make the gap useful as a management instrument. It is unavoidably quantitative, so it cannot be closed by assertion. And it is asymmetric: closing it is cheap at design time and ruinously expensive at challenge time, which is exactly the profile boards are equipped to reason about once it is put in front of them in those terms.

There is a case the table cannot show, because it has no row. A determination that nobody recognised as a decision — a threshold applied silently, a ranking that was never called a decision, a default that decided by not deciding — has no record, no retention setting and no owner. Its evidence horizon is exactly zero, and its consequence horizon is whatever it was always going to be, because the consequence clock does not wait for the institution to notice. This is the purest custody gap. Srikanth Gaurav was right to observe, in response to the first version of this paper, that the larger exposure may sit before any of the instruments here can be applied: they all assume that something became recognisable as a decision record. Custody attaches where the consequence attaches, not where the register does. §7 therefore begins with a test for it.

7. The second instrument: the four tests

The second instrument turns the definition into an examination. Each verb becomes a test with a stated failure condition, and the tests are taken in order — an institution failing an early one has failed custody, whatever the later ones show and whatever its documentation claims. A pre-condition sits before the four tests, and it is the one the first version of this paper assumed away.

The fourth test is the one that fails most often, and it fails for a structural reason rather than a negligent one. Individuals retire, teams reorganise, projects close, and suppliers are acquired; only offices are built to outlive their occupants. Institutions that have carried decisions across centuries — registries, courts, archives, notarial systems — did it by vesting answerability in an office and then keeping the office. That competence still exists inside most public bodies. It has simply never been asked of the software estate.

7A. What custody preserves — and what it must not

The four tests say what a decision record must be able to do. They do not say what it must contain, and the first version of this paper answered that question inadequately: it proposed snapshotting the reference data in force with each decision. The diagnosis was right. The remedy creates a regress.

Copying the operative reference world into every decision record produces repetition, and every copy then needs custody of its own — a retention setting, a format, an office. Custody all the way down is not an architecture; it is the original problem, multiplied by the number of decisions>

The right unit is narrower. Call it the evidence slice: the exact evidence retrieved, the rule and configuration in force, the individual model responses, the routing, and the answer served — frozen together as a sealed historical event at the moment of decision. Later revision or removal of the source does not rewrite the event, because the event does not point at the source; it contains what was taken from it. This is still selective snapshotting, but at the slice rather than the corpus, and it makes Test 1 tractable in a way the corpus never could: the basis of the decision no longer depends on the live system that produced it, and the record is small enough to be kept for as long as the consequences last. I owe this correction to Srikanth Gaurav, who put the granularity question to the first version of this paper and had already built the narrower answer.

The slice also settles a distinction the accountability field has been circling. Chappidi, Cobbe, Norval, Mazumder and Singh have documented, from the practitioner side, what happens when accountability-driven record-keeping over-reaches: it collides with storage limitation, reshapes the organisations that do it, and provokes the resistance it was meant to prevent. Custody is not an argument for recording more. It is an argument for being exact about what must survive and for how long.

Preserving enough of the decision record to sustain reviewability need not mean retaining every underlying input indefinitely. The slice is what must survive. The corpus it was cut from is somebody else's record, on somebody else's clock.

Archival science has a name for much of what the slice contains. Paradata is information about the procedures and tools used to create and process information, and about the persons who carried those procedures out; a growing literature treats it as the documentation that keeps an AI-assisted process accountable after the fact (references 22 to 24). The evidence slice is paradata bound to a single decision at the moment it is made: the retrieval, the configuration, the model responses and the routing are its procedures and tools, and the office that answers for the decision is its person. What this paper adds is the clock. The paradata literature asks what must be documented and how it is preserved. Decision custody asks for how long — set by the consequence of each class of decision — and which office answers when the documentation fails. One boundary: the slice is the evidence for one decision. It does not replace the file that decision belongs to, or the order of that file, which are what let the slice be checked later and are the subject of the next paper in this series (reference 28).

That distinction has a limit, and the limit is the law. Custody justifies preservation; it cannot manufacture a lawful basis for it. Where a data-protection regime imposes storage limitation, or a person exercises a right to erasure, the institution's obligation to answer for a decision does not override the person's right to be removed from it. European law recognises the tension and partly resolves it — the right to erasure yields to processing necessary for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims — but “partly” is doing real work in that sentence. Custody will often fall within those exceptions. Often is not a basis. Each decision class has to be argued, and the argument has to be made before the request arrives, not after.

Where the argument fails, the shape of the answer is the tombstone: the decision chain is preserved, the person's data is removed from it, and the removal is itself recorded as an event with a date and an authority.

The institution can still show that a decision was made, on what rule, under what configuration, by what process, and that it answered for it — while no longer being able to say to whom. This is a real loss, and the paper should be honest about which tests it degrades. Test 1 survives in a weakened form: the decision can be reproduced as a process but not as an outcome for a named individual. Test 2 fails for that individual by construction, and rightly so, since the individual chose it. Test 3 is narrowed: the institution can still defend the rule it applied, but no longer its application to that person. Test 4 is untouched; there is still an office that answers for having applied it. A tombstone is a custody record with the person taken out and the obligation left in>

One consequence for practice follows. The evidence slice and the tombstone are design-time decisions. A system that consumes reference data live, treats configuration as settings, and stores the person's data inseparably from the decision cannot produce either after the fact.

Custody is cheap when it is a schema and ruinous when it is a reconstruction — and that asymmetry, not the regulation, is the reason to decide the slice before the first decision is made.

8. A constructed case: the licence that could not be explained

The following case is constructed. The failure pattern it describes — reference data drifting through a migration, a rule in force that was never versioned, the people who could interpret it gone, and no office defined to answer — is one I have met in more than one form across public-record, financial services and government programme environments. The institution and the particulars are invented, so that the reasoning can be set out without identifying anyone.

An authority licenses practitioners in a regulated profession. Its determinations are consequential in the ordinary sense — a refusal shapes a career, and both grants and refusals are relied upon by employers, insurers and courts for as long as the person practises. The consequence horizon is a working lifetime.

Application volumes rise. The authority introduces automated pre-assessment: applications are scored against published eligibility criteria and routed into clear-grant, clear-refuse and manual-review streams. The programme is governed to a standard most organisations would envy. There is a model card. Every refusal is confirmed by a human assessor. Logging is designed deliberately and retained well beyond the regulatory minimum. An internal audit finds nothing material.

Part of the scoring depends on an external equivalency reference — a table mapping foreign qualifications to domestic ones, maintained by a third party and refreshed on a published schedule. This is a sensible choice. Maintaining it in-house would be duplicative and worse.

Roughly two years later, an applicant who was refused writes to ask why. There is no lawsuit. She has since been licensed in another jurisdiction and simply wants to understand what happened. The authority sets out to reconstruct the determination and finds the following, in this order.

• The record exists, and it is good. The application, the timestamp, the inputs, the score, the routing decision and the assessor who confirmed the refusal are all present and intact.
• The inputs no longer mean what they meant. The equivalency reference has been refreshed eleven times since. The supplier publishes current state; it does not archive prior versions, and nobody asked it to. The qualification codes in the record are still legible, but what they mapped to on the day is gone. The authority can see exactly what was fed in and cannot say what it signified.
• The threshold in force cannot be established. Scoring configuration was adjusted twice during a platform migration eighteen months ago. Both changes were raised, tested, approved and deployed correctly. Neither was versioned in a way that binds a configuration to a date, because configuration was treated as settings rather than as evidence.
• The assessor has retired. Her successor can describe the process as it operates now. He cannot attest to how it operated then, and would be wrong to try.
• No office owns the answer. The authority has a registrar function, competent and long-standing — but its remit covers the licence, not the assessment that precedes it. The question of who answers for a pre-assessment made two years ago was never asked, because until someone asked it, it had no owner.

While assembling this, someone notices that the same conditions apply to every determination made in a fourteen-month window: roughly four thousand of them. That discovery, not the original letter, is the expensive part.

In the absence of evidence, the resolution is what resolutions look like. The authority reviews the affected cohort manually at significant cost, reverses a small number of determinations, reports the matter to its oversight body, and absorbs the finding. There is no misconduct anywhere in the story. Every control performed as designed. What failed was the assumption that a record of a decision is the same thing as the ability to account for it.

Note where the cause actually sits. Nothing in the failure originates in the pre-assessment capability, which was competently built and competently governed. It originates in two architecture decisions taken earlier and elsewhere: to consume reference data live rather than to snapshot it with the decision, and to treat scoring configuration as deployment settings rather than as evidence. Both were reasonable at the time by every criterion then applied. Neither was ever asked how long the decisions downstream of it would need to be defensible — which is the whole of the argument in one sentence.

What would have closed it was neither exotic nor expensive at the time. A consequence horizon stated for the decision class at design, which would immediately have shown a retention setting to be irrelevant to a career-length exposure. A requirement that the evidence slice in force — the reference entries actually retrieved, the rule and configuration applied, the score and the routing — be frozen with the decision as a sealed event, rather than the reference table consulted live (§7A). Configuration versioned as evidence rather than as settings. And last) an office named, with its remit extended to cover the assessment and not only the licence. Four choices at design time, none of them costly, in place of four thousand manual reviews.

9. Why compliance will not produce custody

It is tempting to expect regulation to close this, and it will not, for three reasons that are structural rather than a matter of the rules being immature.

First, regulation is written in system time — and it arrives on legislative time. The European framework requires automatic logging across a high-risk system's lifetime and sets a deployer retention floor of six months. Those obligations were due to apply from August 2026; in July 2026 the Digital Omnibus deferred them to December 2027 for stand-alone high-risk systems and to August 2028 for systems embedded in regulated products. Decisions made in the interval carry consequences for decades; the rule governing their evidence was postponed by sixteen months. Six months is, in any case, a coherent period for post-market monitoring and substantial-modification detection, which is what the provision is for. It is not, and does not claim to be, a period appropriate to answering a citizen in year twelve.

Second, accountability does not travel with the procurement, and the supply chain makes this worse rather than better. Buying a system from a supplier does not transfer the obligation to the supplier; the deploying institution remains answerable for retention, accessibility and the consequences of the output regardless of who built it. Cobbe, Veale and Singh have shown why this is now structurally hard: algorithmic systems are produced, deployed and used within supply chains of multiple actors tied together by flows of data, so that outcomes are driven by the working together of the chain rather than by any one party. Accountability frameworks built for a bilateral relationship between an actor and a forum do not capture that. Custody therefore usually weighs heavier on the buyer than on the seller, and no contract written on standard commercial terms will correct that imbalance unless someone specifically asks it to.

Third, and most consequentially, compliance is assessed at a point in time and custody is tested at a point of stress. Nothing in an annual compliance sign-off reveals whether a record will still be interpretable after two supplier generations, a platform migration and a reorganisation. The only honest test is the adversarial one, which is why the four tests are framed as questions an outsider would ask rather than controls an insider would evidence>.

10. What this asks of a board

Custody is a board matter rather than a technology matter, because it concerns liabilities that mature after the current management is gone. The questions below are deliberately answerable — each has a number, a name, or a date as its answer, and an evasive response is itself the finding.

The final question is the one that changes behaviour, because it converts an omission into a decision. Gaps consciously accepted and signed for are a legitimate posture; an authority may reasonably decide that a low-value routine classification does not warrant career-length custody. Gaps that exist because nobody computed them are something else, and they have a way of surfacing in the same quarter as everything else that was never computed.

11. The proof of the promise

Institutions have always known how to do this. Land registries carried determinations across regime change and fire. Courts produced records that could be read and relied upon by people separated from the judge by generations. Notarial systems solved answerability across borders and lifetimes with nothing but paper, a seal and a well-designed office. The competence is not new and it was never lost. It has simply not yet been asked of the systems now making the decisions.

What is new is the rate at which the machinery underneath turns over, and the ease with which an institution can mistake a supplier's memory for its own. Every model migration, every reference-data refresh, every configuration change is a small transfer of custody, and most of them are executed as change requests>. Enough of them, executed that way, and an organisation arrives at the position of being unable to account for its own conduct — not through misconduct, but through a series of individually reasonable technical decisions, each correctly documented, none of them asked the only question that mattered.

A service covenant states what an institution exists to do and what it undertook to the people it serves. Custody is what makes that undertaking checkable by someone who was not there and has no reason to take it on trust. One without the other is either a slogan or a filing cabinet.

The covenant is the promise; custody is the proof.

What changed in Revision 3

Revision 3 (November 2026) makes six kinds of change. It states the archival history of custody in §2 more exactly: what Jenkinson and Schellenberg each held, the origin of the continuum with Jay Atherton, and the custodial school's objection to the post-custodial reading, which the earlier versions passed over (references 19 to 21); and it adds a caution on the word custody, which in archival usage is narrower than the sense defined here. It corrects three points of fact: the European six-month floor applies to high-risk systems under Annex I as well as Annex III (§6); reviewability dates from Cobbe and Singh in 2020 (§5, reference 26); and Colorado's 2026 statute joins the survey of retention rules (§1, reference 25). It draws four boundaries more tightly: what reproduction reproduces (§3), which dependencies the evidence slice removes from the evidence horizon (§6), how the tests relate to one another (§7), and what a tombstone costs the defence test (§7A). It adds the Canadian law of electronic evidence to the defence test and limitation periods to the consequence horizon (§6, §7, reference 30). It connects the evidence slice to the paradata literature and to the file-level sealing of The Cold Standard (§7A, references 22 to 24 and 28). And last) it replaces loose phrasings — “stand behind” a decision, a “retention policy applied across a system” — and withdraws several universal statements that the evidence did not support. The definition, the tests, the two instruments and the constructed case are unchanged.

Revision 2 (September 2026) makes four changes to the paper as first published in August 2026. It corrects the status of the European retention floor, whose application was deferred after the first version was written (§1, §9, reference 16). It adds a recognition test before the four tests (§7) and a passage on the unrecognised decision (§6), both prompted by Srikanth Gaurav's public response to the first version. It adds §7A, replacing the first version's proposal to snapshot reference data with the evidence slice — a correction also owed to Gaurav — and setting out what custody may preserve against the limits of data-protection law. And last) it positions the paper against two works it should have engaged from the start: Kroll's traceability (2021) and the accountability-capture study of Chappidi, Cobbe, Norval, Mazumder and Singh (2025). The definition, the two instruments and the constructed case are unchanged.

Acknowledgements — Chris Norval (University of Aberdeen) read the first version and commented on its positioning against reviewability. Gillian Oliver (Monash University) and Barbara Reed read it from within the records continuum tradition and do not disagree with its reading of the continuum model. Srikanth Gaurav's public response to the first version prompted Test 0 and §7A. Revision 3 responds to comments from a reader in the archival tradition, who is not named here. None of them is responsible for what the paper does with their generosity, and all remaining errors are the author's.

References

1. Cobbe, J., Lee, M. S. A., & Singh, J., “Reviewable Automated Decision-Making: A Framework for Accountable Algorithmic Systems”, Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (FAccT ’21), 598–609. doi:10.1145/3442188.3445921
2. Cobbe, J., Veale, M., & Singh, J., “Understanding Accountability in Algorithmic Supply Chains”, Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency (FAccT ’23), 1186–1197. doi:10.1145/3593013.3594073
3. Cook, T., “Electronic Records, Paper Minds: The Revolution in Information Management and Archives in the Post-Custodial and Post-Modernist Era”, Archives and Manuscripts, 1994; reprinted Archives & Social Studies 1 (2007), 399–443.
4. European Union, Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 12, 18, 19 and 26(6). High-risk obligations originally applicable from 2 August 2026; application deferred by reference 16.
5. Ham, F. G., “Archival Strategies for the Post-Custodial Era”, The American Archivist 44, no. 3 (Summer 1981), 207–216.
6. International Organization for Standardization, ISO 14721 — Open Archival Information System (OAIS) Reference Model. First published 2003; current edition 2025.
7. Jenkinson, H., A Manual of Archive Administration, Oxford University Press, 1922.
8. Kaminski, M. E., & Urban, J. M., “The Right to Contest AI”, Columbia Law Review 121, no. 7 (2021).
9. Singh, J., Cobbe, J., & Norval, C., “Decision Provenance: Harnessing Data Flow for Accountable Systems”, IEEE Access 7 (2019), 6562–6574. doi:10.1109/ACCESS.2018.2887201
10. Society of American Archivists, Dictionary of Archives Terminology, entry: postcustodial.
11. Upward, F., “Structuring the Records Continuum, Part One: Post-Custodial Principles and Properties”, Archives & Manuscripts 24, no. 2 (Nov 1996), 268–285.
12. Wei, P., & Shu, W., Preserving Decision Sovereignty in Military AI: A Trade-Secret-Safe Architectural Framework for Model Replaceability, Human Authority, and State Control, arXiv:2604.20867, 2026.
13. Kumar, S., The Intent Bottleneck: When AI Compresses Delivery, Strategy Becomes the Constraint, Zenodo, 2026. doi:10.5281/zenodo.21943397
14. Chappidi, S., Cobbe, J., Norval, C., Mazumder, A., & Singh, J., “Accountability Capture: How Record-Keeping to Support AI Transparency and Accountability (Re)shapes Algorithmic Oversight”, Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society 8(1) (AIES ’25), 554–566. doi:10.1609/aies.v8i1.36570; arXiv:2510.04609
15. Kroll, J. A., “Outlining Traceability: A Principle for Operationalizing Accountability in Computing Systems”, Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (FAccT ’21), 758–771. doi:10.1145/3442188.3445937
16. European Union, Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689; published in the Official Journal 24 July 2026, in force 27 July 2026. Application of high-risk obligations deferred to 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems).
17. European Union, Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 5(1)(e) and 17.
18. United States, Equal Credit Opportunity Act, Regulation B, 12 CFR § 1002.12(b) — preservation of records for 25 months.
19. Atherton, J., “From Life Cycle to Continuum: Some Thoughts on the Records Management–Archives Relationship”, Archivaria 21 (Winter 1985–86), 43–51.
20. Schellenberg, T. R., Modern Archives: Principles and Techniques, University of Chicago Press, 1956.
21. Duranti, L., “Archives as a Place”, Archives and Manuscripts 24, no. 2 (Nov 1996), 242–255.
22. Cameron, S., Franks, P., & Hamidzadeh, B., “Positioning Paradata: A Conceptual Frame for AI Processual Documentation in Archives and Recordkeeping Contexts”, ACM Journal on Computing and Cultural Heritage 16, no. 4 (2023), Article 75, 1–19. doi:10.1145/3594728
23. Cameron, S., Franks, P., Huvila, I., & Mooradian, N., “Navigating Accountability: The Role of Paradata in AI Documentation and Governance”, Journal of Documentation 81, no. 4 (2025), 906–926. doi:10.1108/JD-01-2025-0009
24. Feliciati, P., & Duranti, L., “The Responsible Use of Artificial Intelligence in Archives Through the Use of Paradata”, JLIS.it 16, no. 2 (2025), 1–9. doi:10.36253/jlis.it-636
25. Colorado General Assembly, Senate Bill 26-189 (2026), repealing and replacing Senate Bill 24-205 (the Colorado Artificial Intelligence Act); signed 14 May 2026; applies to consequential decisions made on or after 1 January 2027.
26. Cobbe, J., & Singh, J., “Reviewable Automated Decision-Making”, Computer Law & Security Review 39 (2020), 105475. doi:10.1016/j.clsr.2020.105475
27. International Organization for Standardization, ISO 15489-1:2016 — Information and documentation — Records management — Part 1: Concepts and principles.
28. Kumar, S., The Cold Standard — A Fixed Reference for a Record That Won’t Stop Moving, Zenodo, 2026. doi:10.5281/zenodo.22073326
29. OpenAI, “Deprecations”, API documentation; Anthropic, “Model deprecations”, API documentation. Published retirement schedules for hosted models, consulted November 2026.
30. Canada Evidence Act, R.S.C. 1985, c. C-5, sections 31.1 to 31.8; Canadian General Standards Board, CAN/CGSB-72.34-2024, Electronic records as documentary evidence.

AI-assistance disclosure> This paper was drafted and refined with AI assistance. The arguments, the definitions, the instruments and the constructed case are the author's own, and all sources cited above were verified against their primary records before publication. © 2026 Sanjeet Kumar. Views are the author's own and do not represent any employer.