AI System Decommissioning

Objective

Ensure that AI system decommissioning follows a documented procedure addressing dependent system continuity, data retention/deletion, model artifact handling, vendor termination assistance, documentation preservation, and stakeholder communication.

Applicability

AI types

LLM, Agentic AI, Traditional ML, Computer Vision, Generative AI, Multi-modal, Recommender

Deployment models

SaaS, Self-hosted, Hybrid, Edge, Embedded

Lifecycle stages

Retirement

Risk domains

Model, Data

Regulatory regimes

EU AI Act, ISO 42001, GDPR, Banking

Company size

MidMarket, Enterprise

Rationale

Decommissioning is the lifecycle stage most often skipped or fudged. Live but unused models accumulate as risk surface (drift, regulatory exposure, third-party dependencies). Personal data embedded in model weights or vector stores requires explicit handling under GDPR/PIPEDA. EU AI Act Article 11 implicitly requires lifecycle traceability through retirement. A documented decommissioning process closes the lifecycle and preserves audit evidence.

Control narrative

The organization maintains an AI Decommissioning standard requiring, for each retirement: dependent-system impact analysis (which systems consume outputs of this one); successor system or alternative process plan; data retention/deletion per AI-CTRL-015; model artifact handling (archive or destruction with method documented); vendor termination assistance and deletion certificates; documentation preservation (Model Card, Datasheet, evaluation history archived); inventory status change to 'Retired' with date; stakeholder communication (internal users, customers, regulators where applicable). Decommissioning is signed off by the AI Governance lead and the business owner. For EU AI Act high-risk systems, decommissioning records are retained 10 years.

Test of Design

Procedures

1. Obtain the AI Decommissioning standard and confirm coverage of required activities.
2. Confirm sign-off authority and post-decommissioning record retention.
3. Confirm integration with AI-CTRL-001 (inventory status), AI-CTRL-002 (data provenance), AI-CTRL-015 (retention), AI-CTRL-004 (vendor).
4. Confirm stakeholder communication requirements.

Inquiries

• Who triggers a decommissioning?
• How are dependent-system impacts identified?
• How are vendor deletion certificates obtained and stored?
• How are model artifacts archived vs destroyed?

Inspections

• AI Decommissioning standard.
• Sample decommissioning records.
• Inventory status change history.

Test of Operating Effectiveness

Procedures

1. For the audit period, obtain the population of AI systems decommissioned.
2. For a sample, confirm decommissioning records are complete per the standard.
3. Confirm inventory status was updated.
4. Confirm data deletion / archival per the standard and AI-CTRL-015.
5. Confirm vendor termination assistance and deletion certificates obtained.
6. Confirm dependent-system impact analysis was performed and addressed.
7. Confirm sign-off authority matches the standard.

Sample-size guidance

Evidence requirements

Required

• AI Decommissioning standard PDF/Word · At fieldwork
• Decommissioning records for sampled systems PDF/Workflow · Per sample
• Inventory status change records System export · Per sample
• Deletion certificates and archive records PDF/system · Per sample

Supporting

• Stakeholder communications Email/portal · Per sample

Retention: 10 years (EU AI Act high-risk); 7 years (regulated); 3 years (otherwise)

Framework mappings

Related controls

• AI-CTRL-001

  AI System Inventory and Classification

• AI-CTRL-002

  Training Data Provenance and Lineage

• AI-CTRL-015

  Data Retention and Deletion for AI Systems

References

• ISO/IEC 42001:2023, clause 8.3
• NIST AI RMF — MANAGE function
• EU AI Act Article 11 — Technical documentation lifecycle