Audit trails are the least glamorous thing on this site and the most load-bearing. Every other promise — explainable grading, bias checks, defensible decisions — reduces to a question about records: can you produce, months or years later, what you actually did and why. If the answer is no, the rest was decoration.
Why the record is the defence
Two provisions, one on each side of the Atlantic, put the burden on you rather than on the person complaining.
GDPR Art 5(2): "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1." Note what that asks. Not comply — demonstrate. It is an evidential burden, and it is continuous.
42 U.S.C. § 2000e-2(k)(1)(A)(i): once a plaintiff shows a practice causes disparate impact, liability follows unless "the respondent fails to demonstrate that the challenged practice is job related for the position in question and consistent with business necessity." The burden of production and persuasion shifts to the employer.
Evidence assembled after a claim lands is weak in three separate ways. It is impeachable as self-serving reconstruction. It may be inadmissible — or sanctionable — if it displaced originals you were obliged to keep. And most fundamentally, it cannot show what you actually relied on at the moment of the decision, which is the fact in issue.
That is the whole case for logging at decision time rather than reporting afterwards. A rationale written when the grade was produced is evidence. The same words written by your lawyer eighteen months later are argument.
What must be logged
| Source | Requirement |
|---|---|
| AI Act Art 12 | High-risk systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system", with traceability appropriate to the intended purpose. |
| AI Act Art 26(6) | Deployers must keep the logs for at least six months, where under their control. |
| AI Act Art 11 + Annex IV | Provider technical documentation, drawn up before market and kept current. |
| GDPR Art 5(2) | Accountability — be able to demonstrate compliance. |
| GDPR Art 30 | Records of processing: purposes, categories of data subjects and data, recipients, transfers, and "where possible" erasure time limits and security measures. |
| 29 CFR 1607.4(A) | Records disclosing the impact of selection procedures by race, sex and ethnic group. An affirmative, continuous duty — it does not wait for a charge. |
| 6 RCNY § 5-303 | NYC: publish the bias-audit summary — impact ratios, selection rates, data source, count in unknown categories — and keep it posted for at least 6 months after the tool's latest use. |
Art 30(5) exempts organisations under 250 employees — but the exemption collapses where processing is not occasional, risks data subjects' rights and freedoms, or involves special categories. Recruitment screening is systematic and non-occasional by definition. In practice, a small employer running an AI screener is inside Art 30, not outside it.
How long to keep it
There is no universal answer, and any vendor who gives you one number is telling you about their product rather than about the law. The same record — a rejected candidate's assessment — attracts materially different periods depending on where you hire.
| Jurisdiction | Period | Where it comes from |
|---|---|---|
| Germany | ~6 months from rejection | Derived, not decreed: AGG § 15(4) gives 2 months to assert a claim in writing; ArbGG § 61b(1) gives 3 months from that assertion to file suit; plus ~1 month for service. The reasoning is what transfers — not the number. |
| France | 5 years from the post being filled | CNIL's HR retention référentiel marks this an obligation, grounded in Art. L.1134-5 Code du travail, for discrimination-claim evidence. |
| US federal | 1 year, then indefinite on hold | 29 CFR 1602.14 — one year from the record or the personnel action, whichever is later; then until final disposition once a charge is filed. |
| California | 4 years | FEHA ADS regulations extended retention and expressly cover ADS data. |
| EU AI Act | 6 months minimum | Art 26(6), deployer-held logs. A floor, not a recommendation. |
"CNIL says two years." The two-year figure applies to the talent pool (vivier de candidats), runs from last contact, and is a recommendation. The binding French period for the rejected-candidate file is 5 years from the date the post was filled. These are different records with different clocks, and conflating them under-retains the one that matters.
"Art 5(1)(e) lets you archive for litigation." It doesn't. That article's archiving proviso covers public-interest, research and statistical archiving under Art 89(1) — not defending yourself. The correct basis for defensive retention is Art 17(3)(e): the erasure right does not apply where processing is necessary "for the establishment, exercise or defence of legal claims." Cite that one.
Resolving the conflict
Storage limitation pushes retention down. Defending a discrimination claim pushes it up. These genuinely conflict, and the resolution is not to pick a side — it is to stop treating retention as a single binary between "kept" and "deleted".
CNIL's model is the clearest published example: every purpose is split into base active (the working copy, available to the people running the process) and archivage intermédiaire (a restricted archive, reachable only by named people, only for the defined purpose). The candidate file doesn't get deleted at the end of the recruitment — it gets demoted.
The insight worth stealing: storage limitation can be satisfied by narrowing access and purpose, not only by erasure. That is what makes a five-year discrimination archive compatible with Art 5(1)(e) — the data isn't still sitting in the recruiter's search index, it is in a box only the legal team can open, for one stated reason.
The clock you can't predict
29 CFR 1602.14's second limb is the one that breaks naive retention policies. Once a charge is filed, the employer "shall preserve all personnel records relevant to the charge or action until final disposition" — and "relevant" reaches beyond the complainant to similarly-situated employees and to the application forms and test papers of unsuccessful applicants for the same position.
The retention clock is not knowable in advance. A tidy one-year deletion job that fires three weeks after a charge lands has destroyed evidence you were legally obliged to keep — and it did so automatically, which is not a defence.
Worse, the hold reaches people who never complained: the model inputs, scores and rankings of the entire comparator pool for that role. If your system can't place a hold across a cohort — not just a record — you don't have a retention policy, you have a timer.
What makes a trail defensible
Keeping data is necessary and not sufficient. A log that could have been edited proves less than one that couldn't.
- Tamper-evidence. Append-only recording, cryptographic hashing, and — the specific control that matters — users must not be able to delete or modify their own event logs. A hiring manager who can edit the record of their own decision has produced nothing.
- Trusted timestamping. In the EU this is the one with real legal weight: eIDAS (Regulation (EU) 910/2014), Arts 41–42 give qualified electronic time stamps a presumption of accuracy of the date and time. That presumption is worth more in a dispute than any internal claim about your clocks. RFC 3161 is the underlying protocol.
- Clock synchronisation. Timestamps that disagree across systems are worse than none — they invite an argument about your competence rather than about the decision.
- Logging controls. ISO/IEC 27001:2022 A.8.15 (Logging) is the relevant control in the current revision — it consolidates the 2013 standard's A.12.4.1–.3. A.8.16 (Monitoring activities) is new in 2022, not a renumbering, and A.8.17 covers clock synchronisation.
- Completeness across the cohort. Per § 2000e-2(k)(1)(B)(i), if the elements of your decision process "are not capable of separation for analysis", the whole process can be analysed as one practice. Granular logs are what keep the analysis — and therefore the defence — separable. The full argument.
WORM storage is a technique, not a hiring mandate. The term's regulatory home is SEC Rule 17a-4(f) — financial services. Nothing in employment law requires it, and implying otherwise is the kind of borrowed authority a knowledgeable reader will catch.
NIST SP 800-92: the current published version is still the 2006 Guide to Computer Security Log Management. Revision 1 (Cybersecurity Log Management Planning Guide) is an initial public draft from October 2023 — comments closed, still in processing. Cite the 2006 document as current; cite r1 as a draft, if at all.
Where HireBeep fits
HireBeep logs the decision as it makes it, because that is the only moment the record is worth anything. Every answer, grade and decision is timestamped and exportable, and the written rationale is produced by the same act that produces the grade rather than reconstructed on request.
Which is the honest version of the pitch: 100% auditable decisions isn't a feature that was added. It is what you get when the logging is the product rather than a report on top of it. What you still owe is the policy — the retention period you can defend for your jurisdictions, and the reasoning behind it. Our compliance team can work through that with you.
- GDPR Art 5 — text; Art 17 — text; Art 30 — text
- Regulation (EU) 2024/1689 (AI Act), Arts 11, 12, 26 — EUR-Lex
- AGG § 15(4) (English) — gesetze-im-internet.de
- ArbGG § 61b — gesetze-im-internet.de
- CNIL, Référentiel: durées de conservation — gestion des ressources humaines (2 April 2026, updated 20 May 2026) — PDF
- 29 CFR 1602.14 — GovInfo
- 29 CFR 1607.4 (UGESP) — Cornell LII
- 42 U.S.C. § 2000e-2 — Cornell LII
- NYC DCWP adopted rules, 6 RCNY subch. T — rule text (PDF)
- NY State Comptroller, audit of DCWP enforcement of Local Law 144 (2 December 2025) — osc.ny.gov
- NIST SP 800-92 (2006, current) — csrc.nist.gov; Rev. 1 initial public draft — csrc.nist.gov