The rule is older than the software, and it does not care about the software
Most technology vendors meet records retention the same way: a contracting officer's representative asks, three months before go-live, which records schedule the system implements. The team looks at each other. Nobody has heard the phrase. What follows is usually four to eight weeks of unplanned work, because the answer cannot be produced from the codebase. It has to come from the agency, and the system has to be changed to match it. This piece is about getting that sequence right the first time.
The governing statute is the Federal Records Act, codified across 44 U.S.C. chapters 21, 29, 31, and 33. The definition that decides whether it applies to your system sits at 44 U.S.C. 3301: a federal record is "all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business" and preserved or appropriate for preservation as evidence of agency organization, functions, policies, decisions, procedures, operations, or activities, or because of the informational value of the data in it. The Presidential and Federal Records Act Amendments of 2014 (Pub. L. 113-187) rewrote that definition to add "regardless of form or characteristics," which closed the last argument that a database row, an S3 object, a ticket thread, or a model inference log sits outside the statute because it is not a document.
NARA's implementing regulations are at 36 CFR Chapter XII, Subchapter B. That subchapter runs from Part 1220 through Part 1239 and covers creation and maintenance (Part 1222), scheduling (Part 1225), implementing disposition (Part 1226), unlawful or accidental destruction (Part 1230), transfer to the National Archives (Part 1235), and electronic records management (Part 1236). A vendor building a system that holds agency data will spend most of its time in Parts 1222 and 1236.
Who the obligation lands on
Read literally, the Federal Records Act binds agencies. That reading is correct and useless, because the agency discharges its obligation by pushing terms into your contract. The mechanism is 36 CFR 1222.32, "How do agencies manage records created or received by contractors?" Its opening requirement is that agency officials responsible for administering contracts must safeguard records created, processed, or in the possession of a contractor or a non-Federal entity. The section then tells the agency to ensure contractors performing agency functions create and maintain records documenting those activities, and to specify in the contract both Government ownership of those records and their delivery to the Government.
Two clauses of 1222.32 catch engineering teams by surprise. First, electronic records and background electronic data specified for delivery must be accompanied by sufficient technical documentation to permit understanding and use of the records and data. A dump of Parquet files with no schema dictionary does not satisfy that. Second, contracts requiring creation of data for the Government's use must specify delivery of background supporting data or other records with reuse value, not only the final product. If your pipeline produces a clean output table from twelve intermediate stages, the agency may be entitled to the intermediates.
There is no single governmentwide FAR records-management clause. Agencies handle it through their FAR supplements, and the texts are close cousins. The Department of Transportation clause at 48 CFR 1252.239-91, prescribed at TAR subpart 1239.74, is a fair representative: records in contractor custody may not be removed or destroyed except in accordance with an approved agency schedule and with the written consent of the agency Records Officer; the contractor must notify the contracting officer within two hours of discovering an inadvertent or unauthorized disclosure; contractor employees who touch records must complete agency-provided training; and the whole clause flows down to subcontractors. The Department of Labor uses 48 CFR 2952.204-70 and the Department of Education uses 48 CFR 3452.204-70 to similar effect. Read the one in your contract rather than the one in this article.
The seven controls a system has to implement
36 CFR 1236.10 is the section your architecture is graded against. It names seven records management controls that must be built into the electronic information system or into an external recordkeeping system, and its language maps cleanly onto engineering work:
Reliability. Controls ensuring a full and accurate representation of the transactions, activities, or facts attested to, dependable in subsequent transactions.
Authenticity. Controls protecting against unauthorized addition, deletion, alteration, use, and concealment.
Integrity. Controls, and the regulation names audit trails specifically, ensuring records are complete and unaltered.
Usability. Mechanisms ensuring records can be located, retrieved, presented, and interpreted.
Content. Mechanisms preserving the information within the record itself as produced by its creator.
Context. Cross-references to related records showing the organizational, functional, and operational circumstances around the record.
Structure. Controls maintaining the physical and logical format of records and the relationships between data elements.
36 CFR 1236.10 Controls · How Often a Modern Stack Already Satisfies One
Editorial weighting from public sources and practitioner reading; illustrative, not a measured statistic.
The pattern is consistent. Ordinary good engineering delivers content and integrity almost for free. Context and structure are where systems fail, because a normalized relational schema expresses relationships in foreign keys that vanish the moment records are exported as flat files. 36 CFR 1236.12 extends the same thinking into design time, requiring that preservation considerations be built into the development and implementation of the system rather than retrofitted, and 36 CFR 1236.58 governs the transfer metadata that has to accompany records when they leave.
You do not get to decide when data is deleted
This is the single hardest concept for a commercial software team to absorb. Under 44 U.S.C. 3303a, federal records may only be disposed of under a disposition authority approved by the Archivist of the United States. Two kinds exist. The General Records Schedules (GRS) are governmentwide and cover records common to all agencies. Agency-specific schedules cover everything else and are submitted to NARA for approval. Until a schedule item covers a body of records, those records are unscheduled and cannot be destroyed at all.
A retention setting in your admin console is therefore not a product feature. It is the implementation of a legal instrument, and its value comes from the agency Records Officer, not from a customer preference. A ninety-day TTL on a log bucket that a schedule requires you to hold for thirty months is a violation that your own infrastructure-as-code committed automatically, every night, without anyone reading the diff.
Several retention clocks usually run at once over the same system, and the longest one wins:
| Clock | Authority | Typical period |
|---|---|---|
| Contract audit records | FAR subpart 4.7; Audit and Records clause at FAR 52.215-2 | 3 years after final payment, longer if terminated or under claim |
| Program records in the system | Agency records schedule approved under 44 U.S.C. 3303a | Set item by item; permanent items transfer to NARA |
| Common administrative records | NARA General Records Schedules | Varies by GRS item; governmentwide |
| Cybersecurity event logs | GRS 3.2, Information Systems Security Records (Transmittal 33) | Up to 30 months, aligned to OMB M-21-31 logging tiers |
| Full packet capture | GRS 3.2 | At least 72 hours |
| Anything under litigation or claim | FAR 4.703(b) and legal hold | Until the matter is finally resolved |
GRS 3.2 deserves a note because it lands directly on infrastructure teams. Transmittal 33 was the first substantive update to the governmentwide schedule for information systems security records since 2014, and it put explicit floors under two categories our engineers now design for on every federal build: full packet capture held at least 72 hours, and cybersecurity event logs retained up to 30 months. Those numbers line up with the tiered logging maturity model in OMB M-21-31, which asked agencies for roughly twelve months of active storage plus eighteen months in cold storage. If your platform ships with a default log retention of thirty or ninety days, it is out of the box non-compliant on a federal deployment.
The artifacts that have to exist
A records program is proved by documents. Intentions do not survive an assessment. Before an assessment, our team expects to hand over the following, and we build the list into the delivery schedule rather than the closeout:
- A record inventory. Every data class the system creates, receives, or stores, named in business terms the Records Officer recognizes.
- A crosswalk from each data class to a specific schedule item. GRS number or agency schedule item, cited exactly, with the disposition instruction quoted.
- A written disposition procedure. Who authorizes destruction, what evidence is produced, and how the agency Records Officer's written consent is captured.
- Destruction certificates or an equivalent log. Showing what was destroyed, under which authority, on what date, by whom.
- Legal-hold mechanics. A demonstrable technical override that suspends automated deletion, plus proof it was tested.
- Technical documentation for delivered records. Schema dictionaries, code lists, format specifications, and the relationships between elements, per 36 CFR 1222.32.
- An export and transfer path. Records leaving in a format and with the transfer metadata NARA accepts, tested end to end at least once before go-live.
- Training records for cleared staff. The agency-provided records training most supplement clauses require, tracked per person.
- Flow-down evidence. The same clause in every subcontract and a signed acknowledgment back.
If you are converting anything, the digitization rules apply
Vendors doing scanning, OCR, or format migration have their own subparts. 36 CFR 1236 Subpart D (sections 1236.30 through 1236.36) covers digitizing temporary federal records; Subpart E (sections 1236.40 through 1236.56) covers permanent records and is stricter. The structure is the same in both: digitize to the standards in the rule, validate the output against those standards, and manage the resulting digital records under the general electronic-records requirements in Subparts A through C.
The validation clause is where projects get rework. Agencies may build their own validation process or use a third party, and the process can be project-based or agency-wide, but the process itself must be documented, and that documentation must be retained for the life of the process or the life of any records digitized under it, whichever is longer. In practice this means the validation tooling you wrote for a scanning contract becomes a record with a retention period potentially measured in decades. It also means "we spot-checked a sample and it looked fine" is not a validation process.
The deadline that reshaped this work was OMB and NARA memorandum M-19-21, "Transition to Electronic Records," issued June 28, 2019, and updated by M-23-07 on December 23, 2022, which moved the target dates to June 30, 2024. After that date NARA stopped accepting analog transfers, and agencies must digitize permanent analog records before transferring them. Every backlog conversion contract now traces to that policy.
Common findings
Retention is configurable per tenant, with no authority behind the setting
The product exposes a retention slider because commercial customers wanted one. On a federal deployment that slider lets an administrator authorize a destruction that only the Archivist can authorize. The fix is to bind the setting to a named schedule item, make it changeable only by a role tied to the Records Officer, and log every change as a record in its own right.
Soft delete is treated as deletion, or hard delete is treated as disposition
Both directions fail. A soft-deleted row still exists and still has to be produced under FOIA or discovery, so it has not been disposed of. A hard delete without a destruction certificate satisfies the schedule but leaves no evidence that it did. Systems need three distinct states: active, cut off and pending disposition, and destroyed with an authority citation.
Backups and replicas outlive the records they copy
Cross-region replication, point-in-time snapshots, and log shipping to an observability vendor all create copies that the disposition routine never touches. Where the copy is a convenience copy of a record still being retained, this is a housekeeping problem. Where the original was destroyed under a schedule and the copy persists, it is a records problem with a real answer required in writing.
Nobody can produce a single record with its context
The system can run any query an analyst wants but cannot assemble one case file with its attachments, decision history, and cross-references in a form a person outside the system can read. That is a direct failure of the usability and context controls in 36 CFR 1236.10, and it is usually discovered during the first FOIA request rather than during testing.
What getting it wrong costs
Start with the statutory exposure, because it is sharper than most vendors expect. 44 U.S.C. 3106 requires an agency head to notify the Archivist of any actual, impending, or threatened unlawful removal or destruction of records and, with the Archivist, to initiate action through the Attorney General for their recovery. That is a referral path into the Department of Justice. 18 U.S.C. 2071 makes willful concealment, removal, mutilation, or destruction of a record filed in a public office a criminal offense carrying a fine and up to three years' imprisonment, with additional consequences for custodians. Agency records-management clauses cite these provisions directly at contractors.
Where the Privacy Act is in play the exposure extends further. Under 5 U.S.C. 552a(m)(1), when an agency contracts for the operation of a system of records to accomplish an agency function, the contractor and its employees are treated as employees of the agency for purposes of the Act's criminal penalties. FAR 24.104 and the clauses at FAR 52.224-1 and 52.224-2 carry that into the contract.
The commercial cost is more mundane and more common. A records finding lands in the same assessment package as security findings and delays the authorization to operate. Go-live slips a quarter. The remediation is engineering work that was never priced: adding an authority field to every table, rebuilding export with transfer metadata, writing and testing a disposition job, retrofitting a hold mechanism. On a fixed-price task order that comes out of margin. On a follow-on competition it comes out of the past-performance narrative, where the customer describes the delay in a CPARS entry that every future evaluator reads.
A practical sequence for the first time
The order matters more than the speed. Everything downstream depends on an artifact that only the agency can give you, so ask for it in week one.
First-Time Records Compliance · Delivery Sequence
Two habits make the difference over the life of a program. Treat every disposition action as an event that writes its own auditable record, so the evidence exists before anyone asks for it. And treat the schedule crosswalk as a living configuration artifact stored in version control next to the code, so that when the agency updates a schedule item the change shows up in a pull request instead of an email thread.
Where AI systems sharpen the problem
Machine learning adds record classes that no schedule anticipated when the system was designed. Prompts and completions from an assistant used to draft agency decisions are recorded information made or received in connection with public business. So are retrieval indexes built from case files, training sets assembled from agency data, evaluation results used to justify a deployment, and model cards documenting a system's known limits. Some of that will map to existing items. Some will need a new schedule item, which means a conversation with the Records Officer months before launch.
The vector store is the sharpest edge. Embeddings derived from records are copies of those records in another representation, and deleting a source document without reindexing leaves its content retrievable. Any system where disposition is real needs the index treated as a downstream copy with the same clock, and needs deletion to propagate on the same schedule as the source. Our engineers design that propagation in at the pipeline level, because bolting it on after an index has grown to a few hundred million vectors is the expensive version of the same work.
Bottom line
Records retention is not a compliance checkbox layered over a finished system. It is a set of design constraints from 36 CFR 1236.10, a legal authority that only the agency can supply under 44 U.S.C. 3303a, and a body of evidence that has to be produced continuously rather than assembled at the end. Firms that ask the Records Officer for the schedule in week one ship on time. Firms that discover the question during the assessment lose a quarter. The regulation has been stable for years, the citations are public, and the work is entirely plannable once someone on the team has done it before.
Frequently asked questions
It applies to the records, wherever they sit. If the agency creates or receives federal records in your product, the agency's obligations attach to that data and reach you through the contract under 36 CFR 1222.32 and the agency's records-management clause. The hosting model does not change the analysis. What decides it is ownership and control of the records, which the agency keeps.
Only the applicable records schedule answers that, and it varies by record class from a few years to permanent. Ask the agency Records Officer for the GRS items and agency-specific schedule items that cover the data in scope. Separately, FAR subpart 4.7 requires contract audit records for three years after final payment, longer under termination, appeal, or claim.
No. Under 44 U.S.C. 3303a records may be disposed of only under a disposition authority approved by the Archivist, and most agency clauses add a requirement for the written consent of the agency Records Officer. A customer-initiated purge request has to be routed to that authority, not executed.
GRS 3.2, Information Systems Security Records, sets floors including at least 72 hours for full packet capture and up to 30 months for cybersecurity event logs, consistent with the tiered logging model in OMB M-21-31. Commercial defaults of 30 or 90 days do not meet that, so plan the storage and cost for roughly twelve months hot plus eighteen months cold.
If the output is intended to replace or serve as the record, yes. 36 CFR 1236 Subpart D covers digitizing temporary records and Subpart E covers permanent records, and both require digitizing to the stated standards, validating the output, and documenting the validation process, with that documentation retained for the life of the process or of any records digitized under it, whichever is longer.