AI decommissioning is the withdrawal of an AI system from operational use, including the handling of unfinished work, dependencies and retained information. Turning off inference completes only the part that stops new model outputs.
A decision record connects an outcome to the information and actions used to reach it. Its required retention can extend beyond the life of the service that produced it. The exit process therefore separates stopping the service, transferring custody and disposing of information.
Shutdown and disposal have different authority
For Canadian federal government and ministerial records, section 12(1) of the Library and Archives of Canada Act requires written consent for disposal from the Librarian and Archivist or an authorized delegate. Ending a supplier contract is not that consent. Library and Archives of Canada Act, section 12.
Personal information used for an administrative purpose also carries retention and disposal duties under section 6 of the Privacy Act. Retention supports an individual’s opportunity to obtain access; disposal follows applicable regulations and ministerial directives or guidelines. Neither duty makes shutdown a universal deletion date. Privacy Act, section 6.
The practical task is to classify the information and apply the relevant retention and disposition rules. Keeping every artifact indefinitely does not solve that task. Deleting every artifact with the application does not solve it either.
A record must remain interpretable
A file can survive while its meaning is lost. An outcome labelled approved is ambiguous if it does not identify what was approved, which case it concerns or whether it was a model proposal or an authorized decision.
A usable record connects the outcome to the relevant inputs, system version, action history and human decisions. The exact contents depend on the process being documented. Reproducing the model’s output and understanding how the institution reached its decision are different objectives; neither is guaranteed by storing a model identifier alone.
The receiving custodian also needs usable formats, field definitions, identifiers and access arrangements. An encrypted export without its decryption key is not a usable transfer. A record available only through the terminated vendor account remains dependent on the service being withdrawn.
Unfinished work still needs a destination
Withdrawal can leave queued cases, accepted requests and tasks waiting for human review. Each item needs a final state or an identified destination. Otherwise a successful shutdown of infrastructure can conceal abandoned service work.
Take a service receiving 1,000 cases a day. Before shutdown, automation performs one processing step for 700 cases and staff perform that step for 300. If automation is removed and the staff capacity for that step remains 300, unfinished work grows by 700 cases a day. The existence of a manual procedure does not establish capacity to handle the incoming volume.
The exit test uses the receiving environment
An exit test checks whether the institution can retrieve and interpret a retained case after access to the old service is removed. It also checks how pending work reaches the replacement process and who owns requests for access, correction or review.
That test establishes more than the presence of an export file. It tests the intended operating state after withdrawal. Decommissioning is complete only when the specified service work and information obligations have an owner outside the retired system.