In short
- If you need to be able to find AI conversations later, you have to set that up in advance, tool by tool. Don't keep everything forever: decide on a purpose, a retention period and who may look.
- It only works in business editions. Whatever staff do in personal accounts, you will never find again.
- Copilot and the Gemini app use retention rules and eDiscovery, Gemini in Workspace has had export only since 22 October, and ChatGPT and Claude Enterprise work through a Compliance API.
Should you keep the conversations your staff have with AI? If you need to retrieve them in a dispute, an internal investigation or a data breach, yes, and you have to configure that beforehand. What was never captured cannot be requested afterwards. At the same time, prompts often contain personal data, which you may not keep for longer than necessary.
The main condition: every tool handles this differently, and only in its business editions. Below you will find, per tool, what is captured, where you manage it and what is still missing, followed by the questions to settle with your lawyer or data protection officer (DPO). This is not legal advice.
Based on the providers' documentation, read on 27 October 2026. We have not tested the settings ourselves in every tool.
Why keep AI conversations, or why not?
The GDPR sets no fixed retention period. According to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), you decide the period yourself, keep personal data for as short a time as possible and record why you chose that period. If legal proceedings are under way, you must keep the data (Autoriteit Persoonsgegevens, in Dutch).
Keep too little and you cannot show what was asked and answered through AI. Keep too much and you build up a growing collection of conversations containing customer and staff data. Lawyers at Reed Smith describe that as a privacy and security risk, and point out that most prompts are not business records (Reed Smith). In the Dutch public sector the Archives Act applies as well: lawyer Cornelis van der Sluis argues that a draft suggested by Copilot can be an archival record (Binnenlands Bestuur, in Dutch).
How do you retain AI conversations in each tool?
| Tool | What you can retrieve, and where | Condition | What is missing |
|---|---|---|---|
| Microsoft 365 Copilot | Prompts and responses; retention, eDiscovery and audit in Purview | Exchange Online mailbox | Referenced files only with a separate retention label |
| Gemini app | Prompts and responses; retention rules, holds, search and export in Vault | Workspace with Vault | Attached media and Gems |
| Gemini in Workspace | Prompts, responses, attachments; JSON export in Vault | Conversation history on; Business Plus, Enterprise and others | Retention rules and holds to follow |
| ChatGPT Enterprise | Conversations and logs through the Compliance API | Enterprise or Edu | OpenAI keeps logs for 30 days only |
| Claude Enterprise | Chats, files, projects and sessions through the Compliance API | Enterprise | Custom period of at least 30 days |
Microsoft 365 Copilot. Prompts and responses from Copilot and Copilot Chat are stored in a hidden folder in the user's mailbox. A retention policy on the "Microsoft Copilot experiences" location keeps or deletes them. eDiscovery lets you search them, place them on hold and export them (Microsoft Learn). Microsoft warns that what users see in Copilot says nothing about what has been retained or deleted, so check with eDiscovery. A delete-after-one-day policy can take sixteen days before the message is gone for good (Microsoft Learn). Check the Purview service description to see which features your licence includes.
Gemini. Google distinguishes between the Gemini app and Gemini in Gmail, Docs, Sheets, Slides, Drive and Meet. For the app, Vault supports retention, holds, search and export. For Gemini in Workspace, Vault can only export (Google). That export arrived on 22 October, filtered by user or organisational unit and date range. It only contains conversations created while conversation history was on. You set that history and automatic deletion per organisational unit in the Admin console (Google Workspace Updates). Google's other October updates are covered in Google AI news, October 2026.
ChatGPT. The Compliance Platform is for Enterprise customers only; the current documentation also mentions Edu. You connect the logs to your eDiscovery, DLP or SIEM system. OpenAI keeps them for 30 days, so for anything longer you collect them continuously and store them yourself (OpenAI, OpenAI). Inside ChatGPT a chat stays until the user deletes it or a workspace retention policy removes it. OpenAI schedules a deleted chat for permanent deletion within 30 days (OpenAI). If you use Purview, it can bring in ChatGPT Enterprise through a connector, with pay-as-you-go billing (Microsoft Learn).
Claude. The Compliance API gives Claude Enterprise access to an activity feed and to the chats, files and projects themselves, plus sessions in Cowork, Claude Code and other surfaces. The CSV audit log in the settings contains no content (Anthropic). By default Claude keeps data indefinitely. Owners can set a custom period of at least 30 days, which does not cover Claude Design among others (Anthropic). Purview has a connector here too, still in preview (Microsoft Learn).
How do you set it up?
- List your tools and editions, and agree whether personal accounts are allowed. A template for those agreements is in Using AI safely.
- Decide the purpose: disputes, internal investigations or regulatory oversight. That determines what you keep and for how long.
- Choose a period per tool and write down your reasoning, as the Dutch regulator expects.
- Switch it on: a retention policy in Purview, Gemini conversation history, a continuous export for ChatGPT, a retention period in Claude. If you are still rolling out Copilot, include it in your rollout plan.
- Test it. Hold a conversation, find it, export it and check that deletion works.
- Limit who can look. In Purview's activity explorer, prompt text is only visible with a separate role (Microsoft Learn). Record who gets it.
Which questions should you settle with your lawyer or DPO?
- Which retention period fits our purpose, and how do we justify it?
- Do we keep everyone's conversations, or only for roles where it is needed?
- How do we inform staff, and who may read their conversations?
- Does the works council need to be involved?
- What do we do with conversations covered by legal proceedings?
- Do we use AI systems that the AI Act classifies as high-risk? Then, once those rules apply, you as a deployer must keep the automatically generated logs for at least six months, to the extent they are under your control (AI Act, Article 26). That does not apply to ordinary chat use. What the AI Act does ask of every organisation is covered in the EU AI Act for SMEs.
When does retention not help?
On ChatGPT Business, Claude Team or personal accounts you do not have the Compliance APIs described above. Agree instead that anything that matters does not live only in the chat: a decision, a piece of advice or a text you send goes into your own document system. The same holds for the other tools. A retained prompt is no substitute for a proper record.
Sources
- Autoriteit Persoonsgegevens. Bewaren van persoonsgegevens (in Dutch), accessed 27 October 2026.
- Google Workspace Updates. Google Vault now supports filtered exports for Gemini in Workspace, 22 October 2026.
- Google Workspace. Supported services and data types in Vault, accessed 27 October 2026.
- Microsoft Learn. Use Microsoft Purview to manage data security & compliance for Microsoft 365 Copilot, 1 May 2026.
- Microsoft Learn. Learn about retention for Copilot and AI apps, updated 25 June 2026.
- Microsoft Learn. Use Microsoft Purview for ChatGPT Enterprise, 1 May 2026, and for Anthropic Claude (Enterprise), 4 August 2026.
- OpenAI. OpenAI Compliance Platform for Enterprise Customers, Chat and file retention in ChatGPT and ChatGPT Work admin FAQ, accessed 27 October 2026.
- Anthropic. Compliance API and Configure custom data retention controls for Enterprise plans, accessed 27 October 2026.
- Regulation (EU) 2024/1689 (AI Act), Article 26.
- Reed Smith. AI for legal departments: Managing eDiscovery and data retention risks with Microsoft Copilot, 20 June 2024.
- Binnenlands Bestuur. Moeten ambtenaren Copilot-berichten archiveren? (in Dutch), 19 September 2025.
