Baseline Security Controls: Retire

AI system retirement refers to the secure decommissioning of any model that will no longer be available for use. Although often overlooked, retirement is a critical phase in the AI lifecycle, because models—regardless of modality or architecture—may retain sensitive data, metadata, or intellectual property. Improperly retired systems can expose training data, proprietary model artifacts, or internal infrastructure details, creating regulatory, privacy, and security risks.

Key steps to decommission a model include

1. documenting the rationale for retiring the model, including which components are affected (e.g., model, datasets, pipelines, logs, derived artifacts, etc.)
2. notifying internal or external users about the planned retirement and specifying the date of deactivation
3. deactivating and isolating the model in its production or operational environment (i.e., where it is running), ensuring that it is no longer reachable via APIs, schedulers, or embedded applications
4. maintaining, archiving, or securely deleting model artifacts in line with applicable regulatory, legal, and contractual requirements.

Although deletion might seem the simplest approach to retiring models, the choice between retention and destruction is context dependent. Legal, regulatory, and operational requirements often mandate artifact retention or deletion. For example, models and their data may be retained for litigation or regulatory purposes (e.g., institutional review board data storage requirements), while other regulations, such as the European Union’s General Data Protection Regulation (GDPR) or the state of California’s Consumer Privacy Act Regulations (CCPA), may require secure deletion of certain data to avoid compliance violations and potential penalties.

For examples of high-level decommissioning policies and customer-facing procedures, see OpenAI’s deprecation documentation,^⁠1 DataBrick’s retirement and maintenance policy,^⁠2 or Microsoft Azure’s Model Retirement concepts.^⁠3

Risk Reduction Summary

The prioritized foundational security controls represent proactive, high-impact measures informed by such resources as Google’s Secure AI Framework (SAIF) tool,⁴ Deploying AI Models Securely,⁵ Guidelines for Secure AI System Development,⁶ and a broader literature review of core principles grounded in established cybersecurity and risk management practices. These controls are designed to reduce risk early in the AI lifecycle—before systems face real-world threats—and can be implemented and tested prior to deployment. Their relevance across architectures, training methods, and use cases makes them foundational: They provide a baseline layer of resilience and protection that supports secure AI design, development, deployment, operation, and maintenance.

While many security controls are proactive, not all are foundational. Some protections—such as model-specific red-teaming or customized adversarial training—require specialized infrastructure, organizational maturity, or detailed system knowledge and technical expertise. These advanced controls are valuable but should build on fundamental protections. Foundational controls, by contrast, offer early-stage risk mitigation, are essential regardless of technical stack or threat model, and can be implemented, tested, and iterated with relatively low overhead.