1. What was issued—and what was not

On August 21, 2026, NARA issued memorandum AC 11.2026 and seven pages of guidance applying the existing Federal Records Act to current AI use. It covers inputs, outputs, data, audit trails, software and related materials. It does not create a new AI-governance regime or decide privacy, security, ethics or e-discovery policy.

The scope is U.S. federal. It does not directly bind private companies, Saudi entities or other governments, and it does not turn every prompt in ChatGPT or Claude into a federal record. NARA explicitly says use of an AI platform does not itself create one; creation, maintenance and use in agency business determine the result.

  • New statute? No—application of existing law.
  • Every chat a record? No—context decides.
  • Delete on demand? Not when an approved schedule is required.
  • Global rule? No—but vendor requirements can travel through contracts.

2. The practical test: from trace to record

An agency asks whether material was used for official business, relied on in a decision, circulated, integrated into a system, kept under agency control or needed for a legal or business obligation. An uncaptured exploratory prompt may be a non-record; a prompt used to document the adequacy of a FOIA search may belong in the case file.

NARA's likely-record examples include an AI meeting summary that becomes the official minutes, a saved output used for agency work, an audit trail captured for an investigation, procurement and platform-operations documentation, copies of records used for training, and algorithms, models or code written by or for the agency. Evidential function—not file extension—is the hinge.

3. Automatic retention is not legal classification

A vendor may retain every query, but passive storage alone does not establish a federal record. If security staff capture one employee's AI trail and use it in an investigation, it may become part of the investigative file. That transition demands evidence of who captured what, when, for which purpose and in which version.

The reverse is equally important: a delete-chat control is not disposal authority. AI material that meets the record definition requires a NARA-approved schedule. Some records may qualify as transitory—needed for under 180 days without financial or legal obligation—or intermediary, used to create a subsequent record. The label is not enough; the item must meet GRS 5.2 or an agency-specific schedule.

4. Six tests to put into the RFP and contract

If a product cannot export a conversation with attachments and metadata in a usable format, an agency may not be able to move its record into an approved repository. If an answer can be regenerated without preserving model version and settings, the agency may not be able to show what a decision-maker saw. If administrator logs omit identity, time and use context, personal traces become hard to separate from investigative evidence.

These requirements should be tested in acceptance, not left as marketing claims. Export a complete case, freeze deletion under legal hold, apply different retention rules, inspect the change history and demand a deletion certificate at expiry. The contract should also state where backups live, who controls records at termination and whether vendor model-improvement copies are included.

  • Complete export: prompt, attachments, output, time and identity.
  • Evidence stability: model version, settings and references where available.
  • Selective retention: by purpose and record class, not one global timer.
  • Legal hold: pause disposal without breaking the remaining policy.
  • Portability: transfer into an independent records repository.
  • Deletion proof: auditable coverage of primary and backup copies.

5. This is not a command to keep everything

Universal retention can amplify privacy risk, cost and discovery volume while burying significant records. Universal rapid deletion can erase decision or investigation evidence. A better design maps each use case to material class, record owner, retention authority, repository and the event that suspends or triggers disposal.

GAO's baseline shows why this cannot wait: across 11 selected agencies, reported generative-AI use cases rose from 32 in 2023 to 282 in 2024, while all reported AI cases nearly doubled from 571 to 1,110. These are not 2026 figures and do not represent the whole government, but they show the expanding records surface before this guidance arrived.

6. A Saudi lesson without importing U.S. law

The Federal Records Act should not be presented as a Saudi obligation. Yet the engineering separation of purpose, classification, retention, destruction and audit has a local parallel. Saudi Arabia's Data Sharing Policy requires documented purpose, classification, storage, protection and destruction controls, and requires government entities to keep data-sharing requests and related documentation for five years after termination.

The transferable lesson is architectural: do not procure a public-sector assistant or enterprise agent until the organisation defines what becomes official evidence, who owns it, and how it is exported, protected and destroyed. Actual periods and obligations come from the relevant Saudi laws, policies and contracts—not from NARA's memorandum.