Almost every AI compliance programme we review is pointed at the model: which one, hosted where, trained on what, under whose terms. The index sits beside it holding a full second copy of the organisation's documents, split into chunks, embedded into vectors, cached, replicated, and in most builds carrying none of the permissions that governed the originals.
That is the layer a subject access request reaches, the layer an erasure request has to clear, and the layer almost nobody has inventoried.
None of these are satisfied by a statement about which model you use. Each one touches a specific part of the retrieval stack, creates a duty there, and is discharged by an artefact you either produce at ingestion and query time or cannot produce at all.
GDPR Articles 17 and 15 reach chunks, embeddings, answer caches, reranker stores and the backups that feed rebuilds. The evidence is a deletion manifest naming each store with a measured propagation time, and an index inventory keyed to source that can enumerate chunks by data subject rather than by document.
Article 32 lands on retrieval itself. The filter has to run inside the retrieval boundary, before the vector search, against the asker's live entitlements, and the artefact that proves it is a negative-entitlement test suite which must return zero results and fails the build when a forbidden document scores.
Article 50 applied on 2 August 2026 and reaches the output path wherever retrieved content is surfaced as a generated answer, so you need a disclosure, a citation path back to source and a record of what was shown. Residency needs a topology diagram covering index, cache, logs and inference.
Name the owner, the source corpora, the lawful basis, the residency and the retention period, with the same formality a production database gets. Nothing in Section 02 lands until it does.
Entitlements resolved at query time against the live permission system and applied before the search runs. Filtering after the fact still means the system read what it should not have.
List every store holding a derivative, give each a propagation path and a measured time to effect, then test the chain end to end against a real identifier.
Corpus version, chunk identifiers, retrieval scores, entitlement set and model version recorded together at query time. This is the one item that cannot be added retrospectively.
No. Regulation (EU) 2026/1744 deferred stand-alone Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, and that deferral covers Chapter III only. Article 50 transparency applied on 2 August 2026, prohibitions have bound since 2 February 2025, and GDPR was never deferred at all.
Treat it as such. An index built from personal data is personal data, and the whole point of an embedding is that the original content can be retrieved through it. A deletion that clears the source row and leaves the vector standing will return the content verbatim, with a citation, to anyone who asks the right question.
It arrives on roadmaps somewhere behind reranking, which is the wrong classification. A retriever that ignores entitlements is an access-control failure producing a readable, citable, confidently worded disclosure. Classify it as an Article 32 obligation and it moves up the backlog, which is where it belongs.
Whatever the index holds about that person, which means you need a query path that enumerates chunks by data subject rather than by document. Most stacks can only answer by document, so the request becomes a manual trawl.
An index inventory keyed to source is the thing that makes the answer routine.
This report maps the regimes, the duty each creates and the evidence that discharges it, so start here if you are scoping the problem. Retrieval Architecture: An Engineering Reference is the companion catalogue, numbering seven control families and the artefact that proves each one, and it is where implementation begins.
CISOs, DPOs and heads of data who own the answer when a regulator or a data subject asks what the index holds. It assumes you have a retrieval system in production and have not yet put it on the asset register.
Drop your details and we'll send Retrieval Architecture Under Regulation straight to your inbox - no spam, unsubscribe anytime.
Point a two-week sprint at your retrieval stack and find out what it still returns after a deletion, and what it returns to someone who should not see it. SECTION 7 - FAQ - 5 to 8 questions
Book a retrieval review