Annex AA: Example Conforming Deployment

ARCS v1.0

STANDARD ANNEX AA

March 2026 | Informative Annex

Classification: Tier 1 / Standard Annex / Informative

Standard Annex AA: Example Conforming Deployment

Illustrative Level 4 / Level 5 Implementation (Informative)

This annex provides an illustrative example of an AI system deployment evaluated for ARCS conformance. The example demonstrates how the requirements of this standard may be applied to a realistic enterprise deployment. This annex is informative. It does not define additional requirements.

AA.1 System Description

System name: Example Enterprise AI Assistant. Operator: Example Corporation. Deployment modes: enterprise web interface, API integration, agent toolchain workflow, reduced-retention API mode. Components: AI model provider, application server, enterprise tenant storage, cloud infrastructure provider, feedback/review system, monitoring/logging system, document storage system, backup/archive system, third-party tool integrations.

AA.2 Conformance Level

Declared: Level 4 (Governance Grade) for enterprise deployment. Level 5 (Full Surface Governance) for agent workflow configuration.

AA.3 Record Class Inventory (Section 6)

Identified classes: prompt text, model output, system prompts (where retained), API request/response logs, monitoring logs, safety/abuse logs, feedback submissions, review samples, evaluation dataset entries, agent planning traces, tool call inputs/outputs, retrieval queries, memory updates, generated documents, exported text, stored notes, downstream database entries, backup snapshots, archive copies. All hidden and derived records included.

AA.4 Record Surface Map (Section 7)

---

Surface System Location Custodian Retention Review Hold ID Type

S-01 Model Provider Provider 30d Yes Yes Provider storage

S-02 API Gateway Provider Provider 30d Yes Yes logging

S-03 Tenant DB Tenant Operator 90d No Yes storage

S-04 User Device Local device User User-defined No No

S-05 Browser Browser User Session No No cache

S-06 Monitoring Cloud Cloud 90d Yes Yes monitoring

S-07 Feedback Review Provider 1y Yes Yes service

S-08 Eval Dataset Evaluation Provider 1y Yes Yes pipeline

S-09 Doc System Enterprise Operator Policy No Yes docs

S-10 Email Email server Operator Policy No Yes

S-11 Backup Backup Cloud 90d No Yes storage

S-12 Archive Cold storage Operator 1y No Yes

S-13 Plugin Plugin Vendor Unknown Unknown Unknown vendor

S-14 Agent Agent engine Provider 30d Yes Yes Runtime

S-15 Tool Output Tool vendor Vendor Unknown Unknown Unknown

S-16 Support Ticket Provider 1y Yes Yes system

---

Unknown surfaces (S-13, S-15) treated as present per Section 7.4. Surface map versioned.

AA.5 Custody Surface (Section 8)

Custodians: user, enterprise operator, model provider, cloud provider, plugin vendor, tool vendor, monitoring vendor, archive provider. Custody classified as fragmented. Deletion authority differs by surface.

AA.6 Retention Controls (Section 12)

---

Record Default Backup Archive Feedback Class Copy

Chat log 30d 90d 1y N/A

API log 30d 90d 1y N/A

Feedback copy 1y 1y 2y 1y

Monitoring log 90d 1y 3y N/A

Agent trace 30d 90d 1y N/A

Derived Policy Policy Policy N/A document

---

AA.7 Preservation Override (ARCS-PV)

Legal hold procedure: hold flag set in configuration (no code changes required), deletion suspended across all operator-controlled surfaces, backups preserved, archives preserved, provider notified via contractual mechanism, vendor notified where feasible. Hold log maintained with date, scope, initiator, basis. Automated deletion suspended during hold period.

AA.8 Conformance Statement Summary

Conformance statement prepared per Annex I. Level 4 for enterprise deployment. Level 5 for agent workflow. Unknown surfaces: two (plugin vendor, tool vendor). Fragmented custody: yes.

ARCS v1.0 | Annex AA: Example Conforming Deployment | March 2026 | Informative