NYDFS Part 500 Data Disposal Rules for LLM Prompt Logs and Agent Memory

What Part 500 states and what it leaves to interpretation

As of November 2026, section 500.13 is headed "Asset management and data retention requirements." Paragraph (a) requires each covered entity, as part of its cybersecurity program, to implement written policies and procedures designed to produce and maintain a complete, accurate and documented asset inventory of its information systems. Paragraph (b) requires policies and procedures for secure disposal, on a periodic basis, of NPI that is no longer necessary for business operations or other legitimate business purposes.

Two exceptions apply to paragraph (b). Disposal is not required where the information must be retained by law or regulation, or where targeted disposal is not reasonably feasible because of the manner in which the information is maintained. The disposal duty also refers to NPI identified in section 500.1(k)(2) and (3), not to every category of NPI. Classification of any AI artifact should be made against those provisions, and the reasoning recorded.

DFS's industry letter on AI cybersecurity risks, issued in October 2024, states that it adds no new requirements beyond Part 500. It observes that AI products often process substantial amounts of NPI and that holding NPI in quantity raises risk. It also says covered entities must dispose of NPI that is no longer necessary, "which includes NPI used for AI purposes." That is the closest official statement to the topic of this page. Neither the regulation nor the letter names prompt logs, agent memory or vector stores.

Treat AI artifacts as ordinary data stores in scope

The practical reading, and it is interpretation, is that an LLM application is a set of information systems like any other. A prompt typed by an employee, a document retrieved to ground an answer, or a parameter passed to a tool can contain customer, account or business-related information. If that content is written to a log, an index or a memory store, the store belongs in the 500.13(a) inventory and its contents need a disposal rule.

The difficulty is dispersion. The same interaction may leave copies in application logs, an agent framework's state, a vector database and a model provider's systems. Existing retention schedules were usually written for databases, file shares and email, so these stores often have no owner and no schedule. The asset inventory is the natural place to fix that. Each AI store should map to a named owner, a classification and a disposal rule, including stores hosted by third parties.

Because the AI letter ties data minimization to limiting the NPI at risk of exposure, the cheapest disposal is the record that was never written. Controls that keep NPI out of persistent stores reduce what must later be found and deleted.

Mapping each AI artifact to a classification and disposal decision

The table below is an interpretive working model, not regulatory text. Retention periods should be set by documented business purpose and, where relevant, a legal retention requirement.

• Prompt and response logs: Classification: potentially NPI, because users and models both introduce content. Retention: short, tied to a stated operational purpose. Disposal: scheduled deletion, with redaction before write where possible. Evidence: schedule, deletion run records, redaction decisions.
• Retrieved context: Classification: inherits the classification of the source record. Retention: should not outlive the interaction unless captured in a log. Disposal: governed by the log or cache that holds it. Evidence: a record of what was retrieved and whether it was persisted.
• Tool-call payloads: Classification: potentially NPI in parameters and returned results. Retention: store only the fields needed for the stated purpose. Disposal: scheduled, with payload bodies separated from metadata. Evidence: payload handling rule and enforcement records.
• Vector stores and embeddings: Classification: derived from source documents, so treat as the source's class. Retention: follows the source. Disposal: may be hard to do record by record. Evidence: documented rebuild or deletion approach, or a reasoned reliance on the feasibility exception.
• Persistent agent memory: Classification: potentially NPI, since summaries can carry customer details across sessions. Retention: explicit expiry per memory type. Disposal: expiry jobs and per-subject deletion. Evidence: expiry configuration and execution records.
• Provider-side retention: Classification: depends on what was sent. Retention: set by the provider's terms, which must be understood. Disposal: contractual and verified through due diligence. Evidence: contract terms and diligence file under section 500.11.

Reconciling audit-evidence retention with minimization

Compliance teams are pulled two ways. Examiners and internal audit want a durable record of what an AI system did. Section 500.13(b) wants NPI gone once it is no longer needed. The regulation resolves part of this itself: information that is required to be retained by law or regulation falls outside the disposal duty. The difficulty is that this exception needs a documented legal basis. Wanting to keep audit records is not, by itself, that basis, so each evidence retention period should cite what requires it.

A workable design separates the evidence record from the content. Keep the decision, timestamp, policy applied, actor and a reference or hash, and keep raw prompt text out of the evidence store. Evidence then supports review without becoming a second repository of NPI. Where raw content must be retained for a defined reason, give it its own schedule and owner.

The feasibility exception deserves careful treatment. It may bear on aggregated or embedded stores such as vector indexes, but no official source says how it applies to them. If you rely on it, record why targeted disposal is not feasible, what compensating step you take, such as periodic rebuild, and who approved the position.

Evidence an examiner would likely expect

No official source lists examiner expectations for AI stores, so the following is interpretation based on what the regulation requires you to maintain. Expect to show a current asset inventory that includes AI stores, written disposal policies and procedures, and the classification rationale for each artifact type. Expect to show the schedule applied to each store, evidence that disposal ran, and the basis for any exception. For third-party AI providers, section 500.11 requires policies covering the security of NPI held by providers, including due diligence and contractual protections on access controls, multi-factor authentication and encryption.

Access to AI log and memory stores holding NPI is also relevant. DFS's checklist describes limiting and reviewing access privileges for users with access to NPI, including third-party service providers, with annual review required beginning May 1, 2025.

The strongest position is often to show NPI was never persisted. This is where runtime enforcement helps. Trussed enforces policy in the execution path, at the level of individual interactions and tool calls, and can allow, redact or block content before it reaches a log, index or memory store. It runs as a self-managed deployment in the customer cloud, with configurable retention and data residency. The audit-ready evidence it generates is mapped to NYDFS. Trussed does not dispose of data held in third-party systems, so provider-side retention still depends on contracts and diligence. Its depth is greatest in insurance, a regulated financial sector, and it makes no claim of financial-services deployments beyond that.