English 
French 
OAIS (Open Archival Information System), defined in ISO 14721, is often dismissed as theory; but it is in fact a survival toolkit for regulated organisations. It is not about software or vendors. It is about building a preservation lifecycle that can withstand audits, disputes, and technology changes. This article explains why OAIS matters to your organisation and shows you how to assess whether your archive is actually preserving records or simply storing files.
What OAIS Is
OAIS stands for Open Archival Information System and is defined in ISO 14721. It is not a product specification or a shopping list of features. Rather, it is a conceptual framework that describes the core functions a long-term archive must perform to keep information findable, understandable, and trustworthy over decades. Whether you build an archive in-house or choose a vendor, OAIS gives you the language to describe what a preservation system must do, and the checklist to verify that it is actually doing it.
Why OAIS Matters in Regulated Environments
Regulators and auditors typically do not care about a vendor’s user interface or feature list. They care about:
- whether integrity can be demonstrated, not just claimed;
- whether retention and deletion are controlled and auditable;
- whether access is traceable (who saw what, when);
- whether records remain readable and verifiable after technology changes.
OAIS matters because it forces you to think of the archive as a lifecycle, not a repository. A repository is a place where files sit until someone needs them. A lifecycle is a series of active functions that prove the records are still what you say they are, and that you are still caring for them. Regulators and auditors want to see evidence of a lifecycle.
The Six OAIS Functions: Practical Mapping
OAIS defines six core functions. Here is what each one means in practice for your organisation.
1. Ingest: Controlled Intake
Goal: Accept information into the archive in a controlled, repeatable way.
In practice this means:
- Controlled intake from multiple sources (email, portals, DMS, business applications) with consistent validation rules
- Completeness checks (are all files present, are they readable, do they contain metadata)
- Format identification and validation (what is this file, can we read it in 20 years)
- Signature and evidence checks where applicable
Why it matters: If you ingest randomly without checks, you end up with a collection of orphaned files rather than a defensible archive. Ingest is where you prove the record is authentic and complete.
2. Archival Storage: Protected Preservation
Goal: Protect archived content against corruption, loss, or tampering.
In practice this means:
- Redundancy across multiple storage locations and systems
- Fixity checks (verifying that stored files have not changed silently; checksums recalculated over time)
- Integrity monitoring for hardware failures, media degradation, or unauthorised changes
- Evidence mechanisms and audit trails for every storage action
Why it matters: File corruption is silent. A file might be unreadable, but you would not know until you tried to access it. Archival storage means proving continuously that your records are still intact.
3. Data Management: Keeping Records Discoverable and Explainable
Goal: Manage metadata and indexes so records remain discoverable and explainable.
In practice this means:
- Structured metadata models that capture what the record is, where it came from, why it matters, and how long it must be kept
- Retention attributes linked to legal or operational requirements
- Classification and file plans that reflect your business context
- Searchable indexes that survive technology changes
Why it matters: Without good metadata, records become orphaned. A file with no context is a legal liability. Data management is what turns bare files into records with meaning.
4. Access: Controlled Retrieval
Goal: Provide controlled retrieval without compromising trust.
In practice this means:
- Read-only access models (prevent casual modification or deletion)
- Role-based and attribute-based access controls (auditors see only what they are permitted to see)
- Complete audit logs for every access event (who, what, when, why)
- Controlled exports that prove chain of custody and integrity
Why it matters: If auditors can access files but you cannot prove who accessed what, your archive fails under scrutiny. Access must be auditable, not just permissible.
5. Preservation Planning: Staying Relevant as Technology Changes
Goal: Keep information usable as technology and standards evolve.
In practice this means:
- Format validation (monitoring which file types are becoming obsolete)
- Migration planning (how will you convert old formats to new ones, and how will you prove the conversion is authentic)
- Evidence renewal for digital signatures (as cryptographic standards weaken, signatures must be re-timestamped or re-sealed)
- Algorithm and standard monitoring (tracking which algorithms are losing trust)
Why it matters: Preservation is not passive. Technology changes fast; you must plan ahead or risk losing access. A Word 97 document is not readable on modern systems without interpretation; that interpretation is a preservation action, and it must be auditable.
6. Administration and Governance: Making the Archive Defensible
Goal: Ensure the archive is auditable, compliant, and defensible.
In practice this means:
- Clear policies, roles, and separation of duties (so no single person can silently delete records)
- Audit configuration (logging all system actions and providing auditors with read-only access)
- Retention and legal hold workflows (defining who can delete what, and when)
- Controlled deletion and proof of disposal (proving that deletion happened as authorised, and nothing was left behind)
Why it matters: Without governance, an archive is just a black box. Auditors need to be able to understand the rules, see the logs, and confirm that the archive followed its own policies.
SIP, AIP, DIP: What These Terms Mean (And Why They Matter)
OAIS uses the concept of ‘information packages’ to communicate what is being preserved. These three are fundamental to understanding a preservation lifecycle:
SIP (Submission Information Package): What a client or system submits into the archive. The SIP includes the files, metadata, and any supporting evidence (signatures, timestamps). It is checked and validated at ingest.
AIP (Archival Information Package): What the archive stores long-term. The AIP includes the content, metadata, and preservation metadata (integrity checks, provenance, version history). It is what auditors and lawyers want to see.
DIP (Dissemination Information Package): What is delivered to an authorised user. The DIP is often a controlled view or subset of the AIP; a lawyer might see only the final signed version, not all drafts or access logs.
A practical analogy: think of a court evidence room. The SIP is the bag of evidence you hand to the clerk. The AIP is the sealed, catalogued box with an audit log of every person who has touched it. The DIP is the controlled view you give to the judge, with sensitive parts redacted. If a vendor cannot clearly explain what sits in each package and how integrity and context are preserved, you likely have a repository, not a preservation system.
OAIS Readiness Checklist
Use these six questions to assess whether your organisation is ready for OAIS-aligned preservation, or to evaluate a vendor.
- How do you prove integrity over time (fixity checks, evidence mechanisms, audit logs)?
- What is your plan for format obsolescence? Can you migrate files and still prove authenticity?
- How do you preserve provenance and business context? Can you explain to an auditor why this record matters and where it came from?
- How do retention and legal holds work? Who decides what gets deleted, and what proof exists that deletion happened?
- How do auditors access records without getting broad system access? Is there a read-only, traceable way?
- For signature-heavy records, what is your approach to evidence renewal as cryptographic standards evolve?
If you cannot answer these questions clearly, your organisation is not yet ready for long-term preservation, or the solutions you are relying on are not properly aligned with preservation principles.
How Docbyte Vault Aligns with OAIS
Docbyte Vault is designed from the ground up as an OAIS-aligned preservation system. It is eIDAS-certified and built to support all six OAIS functions in a way that survives audits and disputes.
Ingest: Vault accepts records from multiple channels (DMS, email, portals, business applications) with automatic validation, format identification, signature verification, and metadata enrichment.
Archival Storage: Vault stores records with cryptographic fixity checks, redundant storage across geographically dispersed locations, continuous integrity monitoring, and immutable audit trails.
Data Management: Vault provides structured metadata management, retention attributes linked to regulatory and business rules, searchable indexes, and full provenance capture.
Access: Vault offers role-based access controls, audit-ready retrieval, read-only access for sensitive records, and complete traceability of who accessed what and when.
Preservation Planning: Vault monitors formats, plans for migration, supports evidence renewal for digital signatures, and tracks cryptographic algorithm strength over time.
Administration: Vault enforces policy-driven governance, maintains immutable audit logs, supports legal holds and retention workflows, and provides proof of disposal for deleted records.
Because Vault is eIDAS-certified, the preservation controls themselves are auditable and compliant with trust service requirements. This means you do not have to spend internal resources proving that preservation is happening; the qualification carries that burden.
Next Steps
If your organisation must defend records under audit or in a dispute, OAIS provides the framework. If you are currently relying on a document management system or general-purpose storage for long-term preservation, you are exposed. Vault helps you move from passive storage to active, auditable preservation.
