The pace of AI hardware development is unlike anything the IT industry has seen before. Organisations that were running NVIDIA A100 clusters two years ago are now under pressure to move to newer architectures. GPU deployments that cost hundreds of thousands of dollars are being retired to make way for chips that offer dramatically more performance per dollar.
This is good news for AI capability. It is a growing problem for data security and e-waste compliance.
What is actually stored on retiring AI hardware
AI servers and GPU clusters hold more sensitive data than most people realise. Training jobs, inference workloads, and fine-tuning runs process enormous volumes of data. That data lives in VRAM during processing, but it also lives on the NVMe drives, SSDs, and storage arrays attached to those systems. Model weights, training datasets, customer records, proprietary model architectures, and sometimes patient or financial data depending on your industry.
When a server leaves your building, all of that leaves with it, unless someone has done the work to properly destroy what is on the drives.
The data destruction gap
NIST 800-88 Rev. 2 is the recognised standard for media sanitisation. It distinguishes between three levels: clear (software overwrite), purge (more thorough sanitisation, often cryptographic), and destroy (physical destruction that renders the media unrecoverable). For the NVMe drives common in modern AI servers, a simple software reimage often does not meet the purge threshold.
Yet many IT teams handling a rapid hardware refresh reimage a drive and mark the asset as disposed. That approach does not satisfy a strict reading of NIST 800-88, and it will not hold up under scrutiny if a data breach occurs downstream.
Victorian compliance obligations compound the risk
Victoria’s e-waste landfill ban has been in effect since 1 July 2019. Servers, GPUs, storage arrays, and networking equipment all fall within its scope. You cannot legally dispose of them in general waste or a skip bin. The question is not only whether you are complying with the ban, but whether you have documentation that proves you did.
For organisations that process personal information under the Privacy Act 1988, APP 11 adds a second obligation: take reasonable steps to destroy or de-identify personal information when it is no longer needed. Retiring hardware without adequate sanitisation creates a direct breach exposure, regardless of the dataset size involved.
The residual value aspect
Here is the part that often surprises IT teams. Some of the hardware being retired from Australian AI infrastructure in 2026 still commands meaningful secondary market prices. A properly sanitised, well-documented GPU or accelerator card can return real residual value, offsetting a portion of your next upgrade cost. Skipping formal ITAD does not just create compliance risk. It frequently leaves money on the table as well.
What EWV brings to AI hardware retirement
EWV handles end-of-life IT asset retirement for Victorian organisations, aligned with AS/NZS 5377 for e-waste handling, NIST 800-88 Rev. 2 for data destruction, and ISO 14001 and ISO 27001 aligned environmental and information security processes. Full certification is on our roadmap. Every engagement includes chain-of-custody documentation and a certificate of destruction so you have the audit trail your regulators and clients expect.
For a typical AI hardware refresh, that means NIST 800-88 media sanitisation at the appropriate level, an itemised asset register, CO2e reporting for your ESG obligations, and residual value recovery where the secondary market supports it, with compliant recycling for everything else.
The AI hardware refresh cycle is not slowing down. Each new generation will push more end-of-life equipment out of organisations with more sensitive data on it. Getting the disposal process right before your next refresh is far simpler than responding to a breach notification or a regulator query after the fact.
Get in touch with EWV to discuss your upcoming IT asset retirement.