Even when a vendor does the work, the organisation remains responsible for the records created in doing it. Contracts should specify record creation, access, retention, portability, and end-of-contract transfer.
Outsourcing work does not outsource the recordkeeping duty; the organisation remains responsible for records a vendor creates on its behalf. Contracts should cover record creation, access, retention, export and portability, and end-of-contract transfer, and avoid lock-in that prevents exporting records and metadata.
The public office or local authority remains responsible for records created on its behalf. Contracts should secure access, retention, portability, and transfer of those records and their metadata at the end of the arrangement.
IAR turns terms like this into working practice: assets classified against your disposal authority, stewarded by position, and ready to evidence.