EU AI Act Documentation Requirements

Article 11 of the EU AI Act (Regulation 2024/1689) obliges providers of high-risk AI systems to draw up technical documentation that must be available before the system is placed on the market or put into service. The documentation must contain all elements listed in Annex IV and demonstrate that the system complies with the requirements in Chapter III, Section 2. This includes a general system description, documentation of the risk management system under Article 9, details on training and validation data, performance metrics and information on human oversight. The documentation must be kept up to date, particularly when the system undergoes substantial modifications.

Annex IV of the EU AI Act defines the minimum contents of technical documentation in several sections: (1) General description of the AI system including intended purpose, provider details, versioning and interaction with hardware and software. (2) Detailed description of system elements and the development process, including algorithms, model architecture, design decisions, data governance (collection, preprocessing, labelling) and computational resources used. (3) Information on monitoring, operation and control, in particular performance and accuracy metrics, known risks and reasonably foreseeable misuse. (4) Details on compliance with accessibility requirements. (5) Description of the conformity assessment procedure and applied harmonised standards or common specifications.

The documentation requirements under Article 11 apply to all high-risk AI systems within the meaning of Article 6 of the EU AI Act. This covers AI systems used as safety components of products falling under EU harmonisation legislation (Annex I), as well as AI systems in the areas listed in Annex III, including biometric identification, critical infrastructure, education, employment, law enforcement and migration. For general-purpose AI models (GPAI), additional documentation requirements under Article 53 apply, with specific elements set out in Annexes XI and XII.

Technical documentation must be prepared before a high-risk AI system is placed on the market or put into service. The obligations under Chapter III, Section 2, including Article 11, apply from 2 December 2027. This means all high-risk AI systems placed on the market from that date onwards require complete Annex IV documentation. A transitional provision applies to systems already in use, provided they undergo substantial modification after the deadline. Providers should begin building documentation during the development phase, as retrospective documentation is typically incomplete.

Article 99(4) of the EU AI Act provides for fines of up to EUR 15 million or 3% of global annual turnover for violations of the documentation requirements, whichever is higher. For serious infringements, such as placing a high-risk AI system on the market without any technical documentation, sanctions under Article 99(3) can reach up to EUR 35 million or 7% of turnover. Reduced caps apply for SMEs and start-ups. In addition to fines, market surveillance authorities can order corrective measures up to and including withdrawal of the AI system from the market.

Technical documentation under Article 11 is a prerequisite for the conformity assessment but is not the same thing. Article 11 specifies which information about the AI system must be recorded and maintained. The conformity assessment under Article 43 evaluates, on the basis of this documentation, whether the system meets all requirements of the regulation. For most high-risk AI systems listed in Annex III, an internal conformity assessment under Annex VI is sufficient. For certain systems, such as those used for biometric identification, the involvement of a notified body under Annex VII is mandatory. Without complete technical documentation, no conformity assessment can be carried out and no EU declaration of conformity can be issued.

Technical documentation should be treated as an integral part of the AI development process rather than a separate compliance task. In practice, this means: in MLOps pipelines, model cards, training data logs and experiment records are captured automatically. Version control systems track changes to model architecture and hyperparameters. Test reports and validation results are generated directly from CI/CD pipelines. The risk assessment under Article 9 is maintained as a living document that is updated with each model iteration. ADVISORI helps select and configure suitable tools and processes so that documentation is produced with minimal additional effort and remains current at all times.