EU AI Act Technical Documentation

Annex IV of the EU AI Act (Regulation 2024/1689) defines nine mandatory sections: (1) general description of the AI system including intended purpose, provider details, and versioning; (2) detailed description of system elements including algorithms, model architecture, and design decisions; (3) development process and computational resources; (4) data governance covering training, validation, and test datasets; (5) monitoring, functioning, and control with performance metrics; (6) risk management per Article 9; (7) documentation of lifecycle changes; (8) applied harmonised standards or common specifications; (9) EU declaration of conformity and post-market monitoring plan. Article 11(2) allows SMEs and start-ups to provide simplified documentation.

Article 11 specifically governs technical documentation for high-risk AI systems and references Annex IV with concrete requirements for system architecture, training data, and performance metrics. Other AI Act documentation obligations include the quality management system under Article 17, logging requirements under Article 12, deployer record-keeping under Article 26, and the 10-year retention obligation under Article 18. The Annex IV technical documentation is the core artefact upon which the conformity assessment under Article 43 is based.

Annex IV requires comprehensive data governance documentation: data collection methods, provenance and volume of training, validation, and test datasets, preprocessing steps including annotation and labelling, bias detection and mitigation procedures, data protection measures, and an assessment of data availability and suitability. Additionally, computational resources, hardware used, and training duration must be documented. This transparency enables market surveillance authorities to trace model development decisions.

Annex IV Section 5 requires concrete metrics for accuracy, robustness, and cybersecurity: accuracy metrics for the intended purpose, known and foreseeable error rates, foreseeable unintended outcomes and risk sources, human oversight measures per Article 14, and performance for specific groups of persons where the system is intended for them. Test and validation results must be documented traceably and updated regularly as the system evolves.

Article 11 obligations apply from 2 December 2027 for Annex III high-risk AI systems and from 2 August 2028 for AI in regulated products under Annex I. Systems already in use become subject to these requirements upon substantial modification. Penalties under Article 99(4) reach up to EUR 15 million or 3% of global annual turnover. For severe violations under Article 99(3), fines can reach EUR 35 million or 7% of turnover. Documentation must be retained for 10 years.

Technical documentation should be built as an integral part of the development process: model cards and experiment logs are generated automatically from MLOps pipelines, version control systems track changes to model architecture and hyperparameters, test reports and validation results are exported directly from CI/CD pipelines, and the Article 9 risk assessment is maintained as a living document updated with each model iteration. This approach minimises additional effort while keeping documentation current at all times.

The system architecture section in Annex IV requires: a detailed description of system elements and their relationships, algorithms and model architecture with rationale for design decisions, interaction with hardware and software including other AI systems, software versions and firmware, all forms in which the system is placed on the market (e.g. as a software package or embedded in hardware), and computational infrastructure requirements. This documentation serves as the basis for the conformity assessment and must be comprehensible to market surveillance authorities.