- Home
- Suite features
- Annex IV documentation
Annex IV technical documentation, as a checklist you can work through
Annex IV technical documentation is the file that Art. 11 of the EU AI Act requires from every provider of a high-risk AI system. The suite's Annex IV cockpit breaks it into 29 checklist items in eight groups, with working notes for Articles 9, 12, 13 and 14. It tracks progress; it does not write the file.
- Art. 11 + Annex IV · 29 items
- Art. 9, 12, 13, 14 · working notes
- Technical file · not drafted
- Art. 43 route · not decided
What is Annex IV technical documentation, and when is it due?
It is the technical file of a high-risk AI system. Article 11 technical documentation must exist before the system is placed on the market or put into service in the EU, and be kept up to date (Art. 11(1)); Annex IV sets its minimum content in nine points. It is due from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products (Regulation (EU) 2026/1744, the Digital Omnibus on AI); all dates: EU AI Act timeline.
Annex III lists high-risk uses such as recruitment, credit scoring and life or health insurance pricing; Annex I covers AI in products under EU product-safety law, such as medical devices. The file is kept for ten years after the system is placed on the market or put into service (Art. 18(1)) and, with the declaration of conformity (Art. 47), is the core of your AI Act conformity assessment documentation.
From the first click to the checklist
Open /suite/#ai-act. Then:
- Confirm the legal notice. First visit only; the suite states that it offers orientation, not legal advice.
- Choose the AI Act card on the welcome screen. It opens the quick check; closing that unsaved returns you to Home.
- Answer as a provider: 'Provider', 'Both' or 'Unsure'; 'Established outside the EU' where true ('Unsure' counts as EU and hides the representative banner); and 'Annex III high-risk area' or 'Annex I EU product-safety product'. This seeds a high-risk system, named in German, into the AI Portfolio.
- Click 'Annex IV' in the AI Act sidebar. Groups IV.1 to IV.8 count done/total and a percentage as you tick.
- Open the four sub-cockpits from the sidebar, indented under 'Annex IV', or the buttons below the checklist. On the page they sit last, after 'Engagement Packages'. Despite its label, 'Art. 11 RMS' holds the Art. 9 workflow.
Sub-sections cannot be deep-linked. Without a high-risk system you see a gate notice; a system added by hand under 'AI Portfolio' unlocks the checklist only after a reload. Sub-cockpits open only for provider or both; for other roles their sidebar entries lead nowhere.
What the Annex IV cockpit records, and on which legal basis
Status and working notes, not text, each tied to the article it serves.
| Capability | Legal basis | Output |
|---|---|---|
| Annex IV blueprint | Art. 11(1) + Annex IV | 29 tick-off items in groups IV.1–IV.8, done/total and % per group |
| Art. 11 RMS | Art. 9; Art. 10(2)(f), 10(3); Art. 15(5) | Nine steps, each planned / in progress / completed, with notes |
| Art. 12 Logs | Art. 12; Art. 19(1), 26(6) | Retention from 6 months to 5 years or custom; four categories for remote biometric identification; architecture notes |
| Art. 13 Transparency | Art. 13(3) | Nine fields (none for point (f), the log mechanisms) plus custom fields; a JSON 'stub' download |
| Art. 14 Oversight | Art. 14(3), 14(4)(a)–(e), 14(5) | Five capabilities, each planned / trained / operational; mechanism type; stop-interface notes; two-person flag (Art. 14(5): remote biometric identification only) |
| Annex IV point | Group | Items to tick |
|---|---|---|
| 1 · General description | IV.1 · 5 | Purpose and versions; interaction with hardware/software; provider and representative contact; deployment form; user interface |
| 2 · Elements, development | IV.2 · 9 | Methods; design choices; optimisation objectives; architecture; training data; oversight; pre-determined changes; testing; cybersecurity |
| 3 · Monitoring, control | IV.3 · 4 | Capabilities and limits, incl. accuracy; risks; oversight interface; input data |
| 4 · Performance metrics | — | No group of its own |
| 5 · Risk management | IV.4 · 3 | Identification; evaluation; mitigation and residual risk |
| 6 · Lifecycle changes | IV.5 · 2 | Version log; continuous learning |
| 7 · Standards | IV.6 · 2 | Harmonised standards; alternatives |
| 8 · Declaration | IV.7 · 1 | Signed, kept ten years |
| 9 · Post-market | IV.8 · 3 | Method; corrective-action thresholds; Art. 73 incidents |
Ticks sit with the AI portfolio and each sub-cockpit under its own key, in this browser's local storage; there is no account (Trust Center).
A hypothetical US provider, walked through
A hypothetical insurtech in Columbus, Ohio, with no EU establishment, sells a system pricing individual life and health cover under its own name to insurers in Ireland and the Netherlands: Annex III, point 5(c). Quick check: provider, outside the EU, Annex III high-risk area.
Obligations shows an Art. 11 card with four tasks, from 'Annex IV template' to 'Review before release'. Model cards and validation reports cover four of nine IV.2 items: 4/9 · 44%. In 'Art. 11 RMS' the bias step is in progress, noting postcode as a proxy variable; after a reload, the Article 14 human oversight sub-cockpit offers that note for underwriter training. The six filled Art. 13 fields go, as JSON, to whoever drafts the instructions for use.
Not settled by the suite: whether the ticked items would hold up. Art. 6(3) is unlikely to help: pricing individual cover typically profiles the insured, and an Annex III system that profiles natural persons is always high-risk (Art. 6(3), third subparagraph). The suite has no such test; see AI Act risk classification. Compare the demo persona TalentSync (recruiting).
The limits, stated plainly
- It does not draft the file: no Annex IV text is generated, and a tick records status, not content. The DOCX report button needs the deep-analysis engine, absent from the browser edition, and would carry the sub-cockpit records, not your ticks.
- One record for the whole portfolio, not one per system.
- The 29 items condense the Annex: point 4 has no group, and point 1 lacks items for (e) hardware, (f) product illustrations and (h) instructions for use. 29/29 is not a complete file.
- Some tags are off: the log categories cite 'Annex IV(2)(f)' where Art. 12(3) applies; the Art. 13 fields run to '(i)', though Art. 13(3) ends at (f), which no field covers. Cite from the Official Journal.
- No conformity route: Art. 43 is only the task 'Select assessment route'; Annex VI (internal control) versus Annex VII (notified body) is not assessed.
- No simplified checklist for SMEs, start-ups or small mid-caps (Art. 11(1)); an 'SME / Start-up' tag only adds an Art. 62 card with the task 'Apply simplified Annex IV template'.
- The Template Preview, a watermarked German excerpt of an Annex IV archetype template, is labelled 'not a legal document, not legal advice' and awaits the law firm's ratification before any use. It appears only for a high-risk provider whose Digital Services Act (DSA) profile also lists a search engine, social network, marketplace or media/streaming service.
Frequently asked questions
What must Annex IV technical documentation contain?
Nine points: a general description of the system; its elements and development process; monitoring, functioning and control; the appropriateness of the performance metrics; the Art. 9 risk management system; lifecycle changes; the harmonised standards or other solutions applied; the EU declaration of conformity (Art. 47); and the post-market evaluation system, with the Art. 72(3) monitoring plan.
Is there an official Annex IV template?
Not a mandatory one: Annex IV fixes the content, not the layout, so any EU AI Act technical documentation template is one possible structure. Under Art. 11(1), as amended by Regulation (EU) 2026/1744, SMEs, including start-ups, and small mid-cap enterprises may provide the elements in a simplified manner, on a form the Commission is to establish; notified bodies must accept it. The suite's checklist is a working list, not an official template.
Who has to prepare Annex IV documentation — provider or deployer?
The provider: whoever develops the high-risk system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Art. 3(3), 11, 16). Deployers carry Art. 26 duties, but under Art. 25(1) become the provider if, for example, they put their name on the system or substantially modify it. The AI Act role check works through the questions.
What does an Article 9 risk management system involve?
A continuous, iterative process across the system's lifecycle, not a one-off report. Art. 9(2) names the steps: identify and analyse foreseeable risks, estimate and evaluate them, including under foreseeable misuse, evaluate risks emerging from post-market data, and adopt targeted measures; testing follows Art. 9(6) to (8). The suite's workflow sits under 'Art. 11 RMS'.
What goes into Article 13 instructions for use?
At least the Art. 13(3) list: identity and contact details of the provider and, where applicable, its authorised representative; performance characteristics, capabilities and limitations; pre-determined changes; human oversight measures; computational and hardware resources, expected lifetime and maintenance; and, where relevant, how deployers collect, store and interpret the logs. The suite's nine fields omit that last point (f); add it as a custom field.
Where the checklist ends and the file begins
The cockpit shows that an item is ticked, not whether the text behind it meets Annex IV, whether Art. 6(3) applies or which Art. 43 route fits. Those are legal assessments, and drafting the file is work for the law firm Theo Funk, under a separate mandate.
For a non-EU provider, Art. 22(3) adds a keeper: an authorised representative verifies that the file has been drawn up and holds a copy for the authorities. Art. 22 applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Regulation (EU) 2026/1744. Regingada UG (haftungsbeschränkt) takes that role under written mandate — document custody, verification, cooperation with authorities; not legal advice: AI Act authorised representative service.