EU AI Act Article 11 + Annex IV technical documentation template
Updated
Full Annex IV documentation template (7 mandated sections). Required for every high-risk Annex III system before placement on the EU market. Combine with the AIBOM CycloneDX template for the machine-readable supplement.
How to use
Author per high-risk system; refresh per Article 43(4) substantial change; retain 10 years post-market.
Template (markdown)
copy-paste, replace {{PLACEHOLDERS}}# Annex IV Technical Documentation — {{SYSTEM_NAME}}
**Provider:** {{COMPANY}} · **EU Representative:** {{EU_REP}} · **Version:** {{VERSION}} · **Date:** {{DATE}}
## Section 1: General description of the AI system
- **Intended purpose:** {{INTENDED_PURPOSE}}
- **Provider name + contact:** {{COMPANY}} — {{CONTACT_EMAIL}}
- **EU Representative (if non-EU provider):** {{EU_REP_NAME}}, {{EU_REP_ADDRESS}}, {{EU_REP_EMAIL}}
- **Geographic scope of placement:** {{REGIONS}}
- **Data subject categories:** {{DATA_SUBJECT_CATEGORIES}}
- **System version:** {{VERSION}} (released {{RELEASE_DATE}})
- **System architecture diagram:** see {{DIAGRAM_PATH}}
- **High-level description of system inputs + outputs:** {{IO_DESCRIPTION}}
- **Annex III high-risk classification:** {{ANNEX_III_CATEGORY}} (rationale: {{CLASSIFICATION_RATIONALE}})
## Section 2: Detailed description of elements + development process
- **Model + algorithms used:** {{MODEL_LIST}}
- **Training methodology:** {{TRAINING_METHODOLOGY}}
- **Training data sources + curation:** {{TRAINING_DATA_DESCRIPTION}}
- **Validation + test methodology:** {{VALIDATION_METHODOLOGY}}
- **Bias-detection runs:** {{BIAS_DETECTION_RESULTS_PATH}}
- **Hardware + infrastructure used:** {{INFRA_DESCRIPTION}}
- **Logs of design choices + rationale:** {{DESIGN_LOG_PATH}}
- **Reference to AIBOM:** {{AIBOM_PATH}} (CycloneDX 1.6)
## Section 3: Information about monitoring + functioning + control
- **Post-market monitoring per Article 61:** monthly model-drift report; see {{POST_MARKET_REPORT_PATH}}
- **Incident logging procedure per Article 62:** {{INCIDENT_LOGGING_PROCESS}} (must log within 15 days of awareness)
- **Human oversight design per Article 14:** {{HUMAN_OVERSIGHT_DESIGN_PATH}}
- **Override + halt mechanisms:** {{OVERRIDE_MECHANISM_DESCRIPTION}}
- **Audit trail:** {{AUDIT_TRAIL_DESCRIPTION}}
- **Performance metrics + thresholds:** {{PERFORMANCE_METRICS_PATH}}
- **Continuous accuracy + robustness monitoring:** {{MONITORING_FREQUENCY}}
## Section 4: Detailed description of the risk management system per Article 9
- **Risk-management framework:** ISO 31000-aligned
- **Identified risks (training data, accuracy, robustness, fairness, security):** see {{RISK_REGISTER_PATH}}
- **Mitigations applied:** see {{RISK_REGISTER_PATH}}
- **Residual risks accepted:** see {{RESIDUAL_RISK_PATH}}
- **Sign-off authority:** {{CTO_OR_CISO}}, signed {{SIGN_OFF_DATE}}
## Section 5: Description of changes through the lifecycle
- **Version log:** see {{CHANGELOG_PATH}}
- **Substantial-change tracker per Article 43(4):** {{SUBSTANTIAL_CHANGE_TRACKER_PATH}}
- **Change approval process:** {{CHANGE_APPROVAL_PROCESS}}
- **Re-conformity-assessment triggers:** {{TRIGGERS}}
## Section 6: List of harmonised standards applied
- ISO/IEC 23053:2022 — Framework for AI systems using Machine Learning
- ISO/IEC 42001:2023 — Artificial Intelligence Management System
- ISO/IEC 23894:2023 — AI Risk Management
- CycloneDX 1.6 — AIBOM machine-readable form
- {{ADDITIONAL_STANDARDS}}
## Section 7: Declaration of conformity
- **Conformity assessment route:** Annex {{VI_OR_VII}}
- **Date of declaration:** {{DECLARATION_DATE}}
- **Signed by:** {{NAME}}, {{ROLE}}, {{COMPANY}}
- **CE marking affixed:** {{TRUE_OR_FALSE}} (location: {{CE_MARKING_LOCATION}})
- **EU AI Database registration ID per Article 71:** {{REGISTRATION_ID}}
- **Retention obligation:** This documentation is retained for 10 years post-market-placement per Article 18.