EU AI Act Annex IV: Documentation Checklist for AI Systems

Engineering Documentation Workstreams

Annex IV has nine numbered points. It covers the system description; development and design, including data and testing; monitoring, functioning and control; performance metrics; risk management; changes over the lifetime; applied harmonised standards or other solutions; the EU declaration of conformity; and post-market monitoring. The engineering workstreams below are a summary, not a substitute for each statutory point.

Workstream 1: General Description of the AI System

Describe the intended purpose, users, operating environment and system boundaries. Identify the version being assessed and explain which external models or tools are part of the deployed workflow.

Workstream 2: Design Specifications and Development Process

Document how components exchange data and where controls apply. Link design decisions to implementation evidence, including interfaces, dependencies and the safeguards around consequential actions.

Workstream 3: Information on Training, Validation, and Testing

Explain the relevant training, validation and testing approach, with data provenance and known limitations. Include the performance metrics under Annex IV point 4; distinguish measured results from targets and record failures as well as successes.

Workstream 4: Monitoring, Functioning, and Control

Describe operating limits, monitoring signals and how people inspect or intervene in the system. Test what happens when a limit is reached or the reviewer is unavailable, and retain the evidence needed to understand that behavior.

Workstream 5: Risk Management System

Connect identified hazards and rights-related risks to mitigations and residual risks. Record who accepted the remaining risk and which changes or incidents trigger another assessment.

Workstream 6: Changes Made to the System

Keep a versioned change record covering models, data, tools and operating rules. Explain which evidence was updated after each relevant change and how the team decided whether further testing or conformity work was needed.

Workstream 7: EU Declaration of Conformity

Keep the EU declaration of conformity under Annex IV point 8 with the assessed system version. Separately document the applied harmonised standards or other solutions under point 7; a declaration does not replace that supporting evidence.

Workstream 8: Post-Market Monitoring Plan

Describe how the team gathers operating experience, reviews incidents and updates controls after deployment. Assign owners and a feedback path so monitoring findings can change the risk assessment and documentation.

Summary Checklist

Build a point-by-point register for all nine Annex IV points, with an evidence location, owner, version and unresolved gap. The eight workstreams above group related work; they do not reduce the statutory list to eight points.

Common Documentation Gaps

Look for stale diagrams, untraceable test results and documentation that refers to a different model version. Check performance metrics and standards or alternative solutions explicitly, because these can disappear when teams organise the file by engineering workstream.

EU AI Act Article 12: Logging Requirements Decoded | EU AI Act Article 9: Continuous Risk Management

FAQ

Is the documentation finished after the first review? No: keep it aligned with relevant system changes and operating evidence. Confirm the applicable documentation format and any available simplified forms rather than assuming a single template fits every provider.

Separate documentation from logs. Article 18 sets a period ending ten years after market placement or putting into service for specified provider documentation. Articles 19(1) and 26(6) address automatically generated logs under the provider's or deployer's control: retain them for a period appropriate to the system's purpose, at least six months, unless applicable Union or national law provides otherwise, particularly data-protection law. Financial-sector documentation rules may also apply; there is no universal five-to-seven-year rule for all agent logs.

Book a 30-minute call to audit your Annex IV readiness | EU AI Act Article 15: Accuracy and Robustness