Auditing AI systems
Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation
Annex VII sets out what a notified body may demand when it assesses a high-risk AI system’s technical documentation. Points 4.3 to 4.5 are an evidence-sufficiency ladder written into law: full access to the data sets, then further evidence and tests the body may carry out itself, then — last — the model and its parameters.
§ 1 — Who it binds
Who ever meets this — and who never does
Notified bodyProvider
Only where a provider’s conformity assessment actually runs through Annex VII. Under Article 43(2) high-risk systems in points 2 to 8 of Annex III take the internal-control route in Annex VI, with no notified body at all; only Annex III point 1, biometrics, reaches Annex VII, and Article 43(1) makes that route compulsory where harmonised standards do not exist or have not been applied. The distinction decides the audience: a provider on the Annex VI route never meets these access duties.
§ 2 — In practice
Three rungs: data, tests, and the model
Start with who this reaches, because most readers of it are not in scope. Article 43(2) puts high-risk systems in points 2 to 8 of Annex III on the internal-control procedure in Annex VI — assessed by the provider itself, with no notified body involved at any point. Only point 1, biometrics, can reach Annex VII, and Article 43(1) makes that route a choice only where the provider has applied harmonised standards or common specifications; where none exist, or the provider has applied one only in part, Annex VII becomes mandatory. Content treating “an EU AI Act audit” and third-party certification as the same event is describing a procedure most providers will never undergo. Whether a system is in the high-risk tier at all is settled earlier, at Article 6.
Point 4.3 is not a documentation request. Where relevant, and limited to what is necessary to fulfil its tasks, the notified body “shall be granted full access to the training, validation, and testing data sets used”, including, where appropriate and subject to security safeguards, through API or other relevant technical means and tools enabling remote access. Three things follow. The entitlement is bounded by necessity, so a demand has to be tied to a task rather than issued at large. Confidentiality is answered by the mechanism rather than by refusal — the provision anticipates that the material cannot simply be handed over, and names remote access as the route. And the object of the entitlement is the data sets themselves, not a description of them. A schema, a data sheet and a summary of collection practice are artefacts about the data; the provision names the data.
Point 4.4 is where the assessment stops being a review. The notified body may require the provider to supply further evidence or carry out further tests, so as to enable a proper assessment of conformity with the Chapter III Section 2 requirements; and where it is not satisfied with the tests the provider carried out, it “shall itself directly carry out adequate tests, as appropriate”. Shall, not may — the discretion left by “as appropriate” is over what an adequate test is, not over whether to test. A body that reads a provider’s evaluation report, forms a doubt about it and records the doubt has not discharged the point; the text puts the alternative test on the body. For anyone building an internal testing programme this is the most useful sentence in the Annex, because it states in law a position an auditor otherwise has to argue for — that dissatisfaction with someone else’s testing obliges you to do your own. The same problem, without a statute behind it, is the subject of testing a probabilistic control.
Point 4.5 is the last rung and it is conditional four times over. Access to the training and trained models of the AI system, including its relevant parameters, is granted only where necessary to assess conformity with the Chapter III Section 2 requirements, only after all other reasonable means to verify conformity “have been exhausted and have proven to be insufficient”, only upon a reasoned request, and only subject to existing Union law on intellectual property and trade secrets. Commentary gets this wrong in both directions: notified bodies do not hold standing access to models, and they are not confined to documentation either. The ladder has rungs, and each has to be shown to have failed before the next becomes available — which is why the record of what was tried at 4.3 and 4.4 is what makes a 4.5 request defensible.
It is unusual for an evidence-sufficiency argument to be written into legislation at all; sufficiency is normally left to professional standards and to practice. That makes these three points useful well outside the conformity-assessment population, as a worked statement of what escalation looks like when what you have been given is about a model rather than from it. An internal audit function has no statutory power to compel any of it, which is exactly why the sequence is worth borrowing: ask, be dissatisfied on a stated basis, test independently, and record the refusal when access stops — because under the audit standards an absence of obtainable evidence can itself be the finding, as evidence sufficiency for AI controls sets out.
§ 3 — What discharges it
What the assessment file has to hold
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
The data-access grant record
What was made available under point 4.3, by what mechanism — direct transfer, API, supervised remote session — on what date, and under which security safeguards. An access log is the artefact; a contractual promise of access is not.
02
Further-evidence requests under 4.4, and the responses
Each request stated as a question about a requirement rather than as a document list, with the provider’s answer and the assessor’s note on whether it resolved the question. Unanswered requests are the spine of any later escalation.
03
The body’s own test record, and why the provider’s tests were not accepted
Point 4.4 turns dissatisfaction into an obligation to test. The record has to show the basis of the dissatisfaction, the tests performed, the environment they ran in, and the result — otherwise the file holds a doubt and no resolution of it.
04
The reasoned request under 4.5, with the exhaustion argument
What was tried at 4.3 and 4.4, why each proved insufficient, and why model and parameter access is now necessary. The determination on intellectual property and trade secrets belongs in the same document.
05
The route determination — Annex VI or Annex VII
Which procedure the provider is following and on what basis, since Article 43(2) leaves most Annex III systems on the internal-control route. A file that assumes a notified body without recording why one is involved has skipped the first question.
06
The Union technical documentation assessment certificate, with its conditions of validity
Point 4.6 requires the certificate to state the conclusions of the examination, the conditions (if any) for its validity, and the data identifying the AI system. The conditions are the part organisations file and forget, and the part a later reader needs.
§ 4 — Worked example
Worked example — a refusal at the first rung
A provider of a remote biometric identification system routes its conformity assessment through Annex VII. The notified body asks for the training data. The provider offers a data sheet, the evaluation report from its own test harness, and read-only access to a documentation portal, declining direct access to the corpus on the grounds that it is licensed from a third party under confidentiality terms.
Is the notified body entitled to more, and what is it obliged to do next?
Yes, and the provider’s ground is answered inside the provision it is resisting. Point 4.3 grants full access to the training, validation and testing data sets — bounded by what is necessary for the body’s tasks, which examining this documentation plainly is — and expressly contemplates that this happens through API or other technical means with security safeguards where appropriate. Confidentiality shapes the mechanism, not the entitlement. Intellectual property and trade-secret protection is attached in the text to point 4.5, the model and parameter rung, not to 4.3. On the evaluation report: if the body is not satisfied with the provider’s tests, point 4.4 requires it to carry out adequate tests itself rather than to record an unresolved concern. Escalation to the model under 4.5 is not yet available — the earlier means have not been exhausted, they have been refused, and the reasoned request that unlocks 4.5 has to show the first. The exposure that follows sits with the provider, whose certificate depends on the assessment.
§ 5 — What a weak answer looks like
A portal is not access to the data
A data room offered as data access. The provider stands up a portal holding model cards, dataset documentation, evaluation reports and a schema, gives the assessor a read-only account, and treats the obligation as satisfied. Everything in the portal is a statement about the underlying material made by the party being assessed. The provision is drafted for exactly the situation the provider is invoking — material that cannot simply be handed over — and answers it with a technical route rather than a substitute artefact. One arrangement lets the assessor check; the other asks it to believe.
§ 6 — Elsewhere
What this connects to in the Regulation
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
The tests a notified body may require or perform under point 4.4 are tests of the Chapter III Section 2 requirements, of which Article 15 is the one that declares accuracy levels and metrics in the instructions for use.
Article 6 decides whether a system is in the high-risk tier. The conformity-assessment route, and therefore whether Annex VII is engaged at all, follows from that classification.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7 — When it applies
When the assessment route becomes live
2 August 2026
General applicability of the Regulation. The conformity-assessment machinery exists from this date; whether a given provider is yet obliged to use it depends on which route its system takes.
2 December 2027
Annex III standalone high-risk systems, under Article 113 third paragraph point (c) as replaced by Regulation (EU) 2026/1744. This is the date that matters for the Annex III point 1 systems capable of routing to Annex VII.
2 August 2028
Annex I embedded high-risk systems, under the same amended provision.
§ 8 — Exposure
Exposure — the provider’s, not the body’s
€15 million or 3% of worldwide annual turnover, whichever is higher — against the provider
Exposure runs to the provider, not to the notified body: Article 99(4)(a), reached through Article 16(a), under which a provider must ensure its high-risk system meets the requirements of Chapter III Section 2. Annex VII is not itself enumerated in Article 99. The notified body’s own exposure is not under Article 99(4) at all — it falls to Article 99(1), the penalties each Member State lays down. Article 99(6) gives an SME the lower of the two figures.
§ 9 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
- Regulation (EU) 2024/1689, Annex VII point 4 “Control of the technical documentation”, sub-points 4.3, 4.4, 4.5 and 4.6.
- Regulation (EU) 2026/1744, Article 1 point (40), replacing Article 113 third paragraph point (c) of Regulation (EU) 2024/1689.
- Article 99(4)(a) via Article 16(a); Article 99(1) for national penalties; Article 99(6) for SMEs.
- Article 43(1) and 43(2), with Annex VI and Annex VII.
§ 10 — Also read
Also read
Testing a probabilistic control
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.