EU AI Act
Article 11 — Technical documentation
Article 11 requires the technical documentation of a high-risk system to exist before the system is placed on the market, and to be kept up to date afterwards, containing at a minimum the nine groups of elements in Annex IV. Where the internal-control route applies, that file is not evidence of the conformity assessment. It is most of the assessment.
§ 1 — In practice
Drawn up before, kept current after
Two verbs carry Article 11 and organisations routinely honour only one of them. The documentation shall be drawn up before the system is placed on the market or put into service, which makes it a precondition of lawful supply rather than something assembled for an audit afterwards; and it shall be kept up-to date, a duty with no end until the ten-year period in Article 18 runs out. The second is the one that decays quietly. A file written for launch and never reopened stops describing the system at the first release that changes anything material, and from that point the organisation holds a historical document that reads like a current one.
Annex IV is where the work actually is, and three of its items account for most of what an assessor finds missing. Point 2(b) asks for the key design choices with their rationale and assumptions, and for the decisions about any possible trade-off made regarding the technical solutions adopted to comply with Chapter III Section 2 — a written record of what was given up to reach the figures declared under Article 15. Teams make those calls constantly and minute them almost never. Point 2(g) asks for test logs and all test reports dated and signed by the responsible persons; a pipeline run identified by a commit hash is neither. Point 4 asks for a description of the appropriateness of the performance metrics for the specific system — not the metrics themselves, but the argument that they were the right ones to choose.
The weight of this file is easiest to underestimate where there is no notified body to hand it to. Annex VI, the internal-control procedure that governs Annex III points 2 to 8, consists of three acts: the provider verifies that its quality management system complies with Article 17, examines the information contained in the technical documentation to assess compliance with the Section 2 requirements, and verifies that the design and development process and the post-market monitoring are consistent with that documentation. Read literally, the conformity assessment for most listed systems is an examination of this file by its own author. Which route applies is settled by the classification decision; whether the route arrives anywhere is settled here.
Two amendments and one boundary are worth stating precisely. The Digital Omnibus replaced the second subparagraph of Article 11(1) to extend the simplified-documentation form to small mid-cap enterprises alongside SMEs and start-ups, and kept the provision that notified bodies shall accept that form for the purposes of the conformity assessment — a real concession, and one that requires eligibility to be established rather than assumed. It also replaced Article 72(3) to state that the post-market monitoring plan is part of the technical documentation referred to in Annex IV, which Annex IV point 9 had already implied. Annex IV itself was left untouched. The boundary: this page is about the file. The records a running system writes, and how long they must be kept, belong to Article 12.
§ 2 — What discharges it
The nine Annex IV points, and the three nobody has
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
An index mapping each Annex IV point to an artefact
Nine rows, each naming the document that answers the point and the version it stands at. This is the cheapest thing on this page to produce, and its absence is the most reliable predictor that two or three of the points are not answered at all.
02
Test reports dated and signed by named individuals
Point 2(g) asks for reports signed by the responsible persons. A build artefact identified by a commit hash attributes nothing to anybody, and the signature is what makes someone answerable when a figure is later questioned.
03
The written record of design trade-offs
What was surrendered for what, and why, in choosing the technical solutions used to meet Chapter III Section 2. This is the element most often reconstructed long after the decision, which is also when it is least persuasive.
04
A version history tying the file to system releases
Currency is a continuing duty, so the artefact is a change log showing which release each revision belongs to — and a revision that followed the last material change rather than preceding it by a year.
05
The appropriateness argument for the chosen metrics
Point 4 asks why these measures suit this particular system. Reporting scores answers a different question; this one asks why those were the right things to score, given the intended purpose.
06
Where the simplified form is used, the eligibility record
The concession runs to SMEs, start-ups and small mid-cap enterprises. Head-count and turnover move as an organisation grows, so eligibility needs a date and a basis rather than a standing assumption inherited from an earlier year.
§ 3 — Who it binds
Which systems need a file, and when it has to exist
Provider
Every high-risk AI system, under either Article 6 gateway, before it is placed on the market or put into service. Where the system relates to a product covered by the Union harmonisation legislation in Section A of Annex I, Article 11(2) requires a single set of documentation carrying both this information and whatever those acts demand. SMEs, start-ups and small mid-cap enterprises may use the simplified form, which notified bodies must accept.
§ 4 — Worked example
Worked example — everything documented, nothing assembled
A provider of an Annex III recruitment-screening system holds an extensive engineering knowledge base — architecture decision records, a model card for every version, a data catalogue, three years of continuous-integration output, a security review. Nothing has been thrown away. There is no artefact called technical documentation, and no index.
Is Annex IV satisfied by material that exists but was never assembled?
Not on this evidence, and the objection is not formalism. Article 11(1) requires the documentation to be drawn up so as to demonstrate conformity and to give national competent authorities and notified bodies what they need in a clear and comprehensive form. A knowledge base organised by team and by sprint does not put an authority in that position, and under the internal-control route it does not put the provider in it either — the provider is meant to examine this material and conclude something from it, which is not possible while it has no shape. Three items will also turn out to be genuinely absent rather than merely unindexed: the trade-off decisions behind the technical solutions, reports dated and signed by named responsible persons, and the argument that the chosen performance metrics suit this system. The remedy is a mapping that names, for each of the nine Annex IV points, the artefact satisfying it and its current version. The three real gaps then become visible instead of hidden inside the volume.
§ 5 — What a weak answer looks like
A shared drive offered as technical documentation
The folder that is complete and unusable. Every artefact an assessor might want exists somewhere — a wiki, a ticket system, a model registry, a shared drive — and the provider offers access to all of it in place of a file. What Article 11 asks for is arrangement rather than volume: material a national authority can read and reach a conclusion from without first learning how the engineering organisation is structured. Providers who fail here have usually done more work than those who pass and cannot show it, because nobody was ever made accountable for the document as a document.
§ 6 — When it applies
When the documentation duty bites
2 December 2027
Annex III standalone high-risk systems. Moved from 2 August 2026 by the Digital Omnibus — a sixteen-month extension driven by undesignated national authorities and the absence of harmonised standards, not by any relaxation of the Section 2 requirements themselves.
2 August 2028
Annex I embedded high-risk systems — medical devices, machinery, vehicles — where AI Act requirements fold into the existing sectoral conformity assessment. Moved from 2 August 2027.
§ 7 — Exposure
Exposure — the file, and the failure to keep it
€15 million or 3% of worldwide annual turnover, whichever is higher
Two routes, one ceiling. Article 99(4)(a) reaches the obligations of providers pursuant to Article 16, and Article 16(a) requires the system to comply with the Chapter III Section 2 requirements, in which Article 11 sits. Article 16(d) separately requires the provider to keep the documentation referred to in Article 18 — this file included, for ten years after the system is placed on the market — so a file that once existed and was not retained is reachable without any argument about its contents. Article 99(6) gives an SME the lower of the two figures, and Article 99(6a), inserted by the Digital Omnibus, extends that treatment to small mid-cap companies.
§ 8 — Elsewhere
Where documentation control sits in a management system
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
ISO/IEC 42001
Clause 7.5 of ISO/IEC 42001 addresses documented information — its creation, updating, identification and control. It is the management-system home for the currency duty Article 11 states in its own terms.
ISO/IEC 42001 Annex A carries controls covering documentation of the AI system and of its development. Cited by number and title so the reference stays checkable against the standard itself.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 9 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
- Article 11 and Annex IV points 1 to 9
- Regulation (EU) 2026/1744, replacing Article 113 third paragraph point (c) of Regulation (EU) 2024/1689
- Article 99(4)(a) via Article 16(a); Article 16(d) with Article 18(1)(a)
- Regulation (EU) 2026/1744, point (10) replacing the second subparagraph of Article 11(1), and point (30) replacing Article 72(3)
- Annex VI points 2 to 4 — the conformity assessment procedure based on internal control
§ 10 — Also read
Also read
Annex VII — what a notified body examines
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.