What does Article 11 require?
Prepare the file before placing the high-risk system on the market or putting it into service. Keep it current and show how the system meets the requirements in Chapter III Section 2.
An authority or notified body should be able to understand the system from the file. Start with identity and , then connect the design, data, tests, risk controls, oversight, cybersecurity, conformity and monitoring evidence to that purpose.
Apply Annex IV items as relevant to the system. If an item does not apply, record the facts and reason in the file.
- Identify the AI system, provider, version, deployment form, , and relevant software, firmware, hardware, API, or embedded-product context.
- Explain the system architecture, development process, algorithms, design choices, assumptions, expected outputs, output quality, and any third-party pre-trained systems or tools used.
- Document training, validation, and testing data where relevant, including provenance, scope, main characteristics, selection, labelling, cleaning, and data-governance choices.
- Include validation and testing procedures, metrics for accuracy and robustness, discrimination-impact checks where relevant, test logs, and dated reports signed by responsible persons.
- Tie the file to the Article 9 risk-management system, Article 14 human-oversight measures, cybersecurity measures, conformity evidence, and post-market monitoring plan.
Must the file follow Annex IV?
Annex IV is the minimum content baseline for a high-risk system subject to Article 11, applied as relevant. Small and medium-sized enterprises (SMEs), including startups, and small mid-cap enterprises may provide the elements through the simplified Commission form under amended Article 11. They must still supply the applicable information.
Is a legal memo enough?
No. Annex IV expects engineering and product evidence: system description, , interfaces, architecture, development methods, data requirements, validation and testing procedures, performance metrics, cybersecurity measures, risk management, lifecycle changes, standards or technical specifications, conformity declaration, and post-market monitoring.
When does the documentation duty apply?
Regulation (EU) 2026/1744, published on 24 July 2026 and entering into force on 27 July 2026, moves Chapter III Sections 1 to 3, except Article 6(5), to 2 December 2027 for Article 6(2) Annex III systems and 2 August 2028 for Article 6(1) Annex I systems. Article 111 separately limits how the high-risk rules apply to a system placed on the market or put into service before the relevant date, with a 2 August 2030 deadline for high-risk systems intended for use by public authorities.
Citations (2)
- Regulation (EU) 2024/1689 - Article 11 and Annex IV
Primary legal text for the Article 11 timing rule and Annex IV minimum technical-documentation contents for high-risk AI systems.
before that system is placed on the market
- European Commission - AI Act regulatory framework
Commission overview confirming that high-risk AI providers must address documentation, human oversight, robustness, cybersecurity, conformity assessment, registration, declaration of conformity, and CE marking.
The AI Act defines 4 levels of risk