EU AI Act Technical Documentation and Provider Evidence Templates

Article 11 requires technical documentation for a high-risk AI system to be drawn up before the system is placed on the market or put into service, kept up to date, and written clearly enough for competent authorities and notified bodies to assess compliance.

The Annex IV template should be maintained as a controlled technical file, with one owner for each field and a direct link to the underlying proof. Avoid a narrative-only document: auditors and notified bodies need traceability from claim, to system version, to test result, to approval.

Confirm the legal role and high-risk basis before opening the file. These templates are for the provider of a high-risk AI system. A deployer does not inherit the provider file merely by using the system, but Article 25 can make a deployer, importer, distributor, or other third party the provider after rebranding, a substantial modification, or an intended-purpose change that makes the system high-risk. Record that role decision and the Article 6 route at the front of the file.

For a high-risk AI system related to a product covered by Section A of Annex I, Article 11 permits one technical-documentation set containing both the AI Act material and the information required by the applicable product legislation. Keep a requirements index so the combined file shows which evidence answers each regime.

Article 16 is the provider evidence checklist for high-risk AI systems. The register should show that each provider duty has an accountable owner, a maintained artifact, a date of last review, and a release gate that prevents market placement or putting into service before required evidence exists.

Use the register as the table of contents for the compliance file. It should not duplicate every technical detail; it should point to the authoritative record for each Article 16 obligation.

Set the retention period explicitly. Article 18 requires the provider to keep the technical documentation, quality-management documentation, notified-body change records and decisions where applicable, and EU declaration of conformity for 10 years after the system is placed on the market or put into service. Longer periods may follow from other Union or national law.

The AI Act evidence pack should connect the management system to the product-law outputs. Article 17 requires documented policies, procedures, and instructions; Articles 47 to 49 convert that operating system into declaration, marking, and registration records.

For high-risk AI systems that require notified-body involvement, keep the notified-body application, technical documentation submitted, assessment decision, certificate, change notifications, audit reports, and any additional tests or evidence requests together with the same system version.

Continue evidence collection after release. Article 12 requires high-risk AI systems to technically allow automatic event recording, Article 19 requires providers to keep logs under their control, and Article 72 requires active post-market monitoring throughout the system lifetime.

The post-market template should make field data usable. It should identify what is collected, who reviews it, which signals trigger investigation, how deployer feedback is handled, and how the technical documentation is updated when performance, risk, or intended use changes.

Provider-controlled logs must be retained for a period appropriate to the intended purpose and for at least six months unless other Union or national law provides otherwise. That minimum does not authorise retention that conflicts with data-protection law; record the purpose, access controls, deletion rule, and any longer sector-specific period.

If the evidence package also covers a general-purpose AI model provider, keep that record separate from the high-risk AI system technical file. GPAI providers have model documentation and downstream-provider information duties under Article 53, with minimum content in Annexes XI and XII.

For GPAI models, add a public summary of training content using the Commission template where Article 53(1)(d) applies. Do not merge that public summary with confidential technical documentation; the audiences and disclosure levels are different.