Build the and provider records for a , with owners and evidence links for each field.
Use these working templates for documentation, assessment, marking, registration, logs and monitoring. They are not official Commission forms.
Confirm the high-risk classification and provider role, then build a for the specific system version. Prepare it before supplying or first using the system, link statements to evidence, and update it when the system changes. These templates support the required assessment; they do not replace it.
Prepare the Article 11 before supplying or first using a . Keep it current and clear enough for authorities and any notified body to assess compliance. Annex IV sets the minimum information.
The Annex IV template should be maintained as a controlled , with one owner for each field and a direct link to the underlying proof. Link each claim to the system version, test result and approval so reviewers can check it.
Confirm the legal role and high-risk basis before opening the file. These templates are for the provider of a .
A deployer does not inherit the provider file merely by using the system, but Article 25 can make a deployer, importer, distributor, or other third party the provider after rebranding, a substantial modification, or an intended-purpose change that makes the system high-risk.
Record that role decision and the Article 6 route at the front of the file.
For a related to a product covered by Section A of Annex I, Article 11 permits one technical-documentation set containing both the AI Act material and the information required by the applicable product legislation. Keep a requirements index so the combined file shows which evidence answers each regime.
Check the application date and sectoral route before treating this pack as a current release requirement. Under amended Article 113, Chapter III Sections 1-3, except Article 6(5), apply from 2 December 2027 for Article 6(2) Annex III systems and 2 August 2028 for Article 6(1) Annex I systems, subject to transition rules.
Annex I Section B products follow the limited direct application in Article 2(2), rather than the full Article 11 route. Record the controlling provisions beside the file owner.
Amended Article 11 allows SMEs, including start-ups, and small mid-cap enterprises (SMCs) to provide the Annex IV elements in a simplified manner. If the provider chooses this route, it must use the Commission form established for it, and notified bodies must accept that form.
These working templates do not substitute for that form or remove the Annex IV information requirement.
Sources (2)
Supports the requirement to create and maintain technical documentation for high-risk AI systems and the minimum Annex IV content categories.
Supports the role-change triggers that can make a deployer, importer, distributor, or other third party the provider responsible for the high-risk technical file.
Use an evidence register to track Article 16 provider duties. Give each duty an owner, authoritative record, last-review date and pre-release check. Block release when required evidence is missing.
Set the retention period explicitly. Article 18 requires the provider to keep the technical documentation, quality-management documentation, notified-body change records and decisions where applicable, and for 10 years after the system is placed on the market or put into service.
Longer periods may follow from other Union or national law.
Sources (1)
Lists the provider obligations for high-risk AI systems, including QMS, documentation, logs, conformity assessment, declaration, CE marking, registration, corrective actions, and authority cooperation.
Providers of high-risk AI systems shall
Link quality-management procedures to the declaration, marking and registration records. Article 17 requires documented policies, procedures and instructions; Articles 47-49 govern those market-entry records.
For high-risk AI systems that require notified-body involvement, keep the notified-body application, technical documentation submitted, assessment decision, certificate, change notifications, audit reports, and any additional tests or evidence requests together with the same system version.
EN 18286:2026 was cited in the Official Journal on 14 October 2026 by Decision (EU) 2026/2274. Use the working register below to record covered requirements and remaining measures. Presumption of conformity applies only to covered requirements; adopting the standard does not establish whole-Act compliance or replace conformity assessment.
Keep one row per legal requirement and standard part used. These fields and example rows are a working template, not an official form. Check the detailed mapping against an authorised copy of the standard; retain the licensed text in your controlled internal library.
Sources (4)
Supports the quality management system, EU declaration of conformity, CE marking, conformity assessment, and registration fields.
The provider shall draw up a written machine readable
Explains registration of providers, authorised representatives, deployers, and high-risk AI systems in the EU database before placement or use.
registration requirements for high-risk AI systems
Article 1 and the Annex cite EN 18286:2026. Article 2 and recital 6 establish effect from publication on 14 October 2026, limited to requirements covered by the standard.
Official publication announcement identifying the Article 17 quality-management standard. Check Annex ZA in an authorised copy for detailed coverage conditions.
Continue collecting evidence after release. Article 12 requires automatic logging capability, Article 19 requires retention of logs under provider control, and Article 72 requires active monitoring throughout the system lifetime.
The post-market template should make field data usable. It should identify what is collected, who reviews it, which signals trigger investigation, how deployer feedback is handled, and how the technical documentation is updated when performance, risk, or intended use changes.
Provider-controlled logs must be retained for a period appropriate to the intended purpose and for at least six months unless other Union or national law provides otherwise. That minimum does not authorise retention that conflicts with data-protection law; record the purpose, access controls, deletion rule, and any longer sector-specific period.
Amended Article 72(3) requires Commission guidance including a voluntary monitoring-plan template by 2 September 2027. Keep this provider-designed monitoring record separate from that future Commission template and retain system-specific sources, thresholds, reviewers and corrective-action decisions.
Sources (1)
Supports log capability, provider log retention, corrective actions, authority cooperation, and post-market monitoring plan requirements.
actively and systematically collect, document and analyse relevant data
If you also provide a general-purpose AI (GPAI) model, keep its documentation separate from the high-risk system file. Article 53 and Annexes XI-XII govern model documentation and information for companies integrating the model, subject to the applicable exceptions.
For GPAI models, add a public summary of training content using the Commission template where Article 53(1)(d) applies. Do not merge that public summary with confidential technical documentation; the audiences and disclosure levels are different.
Sources (2)
Commission guidance context for GPAI provider obligations, submission routes, and how the Commission interprets the GPAI provider scope.
Guidelines for providers of general-purpose AI models
Supports the public training-content summary template for general-purpose AI model providers under Article 53(1)(d).
summary of the content used to train their models
Check documentation gaps, record ownership and the boundary between system and model evidence.
Check the documentation, retention, declaration and registration requirements behind these fields.
Check documentation gaps, record ownership and the boundary between system and model evidence.
"Registration"
"registration requirements for high-risk AI systems"
"general-purpose AI models"
"Guidelines for providers of general-purpose AI models"
"summary of the content used for training"
"summary of the content used to train their models"
"Providers of high-risk AI systems shall"
"actively and systematically collect, document and analyse relevant data"
"The provider shall draw up a written machine readable"
"laying down harmonised rules on artificial intelligence"
Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.
Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.
Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.
Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.
Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.
Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.
Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.
See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.
Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.
Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.
Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.
Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.
Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.
Check each AI tool, decide which duties apply, and give every action an owner and evidence link.
Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.
Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.
Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.
High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.
Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.
Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.
Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.
Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.
Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.
Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.
Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.
Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.
Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.
Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.
See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.
See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.
Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.
Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.
Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.
Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.