Annex IV Technical Documentation: The 9 Sections Explained
Complete guide to EU AI Act Annex IV technical documentation. All 9 mandatory sections explained with required contents, implementation tips, and documentation automation guidance.
Annex IV of the EU AI Act specifies the technical documentation that providers of high-risk AI systems must draw up and maintain. This documentation is a cornerstone of compliance: it demonstrates that your AI system meets all Chapter III requirements and must be available to national competent authorities upon request.
Technical documentation is not a one-time deliverable. It must be kept up-to-date throughout the AI system's lifecycle, updated with each significant modification, and maintained for 10 years after the system is placed on the market or put into service.
Key Facts
Required documentation sections
Minimum retention period after market placement
Estimated manual effort per AI system (first time)
The 9 Sections of Annex IV
General Description of the AI System
A clear description of the AI system's intended purpose, the provider's identity, the system's version, and how it interacts with hardware, software, or other AI systems.
Required Contents
- System name, version, and unique identifier
- Provider name, address, and contact details
- Intended purpose and conditions of use
- Description of interaction with other systems
- Hardware and software requirements
- Product or system in which the AI is integrated
Implementation Tips
Maintain this as a living document in your repository. Link it to your system's README or architecture documentation. Automate version tracking through CI/CD metadata.
System Elements and Development Process
The methods and tools used to develop the AI system, including design specifications, system architecture, algorithms, data requirements, and computational resources employed.
Required Contents
- Design specifications and architecture diagrams
- Algorithms and model architecture details
- Data requirements and specifications
- Training methodology and hyperparameters
- Computational resources used for development
- Third-party tools and components integrated
Implementation Tips
Extract architecture details programmatically from your codebase. Use model cards and experiment tracking (MLflow, W&B) to capture training details. Document third-party dependencies with versions and licenses.
Monitoring, Functioning, and Control
Detailed information on performance monitoring, the system's capabilities and limitations, human oversight measures, and specifications for input data.
Required Contents
- Performance monitoring mechanisms
- System capabilities and known limitations
- Human oversight measures and intervention mechanisms
- Input data specifications and validation rules
- Expected output behavior and confidence thresholds
- Fail-safe and degradation modes
Implementation Tips
Implement structured logging (Article 12) and link logs to this documentation. Define clear SLIs/SLOs that map to regulatory requirements. Document kill-switch and override procedures.
Risk Management System
A description of the risk management system per Article 9, including risk identification, estimation, evaluation, and the measures adopted to address identified risks.
Required Contents
- Risk identification methodology
- Risk assessment results (likelihood, severity, affected groups)
- Mitigation measures implemented
- Residual risk evaluation
- Continuous monitoring and update process
- Stakeholder involvement in risk assessment
Implementation Tips
Use a structured risk register. Map each identified risk to specific mitigation measures in your codebase. Update the assessment after every significant system change.
Data Governance Measures
A description of data governance measures per Article 10, including training data characteristics, collection processes, preparation operations, and bias detection.
Required Contents
- Training, validation, and test dataset descriptions
- Data collection methodology and sources
- Data preparation and preprocessing steps
- Labelling processes and quality controls
- Bias detection and mitigation measures
- Data provenance and lineage documentation
Implementation Tips
Implement data versioning (DVC or similar). Automate data quality checks in your pipeline. Document data provenance end-to-end, including consent basis under GDPR where personal data is used.
Testing and Validation
Information on testing and validation procedures, including methodologies, metrics, test datasets, and results. Covers pre-deployment testing and post-market monitoring plans.
Required Contents
- Testing methodology and test plan
- Metrics and KPIs for performance evaluation
- Test datasets and their representativeness
- Test results including accuracy, robustness, and bias metrics
- Adversarial testing results
- Post-deployment monitoring plan
Implementation Tips
Integrate compliance-relevant test suites into CI/CD. Use stratified evaluation across protected groups. Automate regression testing for performance metrics mapped to regulatory thresholds.
Changes and Modifications
A description of all changes made throughout the system's lifecycle, including the nature of each change, rationale, and impact assessment.
Required Contents
- Changelog with version history
- Nature and rationale of each modification
- Impact assessment for each change
- Re-testing and re-validation results
- Conformity assessment update decisions
- Pre-determined change boundaries
Implementation Tips
Leverage your git history and CI/CD pipeline. Tag releases with regulatory relevance. Define clear criteria for what constitutes a substantial modification requiring conformity re-assessment per Article 43.
Conformity Assessment Procedures
Documentation of the conformity assessment procedure followed, including whether internal control (Annex VI) or notified body (Annex VII) was applied, and the EU declaration of conformity.
Required Contents
- Conformity assessment procedure applied (Annex VI or VII)
- Evidence of compliance with each Chapter III requirement
- EU declaration of conformity (Article 47)
- CE marking documentation
- Notified body involvement (if applicable)
- Quality management system documentation (Article 17)
Implementation Tips
For most software-based AI systems, the internal control procedure (Annex VI) applies. Prepare a compliance matrix mapping each Article 9-15 requirement to specific evidence in your documentation and codebase.
Post-Market Monitoring
A description of the post-market monitoring system per Article 72, including data collection, performance analysis, feedback processing, and corrective action implementation.
Required Contents
- Post-market monitoring plan and methodology
- Data collection mechanisms (logs, user feedback, incident reports)
- Performance degradation detection
- Corrective action procedures
- Serious incident reporting process (Article 73)
- Communication plan for downstream deployers
Implementation Tips
Implement automated drift detection and performance monitoring. Set up alerting for accuracy degradation below documented thresholds. Establish a clear incident response process with defined escalation paths.
Automating Annex IV Documentation
Creating and maintaining Annex IV documentation manually for each AI system is costly and error-prone. Modern engineering teams are adopting documentation-as-code practices to generate, version, and maintain compliance documentation directly from their codebase and CI/CD pipeline.
Code-Derived Documentation
Extract architecture details, dependency lists, model parameters, and test results directly from your codebase. Scanara automatically maps code-level findings to Annex IV sections, producing documentation that stays synchronised with your actual system.
Continuous Compliance
Integrate documentation generation into your CI/CD pipeline. Every pull request can trigger documentation updates, ensuring your Annex IV documentation reflects the current state of your AI system at all times.
People Also Ask
Related Guides
How Scanara Helps
Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.