Esempio di rapporto di conformità

Per Article 43, complete the conformity assessment procedure which includes: (1) Assessment type - determine the applicable procedure: for high-risk systems under Annex III points 2 to 8, internal control under Annex VI without a notified body (Art 43(2)); for Annex III point 1, internal control under Annex VI or, where harmonised standards were not applied or only partly applied, the Annex VII procedure with a notified body (Art 43(1)); for systems covered by the Annex I Section A legislation, the procedure required by that legislation (Art 43(3)); (2) Technical documentation review - review technical documentation to verify compliance with Articles 8-15; (3) Quality management system - verify QMS is implemented and operational (Article 17); (4) Testing - conduct or review testing and validation results; (5) Declaration - draw up EU Declaration of Conformity upon successful assessment. The assessment must be completed before placing the AI system on the market.

Add the following PMM elements per Article 72: monitoring_plan, user_feedback, update_procedures

Add the following required Annex IV sections to your technical documentation: design_specifications, training_data, risk_mitigation. Per Article 11 and Annex IV, technical documentation must include all 8 required sections. Missing sections indicate incomplete documentation that may not meet compliance requirements. Ensure each section is comprehensive and addresses all relevant aspects of the AI system.

Create documentation_retention_policy per Article 18 of the EU AI Act.

Per Article 10, document comprehensive data governance including: (1) Data sources - identify and document all data sources used for training, validation, and testing; (2) Training data - describe data collection, selection, and preparation processes, including data quality measures; (3) Validation data - document validation datasets and their representativeness; (4) Data quality - specify relevance, representativeness, accuracy, completeness, and bias mitigation measures; (5) Data management - describe data collection, labeling, storage, and retention procedures; (6) Privacy and data protection - document compliance with applicable data protection laws. Ensure documentation covers the entire data lifecycle and addresses potential biases.

Per Article 12, create logging documentation that includes: (1) Automatic logging - document that automatically generated logs are kept for at least 6 months, or longer if required by Union or national law; (2) Log retention - specify retention periods and procedures for log storage; (3) Audit trail - document audit trail capabilities and access controls; (4) Access controls - document who can access logs and under what circumstances. Logging must be automatic and cover all relevant system operations.

Per Article 14, document human oversight procedures including: (1) Oversight mechanisms - document how human oversight is implemented; (2) Human intervention capabilities - document when and how humans can intervene; (3) Override/stop procedures - document procedures for overriding or stopping AI system operations; (4) Training for human overseers - document training procedures for personnel responsible for oversight; (5) Interpretation guidance - document guidance for interpreting AI outputs. Human oversight must be effective and allow for intervention at any time.

Per Article 15, create accuracy and robustness documentation including: (1) Accuracy metrics - document accuracy levels and how they are measured; (2) Robustness testing - document robustness testing procedures and results; (3) Performance evaluation - document performance evaluation methods and criteria; (4) Cybersecurity measures - document cybersecurity measures implemented to ensure robustness. The system must achieve an appropriate level of accuracy, robustness, and cybersecurity appropriate to the intended purpose.

Per Article 16(1)(c), establish a quality management system covering the thirteen Article 17(1) elements: (a) compliance strategy; (b) design and design-control procedures; (c) development, quality control and quality assurance; (d) examination, test and validation procedures; (e) technical specifications and standards applied; (f) data management; (g) risk management system (Article 9); (h) post-market monitoring (Article 72); (i) serious-incident reporting (Article 73); (j) communication with authorities, notified bodies, operators and customers; (k) record-keeping; (l) resource management including security of supply; (m) accountability framework.

Per Article 17 (Article 16(1)(c) obliges the provider to have it), establish a quality management system documented in written policies, procedures and instructions covering Article 17(1)(a)-(m): (a) regulatory compliance strategy; (b) design and design-control techniques; (c) development, quality control and quality assurance; (d) examination, test and validation procedures; (e) technical specifications and standards applied; (f) data management systems and procedures; (g) the Article 9 risk management system; (h) post-market monitoring (Article 72); (i) serious-incident reporting (Article 73); (j) communication with authorities and other parties; (k) record keeping; (l) resource management; (m) an accountability framework.

Per Article 17, implement a quality management system (QMS) that includes: (1) Documented procedures - procedures for design, development, testing, validation, and deployment; (2) Risk management integration - integration with the risk management system (Article 9); (3) Data governance - procedures for data governance (Article 10); (4) Technical documentation - procedures for creating and maintaining technical documentation (Article 11); (5) Conformity assessment - procedures for conformity assessment and ongoing compliance; (6) Post-market monitoring - procedures for post-market monitoring (Article 72); (7) Corrective actions - procedures for corrective actions and incident reporting. The QMS must be documented, implemented, and maintained throughout the AI system lifecycle.

Per Article 18, establish documentation retention procedures that ensure: (1) Log retention - automatically generated logs are kept for at least 6 months, or longer if required by Union or national law; (2) Documentation availability - all documentation required under the AI Act is kept and made available to market surveillance authorities upon request; (3) Retention period - documentation is retained for at least 10 years after the AI system is placed on the market or put into service; (4) Accessibility - documentation is organized and accessible within required timeframes. The retention policy must be documented and implemented as part of the quality management system.

Per Article 20, create incident reporting documentation including: (1) Incident definition - define what constitutes a serious incident (death, serious injury, breach of fundamental rights, etc.); (2) Detection procedures - procedures to detect and identify serious incidents; (3) Reporting timeline - report to the market surveillance authorities immediately after establishing a causal link or its reasonable likelihood, and in any event within 15 days of becoming aware of the serious incident (Art 73(2)); within 2 days for a widespread infringement or a serious incident under Art 3(49)(b) (Art 73(3)); within 10 days after the death of a person (Art 73(4)); (4) Report content - include all required elements: incident description, system identification, impact assessment, and mitigation measures; (5) Follow-up - procedures for investigating incidents and implementing corrective measures. The procedure must be documented and operational before placing the AI system on the market.

Per Article 27, conduct FRIA including: (a) a description of the processes of the deployer in which the system will be used in line with its intended purpose; (b) the period and frequency of use; (c) the categories of natural persons and groups likely to be affected; (d) the specific risks of harm to them; (e) the human oversight measures; (f) the measures to be taken if the risks materialise, including internal governance and complaint mechanisms. Required before first use by deployers that are bodies governed by public law or private entities providing public services, and by deployers of Annex III point 5(b) and 5(c) systems; not for Annex III point 2 systems (Art 27(1)). The deployer notifies the market surveillance authority of the results (Art 27(3)).

Per Article 27, conduct fundamental rights impact assessment (FRIA) including: (1) Risk assessment of fundamental rights impacts; (2) Affected groups identification; (3) Mitigation measures; (4) Monitoring plan; (5) Stakeholder consultation; (6) Documentation.

Per Article 47 and Annex V, create EU Declaration of Conformity including: (1) Provider identification; (2) System identification; (3) Intended purpose; (4) Conformity statement; (5) Applicable standards; (6) Notified body details (if applicable); (7) Signature and date.

Per Article 47 and Annex V, create an EU Declaration of Conformity that includes: (1) Provider identification - provider name and address; (2) System identification - AI system name, model, and version; (3) Intended purpose - description of the AI system's intended purpose; (4) Conformity statement - statement that the AI system conforms to the EU AI Act; (5) Applicable standards - list of harmonised standards or other technical specifications applied; (6) Notified body details - if applicable, notified body name and identification number; (7) Signature and date - signature of authorized representative and date. The declaration must be drawn up before placing the system on the market and kept for 10 years after the system is placed on the market.

Per Article 49, register the high-risk AI system in the EU database before placing it on the market. Registration must include: (1) Provider information - provider name and address; (2) System identification - AI system name, model, version, and serial number; (3) Intended purpose - description of the intended purpose; (4) Risk classification - confirmation that the system is classified as high-risk; (5) Conformity assessment - reference to the conformity assessment procedure used; (6) CE marking - confirmation that CE marking has been affixed. Registration is mandatory and must be completed before the system is placed on the market. The registration number must be included in the EU Declaration of Conformity.

Per Article 6, document classification assessment including: (1) Risk classification - determine if the AI system is high-risk based on Annex III categories: (a) biometric identification, (b) critical infrastructure, (c) education, (d) employment, (e) essential services, (f) law enforcement, (g) migration/border control, (h) justice/democratic processes; (2) Classification methodology - document the methodology used to classify the system; (3) Classification result - document whether the system is classified as high-risk and the rationale; (4) Review procedures - document procedures for reviewing and updating classification as system evolves. Classification must be performed before placing the system on the market.

Per Article 73, establish incident reporting procedures that include: (1) Incident definition - define what constitutes a serious incident (death, serious injury, breach of fundamental rights, etc.); (2) Detection procedures - procedures to detect and identify serious incidents; (3) Reporting timeline - report to the market surveillance authorities immediately after establishing a causal link or its reasonable likelihood, and in any event within 15 days of becoming aware of the serious incident (Art 73(2)); within 2 days for a widespread infringement or a serious incident under Art 3(49)(b) (Art 73(3)); within 10 days after the death of a person (Art 73(4)); (4) Report content - include all required elements: incident description, system identification, impact assessment, and mitigation measures; (5) Follow-up - procedures for investigating incidents and implementing corrective measures. The procedure must be documented and operational before placing the AI system on the market.

Per Article 48, affix the CE marking in line with the general principles of Article 30 of Regulation (EC) No 765/2008: (1) Visible - affixed visibly; (2) Legible - affixed legibly; (3) Indelible - affixed indelibly; (4) Digital - for a high-risk AI system provided digitally, use a digital CE marking that is easily accessible via the interface of the system or via a machine-readable code or other electronic means (Art 48(2)); (5) Placement - where affixing it to the system is not possible or not warranted, affix it to the packaging or the accompanying documentation (Art 48(3)); (6) Notified body - where a notified body is responsible for the conformity assessment under Article 43, follow the marking with its identification number (Art 48(4)). Where other Union law also provides for the CE marking, the marking must show that the system also meets the requirements of that law (Art 48(5)).

The document of record is a placeholder (e.g. TODO / 'to be completed'). Replace the placeholder with the substantive content required for this obligation so it is no longer treated as missing.

Move the document into the expected 'docs/' directory so the scanner and auditors can locate the document of record for this obligation.

Move the document into the expected 'docs/' directory so the scanner and auditors can locate the document of record for this obligation.

Move the document into the expected 'docs/' directory so the scanner and auditors can locate the document of record for this obligation.

Move the document into the expected 'docs/' directory so the scanner and auditors can locate the document of record for this obligation.

Move the document into the expected 'docs/' directory so the scanner and auditors can locate the document of record for this obligation.

Per Article 13, create instructions for use that accompany the high-risk AI system, including: (1) Provider identity; (2) Intended purpose and conditions of use; (3) Characteristics, capabilities, and limitations of performance; (4) Human oversight measures; (5) Expected lifetime and maintenance measures.

Per Articles 50-52, create transparency documentation including: (1) User notification - document how users are notified that they are interacting with an AI system; (2) Disclosure requirements - document what information is disclosed to users; (3) Transparency measures - document measures taken to ensure transparency and explainability. For limited-risk AI systems, users must be informed that they are interacting with an AI system. For high-risk systems, additional transparency requirements apply.

A placeholder document matched a regulated EU AI Act type but is not the document of record. Replace it with substantive content or remove it.

Rename the document to the canonical filename 'classification_assessment' (with an appropriate extension) so it is unambiguously identified as the document of record for this obligation.