EU AI Act Technical Documentation (Art. 11): What High-Risk AI Systems Must Prepare

High-risk AI systems must maintain a complete technical file before placing on the EU market. Art. 11 and Annex IV define exactly what to include — from system architecture to training data governance and post-market monitoring plans.

What Is the Technical File?

The technical documentation — commonly called the "technical file" — is the master evidence package that demonstrates a high-risk AI system meets all EU AI Act requirements. Mandated by Art. 11 and structured by Annex IV, it must be drawn up before the system is placed on the EU market and kept up to date throughout the system's lifecycle.

The technical file is not submitted centrally. The provider holds it and presents it on request to market surveillance authorities and notified bodies. This is a pull model: authorities come to you; you must be ready to hand over a complete, coherent package, not an improvised stack of files assembled under pressure.

Art. 11 imposes three duties on providers:

1. Draw it up before market placement or putting into service.
2. Keep it up to date — any substantial change to the system requires updating the file and reassessing conformity.
3. Make it available to competent authorities and notified bodies on request, within a defined timeframe (typically 10 business days under national market surveillance rules).

The standard for "up to date" is functional: the technical file must reflect the system as actually deployed, not the system as originally designed. If a model update changes performance characteristics, accuracy thresholds, or training data, the file must be revised accordingly.

Who Needs Technical Documentation?

Technical documentation under Art. 11 and Annex IV is mandatory for providers of:

• High-risk AI systems listed in Annex III — standalone systems in areas such as biometric categorisation, recruitment, credit scoring, critical infrastructure management, education, law enforcement, migration and border control, and administration of justice (subject to the Art. 6(3) significant-risk filter)
• AI systems functioning as safety components in Annex I-regulated products — AI embedded in medical devices, machinery, vehicles, aviation equipment, and similar products governed by existing EU product safety legislation

Technical documentation is not required for:

• Minimal-risk AI systems (chatbots, spam filters, recommendation engines outside high-risk categories)
• AI systems subject only to transparency obligations under Art. 50 (e.g. deepfake disclosures, emotion recognition disclosures where not high-risk)
• General-Purpose AI (GPAI) model providers — they have separate documentation obligations under Art. 53, including technical documentation for the model itself, but not the Annex IV format designed for deployed high-risk systems

If you are a deployer (not a provider), you are not required to prepare the technical file. However, deployers must maintain logs of system use (Art. 26(5)), and providers are entitled to draw on these logs when updating technical documentation or handling incident reports.

The 14 Elements of Annex IV

Annex IV specifies the minimum content of the technical file. There is no rigid format — providers may organise the documentation as they see fit — but all 14 elements must be present and substantive. Tick-box entries without supporting evidence do not satisfy Annex IV.

Practical note on element 4 (training data): Annex IV does not require you to disclose the datasets publicly or to authorities by default. It requires that the documentation exists and can be produced. For proprietary datasets, a description of data governance procedures, statistical summaries, and bias-testing results will typically satisfy the requirement without disclosing commercially sensitive data.

Practical note on element 14 (standards): As of mid-2026, the AI Act standardisation programme is still in progress. ISO/IEC 42001 (AI management systems) is available and widely referenced. Providers should monitor the European standardisation work under CEN/CENELEC JTC 21 and update this section as harmonised standards are published in the Official Journal.

EU Declaration of Conformity (Art. 47)

The EU Declaration of Conformity (EU DoC) is a separate mandatory document — it is not part of the technical file, but it references it. The EU DoC is the provider's formal statement that the AI system complies with all applicable EU AI Act requirements.

A valid EU DoC must include:

• The provider's name and address (and authorised representative if applicable)
• The AI system's name, version, serial or batch number if applicable
• A statement that the system complies with the EU AI Act
• The conformity assessment procedure used: Annex VI (internal control / self-assessment) for most Annex III systems, or Annex VII (third-party assessment by a notified body) for biometric categorisation AI and AI used in critical infrastructure requiring third-party involvement
• A list of the harmonised standards or common specifications relied on
• The signature of the provider's authorised representative with date and place

The EU DoC must be kept for 10 years after market placement and produced on request. It accompanies the CE marking (see below).

For AI systems embedded in Annex I products, the EU DoC may be merged with the declaration of conformity required under the relevant sector legislation, provided it contains all the elements required by both legal instruments.

CE Marking (Art. 48)

High-risk AI systems placed on the EU market must bear the CE marking, which signals conformity with the EU AI Act and any other applicable Union harmonised legislation covering the same product.

Exceptions: AI systems in Annex III categories deployed by public authorities for their own internal use are exempt from CE marking requirements. They remain subject to all other obligations — technical documentation, risk management, human oversight, registration — but do not need to affix CE marking.

CE marking must be affixed before the system is placed on the EU market. It must be visible, legible, and indelible. Where the physical nature of the system does not permit affixing the marking directly, it may appear on the packaging or in the instructions for use.

When a high-risk AI system is a component of an Annex I product that already requires CE marking under sector-specific legislation (e.g. medical devices, machinery), the CE marking covers conformity with both the sector legislation and the AI Act. Providers should document clearly which conformity assessment procedures underpin the CE marking.

Practical Checklist: Minimum Viable Technical File

Before any high-risk AI system is placed on the EU market, verify these 10 items are complete and evidenced:

• [ ] System description and version control — name, version, intended purpose documented; a change log exists
• [ ] Architecture diagram — data flow and component diagram showing all hardware, software, and third-party elements
• [ ] Training data inventory and governance record — datasets catalogued with source, size, splits, and data quality procedures documented
• [ ] Risk assessment (per Art. 9) — identified risks, mitigation measures, and accepted residual risks documented and signed off
• [ ] Bias testing results — testing methodology documented; results disaggregated by relevant demographic groups where applicable
• [ ] Accuracy metrics on a representative test set — performance metrics documented with test conditions; thresholds defined
• [ ] Human oversight procedure document — override mechanisms described; operator requirements (training, qualification) documented
• [ ] Cybersecurity assessment — known attack vectors assessed; technical countermeasures documented
• [ ] Instructions for use (deployer-facing) — Art. 13 document complete, including limitations, logging obligations, and incident reporting contact
• [ ] Post-market monitoring plan — data collection scope, monitoring frequency, review triggers, and incident reporting procedure documented

This checklist covers the minimum. A well-prepared technical file will go further — particularly on bias testing methodology, model cards for component models, and evidence of the risk management process being iterative rather than a one-time exercise.

How This Links to the EU AI Act Academy

The EU AI Act Academy Pro tier includes ready-to-use technical documentation templates covering all 14 Annex IV elements, including:

• A structured XLSX workbook with one tab per Annex IV element, pre-populated with prompts and example entries
• A DOCX technical file skeleton ready for editing
• A risk assessment worksheet following the Art. 9 iterative process
• A data governance record template covering training, validation, and test datasets
• A post-market monitoring plan template aligned with Art. 72

These templates are designed to be adapted to your specific system — they are starting points with substantive content, not blank forms.

Related pages:

• Annex III — High-risk AI categories and obligations
• Conformity Assessment procedures (Annex VI and VII)
• EU AI Act Academy — templates and training
• Tools — Conformity Assessment Selector