Annex IV technical documentation, section by section

Providers of high-risk AI systems must draw up technical documentation before placing the system on the market or putting it into service, and keep it up to date (Art. 11(1)). Annex IV defines what the file must contain; Art. 18 requires the provider to keep it at the authorities' disposal for ten years after market placement. For Annex III systems the duty applies from 2 December 2027.

What Annex IV asks for

• A general description of the system — intended purpose, provider, version and how it relates to earlier versions, how it interacts with hardware and software, the forms it is placed on the market in, the instructions for use.
• A detailed description of its elements and the development process — methods and steps, use of pre-trained systems or third-party tools, design specifications and architecture, the training methodologies and the data used (provenance, scope, labelling, cleaning), the human-oversight measures needed, pre-determined changes, validation and testing procedures and their results, cybersecurity measures.
• Information on the monitoring, functioning and control of the system — capabilities and limitations, foreseeable unintended outcomes, human-oversight measures, input-data specifications.
• The appropriateness of the performance metrics.
• A description of the risk management system (Art. 9).
• Changes made through the lifecycle.
• The standards applied — harmonised standards or the alternative solutions used.
• A copy of the EU Declaration of Conformity (Art. 47).
• The post-market monitoring plan (Art. 72).

A provider that is an SME, a start-up or a small mid-cap (SMC) may supply the same content in the simplified form the Commission provides, and a notified body must accept that form (Art. 11(1), as amended by the Digital Omnibus).

How Veritome composes it

Each system has an Annex IV editor — opened from Documents (the per-system grid, one cell per system), from the system itself, or from Evidence → Generate document. It follows the Annex point by point, in nine sections shown one at a time — the Annex's own numbering, as the outline on the left: 1 General description of the AI system (1(a)–(h)), 2 Elements and development process (2(a)–(h), with its four themes headed inside the section: design and development, training, validation and testing data, human oversight and pre-determined changes, and validation, testing and cybersecurity), 3 Monitoring, functioning and control, 4 Performance metrics, 5 Risk management system, 6 Lifecycle changes, 7 Standards applied, 8 EU declaration of conformity and 9 Post-market monitoring. Every field carries its Annex IV point; a point that applies only "where applicable" can be declared not applicable with a reason; tables hold the lists the Annex asks for (versions, data sets, metrics, signed test reports, the change log, the standards); attachments stand in for documents you already have.

A switch at the top of the file chooses the regime: Full · Annex IV, or Simplified · SME / SMC for a provider that is an SME, a start-up or a small mid-cap under Art. 11(1), which collapses the detailed 2(b) and 2(d) fields into one combined field each and asks for screenshots instead of a described interface. The simplified layout is provisional until the Commission publishes its form; it still covers every point, and the editor says so. The size declaration (Recommendation 2003/361/EC) is recorded beside the switch.

The file is a composed document: a field whose answer already exists in an obligation shows that text as a composed draft beneath it — Art. 9 feeds the risk process, Art. 10 the data sets, Art. 14 the oversight assessment, Art. 15 the cybersecurity measures — and you use it or write your own; nothing is written into the file unasked. The instructions for use, the risk management system, the declaration of conformity and the post-market monitoring plan are linked records: the file shows each one's state and opens its own editor, and they are exported with the file rather than duplicated in it.

Synced to the obligation

The Art. 11 obligation tracks the Annex IV document: as the file is populated, the obligation's status follows, so the obligation's row and your completion figures reflect the real state of the file. The evidence links this creates are marked derived — composition made them, and they cannot be removed by hand, because deleting one would make those figures lie.

Export, seal, keep

Export PDF renders an A4 technical file stamped with the system name and provider from the live record. Issuing it computes a SHA-256 fingerprint, writes it into the system's dossier chain-of-custody, mints a Generated evidence record, and appends the issue to the Issued archive with a ten-year retention floor stamped at that moment — a later reclassification cannot shorten a clock that already started. Re-generating the file later appends a new issue; the earlier one stays retrievable under its own hash, which is what an auditor opening the evidence filed against a March obligation needs to still read March's text.

Hash-sealed dossier records

The system's classification dossier is a tamper-evident chain: every submitted entry gets a SHA-256 fingerprint that folds in the previous entry's fingerprint, plus a verification ID. The Verify link on an entry opens a public verify page anyone can check without logging in, and issued documents carry their own fingerprint with the same public verification.