EU AI Act technical documentation template: Annex IV checklist, conformity and CE marking

Who is this template for?

• Provider of an Annex III high-risk AI system, such as software for recruitment, education, credit or benefitsProvider obligations (Article 16), technical documentation (Article 11 and Annex IV)
• Quality or compliance manager at the providerQuality management system (Article 17), ten-year record keeping (Article 18) and conformity assessment (Article 43)
• Provider of a general-purpose AI modelDocumentation, information for downstream providers and copyright policy (Article 53, Annexes XI and XII); Article 55 for systemic risk
• Software company building someone else's AI model into its own product (downstream provider)Provider of the system: Article 50(1) and (2) and, for high-risk systems, the written agreement in Article 25(4)
• The provider's data protection officer or privacy officerGDPR statement in the EU declaration of conformity (Annex V, point 5), lawful basis (Article 6 GDPR) and DPIA (Article 35 GDPR)
• Provider established outside the EU and its authorised representativeAuthorised representative in the EU (Article 22 for systems, Article 54 for general-purpose AI models)

What is inside

How to use the template

1. Use the decision box in chapter 1 to establish, per system or model, whether you are the provider and which date applies to you.
2. For every Annex IV point, complete the evidence column with a document, a version and a location. A tick without a document is not evidence.
3. Complete the conformity assessment route in chapter 4 and only then draw up the EU declaration of conformity, including the GDPR statement in Annex V, point 5.
4. Arrange CE marking, registration, post-market monitoring and the incident procedure (chapters 6 to 9). If you use someone else's AI model, also complete section 10.4.
5. Approve the file in chapter 11 and update it with every change; keep it for ten years (Article 18). National rules on penalties and supervision differ per Member State: check the countries where you place the system on the market.

Common mistakes

• Writing the technical documentation after the fact. It must be ready before the system is placed on the market or put into service (Article 11(1)), and written for an outsider.
• Treating Annex IV as a list of eight points, or looking for quality management, CE marking and registration in it. Annex IV has nine points; point 9 is the post-market monitoring plan. Quality management is in Article 17, CE marking in Article 48 and registration in Article 49.
• Assuming a notified body is always needed. Annex III, points 2 to 8, use internal control (Annex VI). A notified body is needed for biometrics under point 1 without harmonised standards applied in full, and for Annex I products through that product legislation.
• Signing the EU declaration of conformity without evidence behind the GDPR statement (Annex V, point 5): lawful basis for training data, special categories of personal data, DPIA and your role as controller or processor.
• Assuming you carry the Article 53 obligations because you build someone else's model into your product. You are the provider of your system, not of the model. Only a modification using more than a third of the original training compute (indicator in the Commission guidelines, July 2025) can make you the provider of the modified model.

Frequently asked questions