Why this object hangs off that object

Per product: the Annex I legal act, the section it falls under after 27 July 2026, the conformity assessment procedure chosen and whether a third party is involved, the harmonised standards any opt-out relies on, the AI functions identified as safety components together with the failure analysis, and the role you carry as a result. This is the file that shows why your system is or is not high risk through Article 6(1).

Hangs off: Article 6(1): the product route to high risk

Editorially reviewed | evidence, high-risk

Per system: the intended purpose in your own words, the chosen point and lettered subpoint, the reasoning, the outcome of the Article 6(3) assessment with the condition it rests on, whether the system performs profiling, and for a reasoned no also the documentation and registration required by Article 6(4) and Article 49(2). Plus who assessed it and when. This is the document with which you later explain why the system was out of scope.

Hangs off: Annex III: the eight areas separately

Editorially reviewed | high-risk

Traceable rationale covering intended purpose, Annex III category, Article 6(3) assessment and registration decision.

Hangs off: Annex III: high-risk AI

Editorially reviewed | evidence, high-risk

Record per dataset of origin, choices, assumptions, bias examination and mitigations.

Hangs off: Article 10: data and data governance

Editorially reviewed | evidence, high-risk-requirements

Technical documentation kept current per system version, ready for a supervisor’s request.

Hangs off: Article 11: technical documentation

Editorially reviewed | evidence, high-risk-requirements

Log files with a retention period appropriate to the purpose and at least six months for deployers (Articles 19 and 26).

Hangs off: Article 12: logging and traceability

Editorially reviewed | evidence, high-risk-requirements

The received instructions for use plus their internal translation into work instructions per role.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | evidence, high-risk-requirements

Record of oversight measures, appointed persons, their training and the moments of intervention.

Hangs off: Article 14: human oversight

Editorially reviewed | evidence, high-risk-requirements

Declared accuracy levels, test results, and measures against data poisoning and adversarial attacks among others.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | evidence, high-risk-requirements

The documented quality system with procedures, role assignment and references to the underlying files.

Hangs off: Article 17: quality management system

Editorially reviewed | evidence, high-risk-requirements

Per system: the technical documentation, the quality management system documentation, the changes approved by notified bodies, the decisions and documents they issued, and the EU declaration of conformity, with the date of placing on the market, the date of putting into service and the resulting end date of the retention period.

Hangs off: Article 18: documentation keeping

Editorially reviewed | evidence, high-risk-requirements

Versioned record of roles, context, measures, participation or instruction and review moments.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, evidence

A record per system that the Article 5 screening was performed, with outcome and reasoning. The conclusion "no prohibited practice" is evidence too.

Hangs off: Article 5: prohibited practices

Editorially reviewed | evidence, prohibited-practices

Record of scenario, actor, disclosure or marking, technical implementation, test and owner.

Editorially reviewed | evidence, transparency

Evaluation results, risk assessments, mitigations, incident reports and security measures per model version.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | evidence, gpai-systemic-risk

Per model: the decision whether or not to adhere to a code of practice, the version and chapter it relates to, the date and the authorised signatory, whether adherence was limited under paragraph 7 to the obligations in Article 53, and, where the decision is negative, the elaboration of your own for the issues in paragraph 2.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | evidence, governance, gpai, gpai-systemic-risk

The plan as part of the technical documentation plus the periodic analyses and follow-up actions.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | evidence, post-market

Record of incidents, analyses, reports to supervisors and corrective measures.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | evidence, post-market

Per submission: which system, which document, which version, to which recipient, on what date, which part was marked confidential, and which purpose the recipient stated.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | enforcement, evidence, governance

Per system and per version: which intended purpose was taken, which standards, specifications, evaluation methods and test sets were treated as the state of the art, which were deliberately not applied and why, who established that, and on what date the record was reviewed again.

Hangs off: Article 8: compliance with the requirements for high-risk AI systems

Editorially reviewed | conformity, evidence, high-risk-requirements

Versioned record of risk analyses, chosen measures, residual risks and test results per system version.

Hangs off: Article 9: risk management system

Editorially reviewed | evidence, high-risk-requirements

Per processing operation: the system or model, the paragraph of Article 4a relied on, the justification why synthetic or anonymised data do not suffice, the technical and organisational safeguards applied, the access list, the confirmation that no other party can reach the data, and the deletion date. This is also the text that paragraph 1, point (f), requires in the record of processing activities.

Hangs off: Article 4a: legal basis for bias testing with special categories of personal data

Editorially reviewed | fundamental-rights, high-risk-requirements

The assessment, EU declaration of conformity, CE marking and registration proof, per system version.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, evidence

Per system: which Annex VIII data was entered, by which natural person with the legal authority to do so, on what date, in which version, when the entry was last checked against reality, and for a public deployer the URL of the entry made by the provider. This is also the file that shows the public entry and your internal documents say the same thing.

Hangs off: Article 71: EU database for high-risk AI systems listed in Annex III

Editorially reviewed | conformity, evidence

Dated impact assessment, measures, residual risks and, where required, notification to the market surveillance authority.

Hangs off: Article 27: FRIA

Editorially reviewed | evidence, fundamental-rights

Current technical documentation, downstream information, copyright policy and public training summary.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | evidence, gpai

The written mandate itself, in an official language of the institutions of the Union, together with the copy of the Annex XI technical documentation, the contact details of the provider, and the record of the verification under paragraph 3(a). The provider grants the mandate and supplies the documentation; the ten year retention after the placing on the market rests under paragraph 3(b) with the representative, which keeps the file at the disposal of the AI Office and national competent authorities.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | evidence, gpai

Per type and model: the date the first unit was placed on the market or put into service, the route and therefore the cut off date, whether it is intended to be used by public authorities, which design changes have been made since that cut off, and per change the judgement whether it was significant with the reasoning and the date. This is the file that shows which track a system was on and why.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

Per body: identification number, Member State of establishment, the conformity assessment activities and system types for which it is notified, the date of each check against the public list, the outcome of the independence test, the subcontracted tasks with your written agreement, and every notice of a change to its designation.

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, evidence, governance

Per AI component: the intended purpose, the function inside the product, the failure analysis with its consequence for health and safety, the basis of the third-party conformity assessment, and which of paragraphs 1a, 1b and 1c was applied and why. This is a self-maintained file; the Regulation does not prescribe it, and for products under Annex I, Section B, the technical documentation of Article 11 and Annex IV does not apply at all.

Hangs off: Article 6(1a) to (1c): the tightened classification route

Editorially reviewed | conformity, high-risk

Per model version: the measured and planned training compute with the scope of recital 111, so including pre-training, synthetic data generation and fine-tuning, the moment the threshold was reached or foreseen, the notification sent with its supporting information, any arguments under paragraph 2, any reassessment request under paragraph 5, and the response or designation decision of the Commission.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Record per system of role, contractual arrangements on information and cooperation, and the appointment of a representative where required.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | evidence, value-chain