Why this object hangs off that object

Per serious incident: when you established it, when and where you reported it, which system version it concerned and how you met the Article 73 deadlines. Per third-party conformity assessment: that the Office was responsible, which notified body acted on behalf of the Commission, which fees you paid directly and when the assessment was completed.

Hangs off: Article 75(1a) and (1e): reporting to and assessment by the AI Office

Editorially reviewed | enforcement, evidence

Per product: the Annex I legal act, the section it falls under after 27 July 2026, the conformity assessment procedure chosen and whether a third party is involved, the harmonised standards any opt-out relies on, the AI functions identified as safety components together with the failure analysis, and the role you carry as a result. This is the file that shows why your system is or is not high risk through Article 6(1).

Hangs off: Article 6(1): the product route to high risk

Editorially reviewed | evidence, high-risk

Per system: the intended purpose in your own words, the chosen point and lettered subpoint, the reasoning, the outcome of the Article 6(3) assessment with the condition it rests on, whether the system performs profiling, and for a reasoned no also the documentation and registration required by Article 6(4) and Article 49(2). Plus who assessed it and when. This is the document with which you later explain why the system was out of scope.

Hangs off: Annex III: the eight areas separately

Editorially reviewed | high-risk

Proof that the system for which you invoke the Article 6(3) exception is registered as Article 49(2) requires, with the registration number linked to the underlying assessment.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

The written assessment with date, author and rationale, drawn up before the system is placed on the market or put into service, ready to be provided to the national competent authority on request.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Traceable rationale covering intended purpose, Annex III category, Article 6(3) assessment and registration decision.

Hangs off: Annex III: high-risk AI

Editorially reviewed | evidence, high-risk

Record per dataset of origin, choices, assumptions, bias examination and mitigations.

Hangs off: Article 10: data and data governance

Editorially reviewed | evidence, high-risk-requirements

Technical documentation kept current per system version, ready for a supervisor’s request.

Hangs off: Article 11: technical documentation

Editorially reviewed | evidence, high-risk-requirements

Log files with a retention period appropriate to the purpose and at least six months for deployers (Articles 19 and 26).

Hangs off: Article 12: logging and traceability

Editorially reviewed | evidence, high-risk-requirements

The received instructions for use plus their internal translation into work instructions per role.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | evidence, high-risk-requirements

Record of oversight measures, appointed persons, their training and the moments of intervention.

Hangs off: Article 14: human oversight

Editorially reviewed | evidence, high-risk-requirements

Declared accuracy levels, test results, and measures against data poisoning and adversarial attacks among others.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | evidence, high-risk-requirements

One dossier per system holding the documentation, the logs, the EU declaration of conformity and the registration record, in the version that applied at the moment of placing on the market.

Hangs off: Article 16: the twelve duties of a provider of a high-risk AI system

Editorially reviewed | high-risk-requirements

The documented quality system with procedures, role assignment and references to the underlying files.

Hangs off: Article 17: quality management system

Editorially reviewed | evidence, high-risk-requirements

Per system: the technical documentation, the quality management system documentation, the changes approved by notified bodies, the decisions and documents they issued, and the EU declaration of conformity, with the date of placing on the market, the date of putting into service and the resulting end date of the retention period.

Hangs off: Article 18: documentation keeping

Editorially reviewed | evidence, high-risk-requirements

Versioned record of roles, context, measures, participation or instruction and review moments.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, evidence

Internal register showing who received which instruction, working session, training or guidance, for which system, on which date and on what basis, including new joiners, contractors and external staff.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

The recorded matrix of roles against AI systems, with the context of use, affected persons, risk and selected measure per combination, dated and with an owner per row.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Per request: which system and which version, which exceptional reason was invoked and on which facts, to which market surveillance authority and on what date the request was made, what the status of the conformity assessment was, which end date was agreed, when the notification of paragraph 3 was made, and what the outcome was.

Hangs off: Article 46: derogation from conformity assessment procedure

Editorially reviewed | conformity, enforcement, evidence

Per system: which Article 49 route was followed, the registration number, the date of registration, the name of the person who submitted it, the system version the entry relates to, and, for the secure section, a statement of which limited fields from Annex VIII and Annex IX were completed.

Hangs off: Article 49: registration in the EU database before the system reaches the market

Editorially reviewed | conformity, evidence, high-risk

A record per system that the Article 5 screening was performed, with outcome and reasoning. The conclusion "no prohibited practice" is evidence too.

Hangs off: Article 5: prohibited practices

Editorially reviewed | evidence, prohibited-practices

Dated record per interface and channel showing that the disclosure appears at the latest at first interaction or exposure, is clear and distinguishable, and passed the accessibility check, with screenshot, version number and tester identity.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Record of scenario, actor, disclosure or marking, technical implementation, test and owner.

Hangs off: Article 50: transparency

Editorially reviewed | evidence, transparency

Written statement from the supplier describing which marking is applied to the output, in which machine-readable format, how robust and interoperable the solution is, and whether the marking survives editing or export.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Evaluation results, risk assessments, mitigations, incident reports and security measures per model version.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | evidence, gpai-systemic-risk

Per model: the decision whether or not to adhere to a code of practice, the version and chapter it relates to, the date and the authorised signatory, whether adherence was limited under paragraph 7 to the obligations in Article 53, and, where the decision is negative, the elaboration of your own for the issues in paragraph 2.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | evidence, governance, gpai, gpai-systemic-risk

On request, the competent authority provides written proof of the activities successfully carried out, plus an exit report with results and learning outcomes. You can use that documentation in conformity assessment and in market surveillance.

Hangs off: Article 57: AI regulatory sandboxes

Editorially reviewed | innovation

For every test subject you record freely given informed consent, covering five prescribed information elements, dated, documented, with a copy provided to the subject.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

The document that precedes consent: per test the five points of Article 61(1) written out, with the Union-wide unique single identification number, the contact details from whom further information can be obtained, and the mechanism for requesting the reversal or the disregarding of an output. This is a different item from the dated consent record itself, which sits in article-61-informed-consent-record.

Hangs off: Article 61: informed consent of test subjects for testing in real world conditions

Editorially reviewed | evidence, fundamental-rights, innovation

The substantiation of your status as an SME or start-up with the date, the evidence of a registered office or branch in the Union, and per facility what was applied for, with which body, on what date and with what outcome, including the answer to how the fee reduction was applied.

Hangs off: Article 62: measures for providers and deployers that are SMEs or start-ups

Editorially reviewed | evidence, governance, innovation

The record of the test against Recommendation 2003/361/EC with the date, the evidence that there are no partner enterprises or linked enterprises, and the list of the elements of the quality management system for which you want to invoke a simplification once the Commission guidelines exist.

Hangs off: Article 63: derogations for SMEs in the quality management system

Editorially reviewed | evidence, high-risk-requirements, innovation

The plan as part of the technical documentation plus the periodic analyses and follow-up actions.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | evidence, post-market

Record of incidents, analyses, reports to supervisors and corrective measures.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | evidence, post-market

Per submission: which system, which document, which version, to which recipient, on what date, which part was marked confidential, and which purpose the recipient stated.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | enforcement, evidence, governance

Per system and per version: which intended purpose was taken, which standards, specifications, evaluation methods and test sets were treated as the state of the art, which were deliberately not applied and why, who established that, and on what date the record was reviewed again.

Hangs off: Article 8: compliance with the requirements for high-risk AI systems

Editorially reviewed | conformity, evidence, high-risk-requirements

Versioned record of risk analyses, chosen measures, residual risks and test results per system version.

Hangs off: Article 9: risk management system

Editorially reviewed | evidence, high-risk-requirements

Per system and per commitment: which requirements you apply voluntarily, under which paragraph of Article 95, with which objectives and key performance indicators, who owns it, when it is measured, and which obligation under the Regulation continues to apply in full alongside it.

Hangs off: Article 95: codes of conduct for voluntary application of specific requirements

Editorially reviewed | evidence, governance, innovation

Per obligation: which ceiling attaches to it and on which provision that rests, whether the level follows from national law and if so from which, and whether the Article 101 or Article 75c regime is added on top. This is the document that shows a board there is no single amount, and that substantiates where you make your controls heavier.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | enforcement, evidence

Per request: which authority made it and on what legal basis, on what date, on what grounds the request was reasoned, which documents and which logs were supplied, which system version they belong to, in what language and when. This file shows you delivered fully and in time, also years later when the staff involved have left.

Hangs off: Article 21: cooperation with competent authorities

Editorially reviewed | evidence, high-risk-requirements

Per processing operation: the system or model, the paragraph of Article 4a relied on, the justification why synthetic or anonymised data do not suffice, the technical and organisational safeguards applied, the access list, the confirmation that no other party can reach the data, and the deletion date. This is also the text that paragraph 1, point (f), requires in the record of processing activities.

Hangs off: Article 4a: legal basis for bias testing with special categories of personal data

Editorially reviewed | fundamental-rights, high-risk-requirements

The assessment, EU declaration of conformity, CE marking and registration proof, per system version.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, evidence

Per case: which signal came in and when, which system and which version it concerned, which measure was chosen and why, who decided on it, which parties were informed and when, and what the investigation of causes produced. This is the file that shows that "immediately" is a moment in your organisation rather than an estimate after the fact.

Hangs off: Article 20: corrective actions and duty of information

Editorially reviewed | evidence, post-market

The dossier that shows you retain the logs, that you informed workers and their representatives in time, and that the people about whom decisions are made are aware of it.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

A running record of what you checked, when, with what outcome and which action followed, because the supervisor asks about your conduct rather than about the system.

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

Per system: which Annex VIII data was entered, by which natural person with the legal authority to do so, on what date, in which version, when the entry was last checked against reality, and for a public deployer the URL of the entry made by the provider. This is also the file that shows the public entry and your internal documents say the same thing.

Hangs off: Article 71: EU database for high-risk AI systems listed in Annex III

Editorially reviewed | conformity, evidence

Per request: who made it, about which decision, which system and which version contributed to it, what explanation was given and when. This is also the file that shows you did not silently ignore the right.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority, Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

The sent notification through which you report the assessment results to the market surveillance authority, with the completed template attached, plus date of dispatch and acknowledgement of receipt.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

An overview indicating per Article 27(1) element whether it is already covered in the data protection impact assessment and where, so it is visible which elements exist only in the FRIA.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Dated impact assessment, measures, residual risks and, where required, notification to the market surveillance authority.

Hangs off: Article 27: FRIA

Editorially reviewed | evidence, fundamental-rights

Current technical documentation, downstream information, copyright policy and public training summary.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | evidence, gpai

A register with one row per model version: release date, distribution method, architecture and parameter count, compute used, and a note of which Annex XI and Annex XII elements changed relative to the previous version.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

The published, sufficiently detailed summary of the content used to train the model, drawn up according to the template provided by the AI Office, with publication date and the corresponding model version.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

The written mandate itself, in an official language of the institutions of the Union, together with the copy of the Annex XI technical documentation, the contact details of the provider, and the record of the verification under paragraph 3(a). The provider grants the mandate and supplies the documentation; the ten year retention after the placing on the market rests under paragraph 3(b) with the representative, which keeps the file at the disposal of the AI Office and national competent authorities.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | evidence, gpai

Your own archive of the notified body certificate, the instructions for use and the EU declaration of conformity, available for ten years and in a language the authority easily understands.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

Per report: what was reported, about which system and which version, what was done with it, when feedback was given and who handled it. The deadlines against which that is measured sit in Article 9(1) of Directive (EU) 2019/1937: acknowledgement of receipt within seven days (point (b)) and feedback within three months (point (f)). This file has limits that are as hard as the record keeping itself: the identity of the person reporting stays shielded and does not travel with the substantive follow-up (Article 16), nothing is retained longer than necessary and proportionate (Article 18(1)), and an oral report is recorded only with the consent of the person reporting (Article 18(2) to (4)). Without those limits the file is itself a risk, including under the GDPR.

Hangs off: Article 87: reporting of infringements and protection of reporting persons

Editorially reviewed | evidence, fundamental-rights

Per type and model: the date the first unit was placed on the market or put into service, the route and therefore the cut off date, whether it is intended to be used by public authorities, which design changes have been made since that cut off, and per change the judgement whether it was significant with the reasoning and the date. This is the file that shows which track a system was on and why.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

Per high-risk system: the certificate itself and the route along which it was issued, the notified body that issued it, its validity period and expiry date, its supplements, the extension requests with the re-assessment underlying them, the assessment per change of whether it was substantial within the meaning of Article 43(4), every decision to suspend, withdraw or restrict together with the reasons the body gave for it, and the notices from the body on cessation or change of its designation with the confirmation that followed.

Hangs off: Article 44: certificates of notified bodies

Editorially reviewed | conformity, evidence

Per body: identification number, Member State of establishment, the conformity assessment activities and system types for which it is notified, the date of each check against the public list, the outcome of the independence test, the subcontracted tasks with your written agreement, and every notice of a change to its designation.

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, evidence, governance

Per AI component: the intended purpose, the function inside the product, the failure analysis with its consequence for health and safety, the basis of the third-party conformity assessment, and which of paragraphs 1a, 1b and 1c was applied and why. This is a self-maintained file; the Regulation does not prescribe it, and for products under Annex I, Section B, the technical documentation of Article 11 and Annex IV does not apply at all.

Hangs off: Article 6(1a) to (1c): the tightened classification route

Editorially reviewed | conformity, high-risk

Per requirement of Section 2: the harmonised standard or common specification applied with its version, the publication status of the reference in the Official Journal, what the standard or specification does and does not cover, and on departure the Article 41(5) justification with the technical solution chosen and the test showing equivalence.

Hangs off: Articles 40 to 42: standards, common specifications and presumption of conformity

Editorially reviewed | conformity, evidence, standards

Per AI system: which model underlies it, from which provider, whether model and system come from the same undertaking, whether the system constitutes or is integrated into a designated very large online platform or search engine, which carve-out in paragraph 1 applies if any and which authority follows from it. With a date and with the system version the assessment covers.

Hangs off: Article 75: market surveillance, mutual assistance and the powers of the AI Office

Editorially reviewed | enforcement, evidence

Per model version: the measured and planned training compute with the scope of recital 111, so including pre-training, synthetic data generation and fine-tuning, the moment the threshold was reached or foreseen, the notification sent with its supporting information, any arguments under paragraph 2, any reassessment request under paragraph 5, and the response or designation decision of the Commission.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Record per system of role, contractual arrangements on information and cooperation, and the appointment of a representative where required.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | evidence, value-chain