What Classifies as a High-Risk AI System?
High-risk AI systems are those that pose a significant threat to the health, safety, or fundamental rights of individuals. These are heavily regulated under the EU AI Act.
Examples include AI used in critical infrastructure, medical devices, educational admissions, employment screening, essential private and public services (like credit scoring), and law enforcement.
Purpose of the Annex IV Technical Documentation
The Annex IV documentation is the cornerstone of high-risk AI compliance. It must be drawn up before the system is placed on the market and kept up-to-date throughout its lifecycle.
Its purpose is to provide authorities and notified bodies with all the necessary information to assess the system's compliance. It acts as a comprehensive blueprint of the system's design, logic, and safety guardrails.
Essential Elements: Risk Management and Data Governance
A major section of the dossier must detail the risk management system. This involves identifying potential risks to health, safety, and rights, and outlining the specific technical or operational measures implemented to mitigate them.
Additionally, data governance practices must be documented. You must describe the training, validation, and testing datasets used, detailing their provenance, quality checks, and how bias was identified and addressed.
Logging, Monitoring, and Human Oversight
High-risk systems must automatically record events ('logs') to trace operations and facilitate post-market monitoring. The documentation must detail the architecture of these logging capabilities.
Furthermore, the system must be designed to allow for effective human oversight. The technical documentation should outline the instructions for use provided to deployers, ensuring they understand how to monitor the AI and override its decisions if necessary.
Frequently asked questions
Who is responsible for creating the Annex IV documentation?
The 'provider' (the developer or manufacturer) of the high-risk AI system is legally responsible for drafting and maintaining the technical documentation before placing it on the EU market.
How long must the technical documentation be retained?
Providers must keep the technical documentation at the disposal of national competent authorities for a period of 10 years after the AI system has been placed on the market.
Do I need to disclose my algorithm's source code in the documentation?
No, the AI Act does not generally require the disclosure of source code in the technical documentation, but it does require a detailed description of the system's architecture, logic, and algorithmic choices.
What happens if a high-risk system undergoes a major update?
If an update substantially modifies the system's intended purpose or significantly alters its performance, a new conformity assessment is required, and the technical documentation must be comprehensively updated.
Is third-party auditing required for the documentation?
For certain high-risk systems, particularly those related to biometrics or critical safety components, a third-party conformity assessment by a Notified Body is required to review the documentation.