Who is a "provider" under the EU AI Act?

Anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, paid or free. A deployer also becomes a provider under Article 25 if it puts its name on a high-risk system or makes a substantial modification to one.

What is the current deadline for Annex IV technical documentation?

Regulation (EU) 2026/1744 moved the high-risk obligations to December 2, 2027 for Annex III systems and August 2, 2028 for systems that are high-risk under Article 6(1) and Annex I. The documentation must exist before the system is placed on the market or put into service.

Can an SME provide simplified Annex IV documentation?

Yes. Article 11(1), as amended by the Omnibus, lets SMEs, start-ups and small mid-caps provide the Annex IV elements in a simplified manner. If you take that route you must use the Commission's simplified form, and notified bodies must accept it.

Do we need a notified body?

Not for most Annex III systems. For points 2 to 8 of Annex III, Article 43(2) requires internal control under Annex VI, with no notified body. Biometric systems under point 1 follow Article 43(1) and may need one, depending on the standards applied.

What happens if the technical documentation is missing?

Under Article 83, if the market surveillance authority finds the technical documentation is not available, it must require you to end the non-compliance. If that persists, it must take measures to restrict, prohibit or recall the system. Fines under Article 99 can also apply.

What language must the documentation be in?

Article 21 requires providers to hand documentation to a competent authority, on reasoned request, in a language the authority can easily understand, in one of the official EU languages indicated by the Member State concerned.

How long must we keep it?

Article 18 requires providers to keep the technical documentation at the disposal of national competent authorities for 10 years after the system is placed on the market or put into service. The EU declaration of conformity has the same 10-year period under Article 47.

EU AI Act Annex IV Technical Documentation Templates

Image: Pexels, used under the Pexels License.

What changed since we first published this: Regulation (EU) 2026/1744, the Digital Omnibus on AI, is now law. It moved the high-risk dates, extended the simplified documentation route to small mid-cap companies (SMCs), and made the simplified form mandatory for anyone who uses that route. We also rechecked every Annex IV point against the text. The previous version listed some requirements that are not in Annex IV and missed several that are, and it cited the SME rule as Article 11(2). It is in Article 11(1).

TL;DR: Article 11 requires providers of high-risk AI systems to draw up technical documentation before the system is placed on the market or put into service, keep it up to date, and include at least the nine points of Annex IV. The date is now December 2, 2027 for Annex III systems and August 2, 2028 for Annex I product systems. SMEs, start-ups and SMCs may use the Commission's simplified form. Keep the file for 10 years.

Who needs Annex IV documentation

Annex IV applies to providers of high-risk AI systems. A provider is anyone who "develops an AI system ... or that has an AI system ... developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge."

Your system is high-risk under Annex III if it is used in one of these areas, within the specific uses the annex lists:

Biometrics (remote identification, categorisation, emotion recognition)
Critical infrastructure
Education and vocational training
Employment and workers management
Access to essential private and public services, including credit scoring and risk assessment and pricing for life and health insurance
Law enforcement
Migration, asylum and border control
Administration of justice and democratic processes

You can also inherit the job. Under Article 25(1), a distributor, importer or deployer becomes the provider if it puts its name or trademark on a high-risk system already on the market, or makes a substantial modification that leaves it high-risk. If you fine-tune or re-scope a vendor's high-risk tool and sell it under your brand, the Annex IV file becomes yours.

The dates after the Omnibus

What	Original date	Date now
High-risk obligations, Annex III systems (Chapter III, Sections 1 to 3)	August 2, 2026	December 2, 2027
High-risk obligations, Article 6(1) and Annex I product systems	August 2, 2027	August 2, 2028
General-purpose AI model obligations (Chapter V)	August 2, 2025	August 2, 2025 (unchanged)
Article 50(2) marking of synthetic content, systems already on the market before August 2, 2026	August 2, 2026	December 2, 2026

The Omnibus moved Chapter III, Sections 1, 2 and 3 (except Article 6(5)) as a block. Its stated reason is "the delayed availability of standards, common specifications, and alternative guidance". It did not move the other Article 50 transparency duties; only the 50(2) marking duty gets the four-month transition, and only for systems placed on the market before August 2, 2026.

EU AI Act Service Desk, Article 11 Technical documentation, showing the paragraph marked AMENDED with SMEs, start-ups and SMCs

Screenshot: Article 11, AI Act Explorer, AI Act Service Desk, European Commission.

The simplified route for SMEs and SMCs

The amended Article 11(1) now reads: "SMEs, including start-ups, and SMCs, may provide the elements of the technical documentation specified in Annex IV in a simplified manner." Two conditions come with it. If you opt in, you "shall use the form referred to in this paragraph", the one the Commission must establish. And "Notified bodies shall accept the form for the purposes of the conformity assessment."

The Commission's AI Act Service Desk marks the paragraph as AMENDED and says its text is based on the consolidated version as at 27 July 2026. That is the page to watch for the form.

Separately, the Omnibus rewrote Article 17(2), on the quality management system: implementing it "shall be proportionate to the size of the provider's organisation", naming SMEs, start-ups and SMCs. It also says providers "shall, in any event, respect the degree of rigour and the level of protection required". Simplified means shorter, not thinner.

Annex IV in one page: nine points, suggested owners, and the linked AI Act articles

Image: aipolicydesk.com chart; source: Annex IV of Regulation (EU) 2024/1689. Owners are our suggestion.

What Annex IV requires: the nine points, with templates

Annex IV says the file "shall contain at least the following information, as applicable to the relevant AI system". Below, each point gives what the annex actually asks for, then a template you can paste into your document system. The templates are ours.

EU AI Act Service Desk, Annex IV, point 1 general description items (a) to (h)

Screenshot: Annex IV, AI Act Explorer, AI Act Service Desk, European Commission.

Point 1: General description

What the annex asks for: intended purpose, provider name and version (and how it relates to previous versions); interaction with hardware, software or other AI systems; software and firmware versions and update requirements; every form in which the system is placed on the market (embedded, download, API); the hardware it runs on; photos or illustrations if it is a component of a product; a basic description of the user interface; instructions for use for the deployer.

1. General description
1.1 Intended purpose: [one paragraph, specific users and context]
1.2 Provider: [legal name, address]  Version: [X.Y.Z], replaces [X.Y.Z-1] because [...]
1.3 Interactions: [systems, APIs, other AI systems it calls or is called by]
1.4 Software/firmware versions and update requirements: [...]
1.5 Forms placed on the market: [SaaS / API / on-prem package]
1.6 Hardware it runs on: [...]
1.7 User interface for the deployer: [screens, controls; attach screenshots]
1.8 Instructions for use: [link to the Article 13 instructions document]

Point 2: Elements of the system and the development process

What the annex asks for: development methods, including use of pre-trained systems or third-party tools and how you modified them; design specifications (general logic, key design choices and their rationale, who the system is meant to be used on, what it optimises for, expected output quality, trade-offs); system architecture and the compute used to develop, train, test and validate; datasheets for training data (provenance, scope, how obtained and selected, labelling, cleaning); the Article 14 human oversight assessment; pre-determined changes; validation and testing procedures with metrics for accuracy, robustness and "potentially discriminatory impacts", plus "test logs and all test reports dated and signed by the responsible persons"; and cybersecurity measures.

2. Elements and development
2.1 Third-party components: [foundation model, provider, version; what you changed]
2.2 Design choices and rationale: [optimisation target, assumptions about users and affected persons]
2.3 Architecture and compute: [diagram; training/eval compute]
2.4 Data sheets: [per dataset: source, scope, selection, labelling, cleaning]
2.5 Human oversight assessment (Art 14): [...]
2.6 Pre-determined changes: [what may change without a new conformity assessment]
2.7 Test procedures and results: [metrics incl. discriminatory impact; signed, dated test reports]
2.8 Cybersecurity measures: [...]

Start the signed test log on day one. It is the item you cannot honestly rebuild later.

A dark analytics dashboard with conversion and quality-score tiles on a screen, representing EU AI Act Annex IV technical documentation sections

Image: Unsplash, used under the Unsplash License.

Point 3: Monitoring, functioning and control

What the annex asks for: capabilities and limitations in performance, including accuracy for the specific persons or groups the system is used on and the overall expected accuracy; foreseeable unintended outcomes and sources of risk to health, safety, fundamental rights and discrimination; the human oversight measures; and specifications on input data.

3. Monitoring, functioning and control
3.1 Expected accuracy overall: [...]  By group: [table]
3.2 Foreseeable unintended outcomes: [...]
3.3 Human oversight measures in operation: [who reviews, what they see, how they override]
3.4 Input data specifications: [formats, ranges, out-of-scope inputs]

Point 4: Appropriateness of the performance metrics

What the annex asks for: "A description of the appropriateness of the performance metrics for the specific AI system". One section, one question: why these metrics, for this use.

4. Metric appropriateness
4.1 Metrics chosen: [...]
4.2 Why they fit the intended purpose and the people affected: [...]
4.3 Metrics considered and rejected, and why: [...]

Point 5: Risk management system

What the annex asks for: "A detailed description of the risk management system in accordance with Article 9."

5. Risk management (Art 9)
5.1 Process and owner: [how often reviewed, by whom]
5.2 Risk register: [ID | risk | affected persons | likelihood | severity | mitigation | residual]
5.3 Residual risks communicated to deployers: [where in the instructions for use]

Point 6: Changes through the lifecycle

What the annex asks for: "A description of relevant changes made by the provider to the system through its lifecycle". This links to Article 43(4): a substantial modification triggers a new conformity assessment, unless the change was pre-determined in point 2.

6. Change log
[Date | version | change | pre-determined (Y/N) | substantial modification assessment | approver]

Point 7: Standards applied

What the annex asks for: the harmonised standards applied, in full or in part, whose references are published in the Official Journal; where none were applied, a detailed description of the solutions adopted to meet Chapter III, Section 2, plus other standards and technical specifications used.

7. Standards and solutions
7.1 Harmonised standards applied (OJ reference): [...]
7.2 If none: requirement-by-requirement solutions (Art 9 to 15): [...]
7.3 Other standards or specifications used: [...]

Point 8: Copy of the EU declaration of conformity

What the annex asks for: "A copy of the EU declaration of conformity referred to in Article 47". The declaration itself follows Annex V: system name, type and reference; provider name and address; a statement that it is issued under the provider's sole responsibility; a statement of conformity; a GDPR compliance statement if personal data is processed; standards referenced; notified body details where applicable; and place, date, name and function of the signatory, with a signature.

8. EU declaration of conformity (copy)
[Attach signed Annex V declaration; record date signed and signatory]

Point 9: Post-market monitoring

What the annex asks for: "A detailed description of the system in place to evaluate the AI system performance in the post-market phase in accordance with Article 72, including the post-market monitoring plan referred to in Article 72(3)."

9. Post-market monitoring (Art 72)
9.1 Data collected after deployment and from whom: [...]
9.2 Review triggers: [metric thresholds that start a review]
9.3 Serious incident route: [who decides, who reports]
9.4 How findings flow back into points 2, 5 and 6: [...]

Conformity assessment, retention and language

Conformity assessment. For Annex III points 2 to 8, Article 43(2) requires "the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body". Biometric systems under point 1 follow Article 43(1).
Retention. Article 18: keep the technical documentation for "a period ending 10 years after the high-risk AI system has been placed on the market or put into service".
Language. Article 21(1): on reasoned request, give the authority the documentation "in a language which can be easily understood by the authority in one of the official languages of the institutions of the Union" indicated by the Member State.
Missing file. Article 83 lists "technical documentation is not available" as formal non-compliance. The authority first requires you to fix it; if it persists, it must restrict, prohibit or recall.

How to start building documentation now

Our suggested sequence for a team shipping an Annex III system before December 2, 2027:

First month

Confirm the Annex III classification, and check whether Article 25 makes you the provider of something you bought
Create the file with all nine points as empty sections
Start the signed test log (point 2) and the change log (point 6)

Next quarter

Fill points 1, 3 and 4 for the current version
Build the risk register (point 5)
Decide whether you qualify as an SME or SMC and will use the simplified form

Before release

Complete point 7 against whatever harmonised standards have been published
Run the Annex VI internal control and sign the Annex V declaration (point 8)
Finalise the post-market monitoring plan (point 9)

For the wider calendar, see EU AI Act: what is delayed vs what applies and the Digital Omnibus deadline article. For support schemes, see EU AI Act SME sandbox and support measures.

Our take

I'd treat the extra 16 months as time to document while building, not time to wait. Points 1, 4, 5, 7 and 9 can be written at the end if you must. Points 2 and 6 can't: a dated, signed test report and a change log with substantial-modification calls only mean something if they were made at the time. If you are an SME or SMC, plan to use the simplified form, but don't let "simplified" slide into "partial". The amended Article 17(2) still asks for "the degree of rigour" the Act requires. The cheapest version of this file is the one your engineers update in the same pull request as the change.

How we checked this: we read Article 11, Annex IV, Annex V and Articles 18, 21, 25, 43, 47 and 83 of Regulation (EU) 2024/1689 and the amending Regulation (EU) 2026/1744 on EUR-Lex, and the AI Act Service Desk's consolidated text. We took two screenshots from the Service Desk and built the one-page map. Templates and the build sequence are ours. Last reviewed: October 13, 2026.