# Technical Documentation for AI Systems — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/technical-documentation-ai > Sources are cited per item. Verify against the official texts before relying on them. The AI Act imposes specific technical documentation requirements for AI systems, particularly high-risk AI systems. This dedicated topic would cover the mandatory documentation of system design, functionality, performance, testing, and operational parameters required for AI Act compliance. ## Overview ## Legal Framework Article 11 of the AI Act establishes the core technical documentation obligation for providers of high-risk AI systems. Providers must draw up and maintain technical documentation demonstrating that their system complies with the requirements set out in Chapter III of the AI Act. This documentation must be prepared before the system is placed on the market or put into service and must be kept up to date throughout the system's lifecycle. The technical documentation must contain the elements specified in Annex IV of the AI Act, which covers: a general description of the AI system (intended purpose, name, version, nature of data, interaction with hardware/software); information on the system's development (design specifications, development process, data governance, data collection and preparation); information on the system's monitoring, functioning, and control (performance metrics, accuracy, robustness, cybersecurity measures); and information on risk management, post-market monitoring, and conformity assessment. Recital 109 introduces a proportionality principle for obligations on providers of general-purpose AI models, distinguishing between professional and non-professional or scientific research uses. Small and medium-sized enterprises, including start-ups, benefit from a proportionate compliance approach, though the core documentation obligations for high-risk systems remain mandatory regardless of provider size. The rationale behind Article 11 is to enable national competent authorities and notified bodies to assess conformity with the AI Act's substantive requirements. Without comprehensive technical documentation, authorities cannot verify whether a high-risk system meets the safety, transparency, and fundamental rights protections the Act demands. ## Key Developments The AI Act entered into force in August 2024, with high-risk system obligations becoming applicable from August 2026. As enforcement has not yet commenced, no case law or regulatory decisions interpreting Article 11 have emerged. However, the GDPR enforcement landscape offers instructive parallels. Data protection authorities have consistently treated inadequate documentation under Article 30 GDPR and Data Protection Impact Assessments under Article 35 GDPR as standalone violations warranting significant fines. The same enforcement philosophy is expected under the AI Act, where technical documentation serves as the primary evidence of compliance. The European Data Protection Board's coherence mechanism, referenced in the GDPR framework, provides a model for how AI Act authorities will coordinate enforcement of documentation requirements across Member States. Authorities are likely to request technical documentation during market surveillance activities and post-market investigations, making its completeness a first-line defense. ## Practical Guidance - **Prepare Annex IV documentation before market placement**: Technical documentation must exist before a high-risk AI system is placed on the market or put into service. Drafting it retrospectively constitutes non-compliance. - **Maintain living documentation**: Article 11 requires documentation to be kept up to date. Establish internal review cycles triggered by system updates, retraining, or significant changes to the operational environment. - **Align with risk management records**: The technical documentation must demonstrate how the risk management system required under Article 9 identified and mitigated risks. Ensure consistency between the risk register and the technical documentation. - **Document data governance comprehensively**: Annex IV requires detailed information on training, validation, and testing datasets, including their provenance, collection criteria, and data preparation processes. Maintain records that trace data lineage throughout the AI system lifecycle. - **Designate documentation ownership**: Assign clear responsibility for technical documentation to specific roles within the organization. Documentation gaps frequently arise from unclear ownership between engineering, legal, and compliance functions. ## Legislation (full text of key provisions) ### Technical documentation *Source: AI Act, aiact-art-11-en, 2024-06-12 — https://overview.legal/posts/92155* ### Amendment to Directive 2014/90/EU *Source: AI Act, aiact-art-105-en, 2024-06-12 — https://overview.legal/posts/93613* In Article 8 of Directive 2014/90/EU, the following paragraph is added:‘5. For Artificial Intelligence systems which are safety components within the meaning of Regulation (EU) 2024/1689 of the European Parliament and of the Council (*), when carrying out its activities pursuant to paragraph 1 and when adopting technical specifications and testing standards in accordance with paragraphs 2 and 3, the Commission shall take into account the requirements set out in Chapter III, Section 2, of that Regulation. ### Amendment to Regulation (EC) No 300/2008 *Source: AI Act, aiact-art-102-en, 2024-06-12 — https://overview.legal/posts/93607* In Article 4(3) of Regulation (EC) No 300/2008, the following subparagraph is added:‘When adopting detailed measures related to technical specifications and procedures for approval and use of security equipment concerning Artificial Intelligence systems within the meaning of Regulation (EU) 2024/1689 of the European Parliament and of the Council (*), the requirements set out in Chapter III, Section 2, of that Regulation shall be taken into account. ### Recital 71 — high-risk AI technical documentation and logs *Source: AI Act, aiact-rec-71-en, 2024-06-12 — https://overview.legal/posts/93824* Having comprehensible information on how high-risk AI systems have been developed and how they perform throughout their lifetime is essential to enable traceability of those systems, verify compliance with the requirements under this Regulation, as well as monitoring of their operations and post market monitoring. This requires keeping records and the availability of technical documentation, containing information which is necessary to assess the compliance of the AI system with the relevant requirements and facilitate post market monitoring. Such information should include the general characteristics, capabilities and limitations of the system, algorithms, data, training, testing and validation processes used as well as documentation on the relevant risk-management system and drawn in a clear and comprehensive form. The technical documentation should be kept up to date, appropriately throughout the lifetime of the AI system. Furthermore, high-risk AI systems should technically allow for the automatic recording of events, by means of logs, over the duration of the lifetime of the system. ### Recital 109 — proportionate compliance for general-purpose AI providers *Source: AI Act, aiact-rec-109-en, 2024-06-12 — https://overview.legal/posts/93900* Compliance with the obligations applicable to the providers of general-purpose AI models should be commensurate and proportionate to the type of model provider, excluding the need for compliance for persons who develop or use models for non-professional or scientific research purposes, who should nevertheless be encouraged to voluntarily comply with these requirements. Without prejudice to Union copyright law, compliance with those obligations should take due account of the size of the provider and allow simplified ways of compliance for SMEs, including start-ups, that should not represent an excessive cost and not discourage the use of such models. In the case of a modification or fine-tuning of a model, the obligations for providers of general-purpose AI models should be limited to that modification or fine-tuning, for example by complementing the already existing technical documentation with information on the modifications, including new training data sources, as a means to comply with the value chain obligations provided in this Regulation. ### Recital 101 — General-purpose AI model provider transparency obligations *Source: AI Act, aiact-rec-101-en, 2024-06-12 — https://overview.legal/posts/93884* Providers of general-purpose AI models have a particular role and responsibility along the AI value chain, as the models they provide may form the basis for a range of downstream systems, often provided by downstream providers that necessitate a good understanding of the models and their capabilities, both to enable the integration of such models into their products, and to fulfil their obligations under this or other regulations. Therefore, proportionate transparency measures should be laid down, including the drawing up and keeping up to date of documentation, and the provision of information on the general-purpose AI model for its usage by the downstream providers. Technical documentation should be prepared and kept up to date by the general-purpose AI model provider for the purpose of making it available, upon request, to the AI Office and the national competent authorities. The minimal set of elements to be included in such documentation should be set out in specific annexes to this Regulation. The Commission should be empowered to amend those annexes by means of delegated acts in light of evolving technological developments. ### Recital 149 — AI Board establishment and advisory tasks *Source: AI Act, aiact-rec-149-en, 2024-06-12 — https://overview.legal/posts/93980* In order to facilitate a smooth, effective and harmonised implementation of this Regulation a Board should be established. The Board should reflect the various interests of the AI eco-system and be composed of representatives of the Member States. The Board should be responsible for a number of advisory tasks, including issuing opinions, recommendations, advice or contributing to guidance on matters related to the implementation of this Regulation, including on enforcement matters, technical specifications or existing standards regarding the requirements established in this Regulation and providing advice to the Commission and the Member States and their national competent authorities on specific questions related to AI. In order to give some flexibility to Member States in the designation of their representatives in the Board, such representatives may be any persons belonging to public entities who should have the relevant competences and powers to facilitate coordination at national level and contribute to the achievement of the Board’s tasks. The Board should establish two standing sub-groups to provide a platform for cooperation and exchange among market surveillance authorities and notifying authorities on issues related, respectively, to market surveillance and notified bodies. The standing subgroup for market surveillance should act as the administrative cooperation group (ADCO) for this Regulation within the meaning of Article 30 of Regulation (EU) 2019/1020. In accordance with Article 33 of that Regulation, the Commission should support the activities of the standing subgroup for market surveillance by undertaking market evaluations or studies, in particular with a view to identifying aspects of this Regulation requiring specific and urgent coordination among market surveillance authorities. The Board may establish other standing or temporary sub-groups as appropriate for the purpose of examining specific issues. The Board should also cooperate, as appropriate, with relevant Union bodies, experts groups and networks active in the context of relevant Union law, including in particular those active under relevant Union law on data, digital products and services. ### Recital 173 — Commission delegated powers to adapt AI rules *Source: AI Act, aiact-rec-173-en, 2024-06-12 — https://overview.legal/posts/94028* In order to ensure that the regulatory framework can be adapted where necessary, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to amend the conditions under which an AI system is not to be considered to be high-risk, the list of high-risk AI systems, the provisions regarding technical documentation, the content of the EU declaration of conformity the provisions regarding the conformity assessment procedures, the provisions establishing the high-risk AI systems to which the conformity assessment procedure based on assessment of the quality management system and assessment of the technical documentation should apply, the threshold, benchmarks and indicators, including by supplementing those benchmarks and indicators, in the rules for the classification of general-purpose AI models with systemic risk, the criteria for the designation of general-purpose AI models with systemic risk, the technical documentation for providers of general-purpose AI models and the transparency information for providers of general-purpose AI models. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (55). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. ### Recital 66 — risk management requirements for high-risk AI *Source: AI Act, aiact-rec-66-en, 2024-06-12 — https://overview.legal/posts/93814* Requirements should apply to high-risk AI systems as regards risk management, the quality and relevance of data sets used, technical documentation and record-keeping, transparency and the provision of information to deployers, human oversight, and robustness, accuracy and cybersecurity. Those requirements are necessary to effectively mitigate the risks for health, safety and fundamental rights. As no other less trade restrictive measures are reasonably available those requirements are not unjustified restrictions to trade. ### Recital 9 — Harmonised cross-sectoral high-risk AI market rules *Source: AI Act, aiact-rec-9-en, 2024-06-12 — https://overview.legal/posts/93700* Harmonised rules applicable to the placing on the market, the putting into service and the use of high-risk AI systems should be laid down consistently with Regulation (EC) No 765/2008 of the European Parliament and of the Council (7), Decision No 768/2008/EC of the European Parliament and of the Council (8) and Regulation (EU) 2019/1020 of the European Parliament and of the Council (9) (New Legislative Framework). The harmonised rules laid down in this Regulation should apply across sectors and, in line with the New Legislative Framework, should be without prejudice to existing Union law, in particular on data protection, consumer protection, fundamental rights, employment, and protection of workers, and product safety, to which this Regulation is complementary. As a consequence, all rights and remedies provided for by such Union law to consumers, and other persons on whom AI systems may have a negative impact, including as regards the compensation of possible damages pursuant to Council Directive 85/374/EEC (10) remain unaffected and fully applicable. Furthermore, in the context of employment and protection of workers, this Regulation should therefore not affect Union law on social policy and national labour law, in compliance with Union law, concerning employment and working conditions, including health and safety at work and the relationship between employers and workers. This Regulation should also not affect the exercise of fundamental rights as recognised in the Member States and at Union level, including the right or freedom to strike or to take other action covered by the specific industrial relations systems in Member States as well as the right to negotiate, to conclude and enforce collective agreements or to take collective action in accordance with national law. This Regulation should not affect the provisions aiming to improve working conditions in platform work laid down in a Directive of the European Parliament and of the Council on improving working conditions in platform work. Moreover, this Regulation aims to strengthen the effectiveness of such existing rights and remedies by establishing specific requirements and obligations, including in respect of the transparency, technical documentation and record-keeping of AI systems. Furthermore, the obligations placed on various operators involved in the AI value chain under this Regulation should apply without prejudice to national law, in compliance with Union law, having the effect of limiting the use of certain AI systems where such law falls outside the scope of this Regulation or pursues legitimate public interest objectives other than those pursued by this Regulation. For example, national labour law and law on the protection of minors, namely persons below the age of 18, taking into account the UNCRC General Comment No 25 (2021) on children’s rights in relation to the digital environment, insofar as they are not specific to AI systems and pursue other legitimate public interest objectives, should not be affected by this Regulation. ## Guidance ### Report on stakeholder event on processing of personal data to target or deliver political advertisements *Source: EDPB, report-on-stakeholder-event-on-processing-of-personal-data-en, 2026-03-27 — https://overview.legal/posts/125684 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/report-on-stakeholder-event-on-processing-of-personal-data_en* Report on stakeholder event on processing of personal data to target or deliver political advertisements 27 March 2026 1. Background The EDPB organised an online stakeholder event on 27 March 2026 to collect stakeholders’ input on processing of personal data to target or deliver political advertisements. The objective was to engage with stakeholders at an early stage of drafting the EDPB Guidelines on the processing of personal data to target or deliver political advertisements (Chapter III of… ## Literature ### From the EU AI Act to Audit Practice: A Governance-to-Controls Framework for Quality Management and Evidence *Source: Accounting and Auditing, 2026-07-15 — https://overview.legal/posts/132365 — original: https://doi.org/10.3390/accountaudit2030012* Artificial intelligence (AI) tools—including audit data analytics, robotic process automation, machine-learning models, and generative AI—are changing how audit teams identify risks, select procedures, and evaluate evidence. At the same time, Regulation (EU) 2024/1689 (the EU AI Act) establishes a risk-based governance architecture built around risk management, data governance, technical documentation, logging, transparency, human oversight, robustness, cybersecurity, and post-market monitoring. ### REGULATION OF APPLIED ARTIFICIAL INTELLIGENCE IN BIOMEDICAL ENGINEERING AS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IN THE EU AI ACT *Source: AFMN Biomedicine, 2026-07-13 — https://overview.legal/posts/132435 — original: https://doi.org/10.65641/afmnai-2026-075* lt;p style= quot;text-align: justify; quot; gt; lt;span class= quot;a_GcMg font-feature-liga-off font-feature-clig-off font-feature-calt-off text-decoration-none text-strikethrough-none quot; gt;Artificial intelligence (AI) represents a global phenomenon changing all spheres of human life. Biomedical engineering is no exception, as many AI systems are applied to biomedical engineering inventions. The European Union has enacted the new EU AI Act, one of the world amp;rsquo;s first laws on AI. The ### General-Purpose AI under the EU AI Act: A Conceptual Allocation of Duties across the Value Chain *Source: SCRIPTed A Journal of Law Technology & Society, 2026-06-30 — https://overview.legal/posts/132370 — original: https://doi.org/10.2218/scrip.12300* This article examines how the final version of the EU Artificial Intelligence Act (“AI Act”, adopted 2024) allocates obligations across the AI value chain, with a focus on general-purpose AI (“GPAI”) or foundation models. It proposes a taxonomy of key actors – foundation model providers, fine-tuners, integrators, and deployers – and analyses the interfaces between them, including documentation tools (model cards, system cards) and logging requirements. Building on principles of control, foreseea ### Technical Documentation Obligations in Data Protection, Technology, and Cybersecurity Law *Source: Computer Law Review International, 2026-03-01 — https://overview.legal/posts/132593 — original: https://doi.org/10.9785/cri-2026-270104* Abstract The article examines the obligation to prepare technical documentation under the GDPR, the CRA, and the AI Act, conducts a comparative analysis to explore synergies, overlaps, and divergences between the technical documentation obligations under the three frameworks, and assesses the feasibility of developing joint technical documentation. ### Italy’s Artificial Intelligence Act and Global AI Governance: The EU Model’s Practice and Prospects *Source: Law and Economy, 2026-02-25 — https://overview.legal/posts/132619 — original: https://doi.org/10.63593/le.2788-7049.2026.03.004* The Italian Artificial Intelligence Act, enacted on September 17, 2025, represents the first comprehensive national implementation of the European Union’s AI Act. This study examines the Italian legislation through the theoretical lens of multi-level governance, analyzing its dual function as both a “bridging legislation” that translates EU framework into domestic practice and a site of significant regulatory innovation. Through detailed textual analysis and case studies, particularly in healthc ## Related topics - **AI Record-Keeping** — https://overview.legal/topics/record-keeping-ai The AI Act imposes specific record-keeping obligations for AI systems that are distinct from general GDPR record-keeping. A dedicated topic would capture AI-spe - **Provider Obligations for AI Systems** — https://overview.legal/topics/provider-obligations-ai The content specifically addresses obligations imposed on providers of high-risk AI systems, which is a distinct and important category of requirements that des - **Documentation Keeping for AI Systems** — https://overview.legal/topics/documentation-keeping-ai While 'record-keeping-ai' exists, a more specific topic focused on documentation keeping as a distinct concept would better capture the AI Act's specific requir - **AI Act Requirements** — https://overview.legal/topics/ai-act-requirements The content specifically addresses 'Compliance with the requirements' from the AI Act, which warrants a dedicated topic for AI Act-specific requirements that go - **Conformity Assessment for AI Systems** — https://overview.legal/topics/conformity-assessment-ai Provider obligations typically include conformity assessment procedures and documentation requirements, which is a specific compliance mechanism under the AI Ac - **Artificial Intelligence** — https://overview.legal/topics/ai AI systems and their implications for data protection --- Generated by overview.legal · https://overview.legal/topics/technical-documentation-ai · 2026-08-22