EU AI Act Article 11 — Technical Documentation Requirements

What Article 11 actually requires

Article 11(1) of Regulation (EU) 2024/1689 is a single, dense paragraph. Providers of high-risk AI systems must:

1. Draw up technical documentation before placing the system on the market or putting it into service.
2. Keep that documentation up to date throughout the system's lifecycle.
3. Demonstrate that the system meets the Chapter III Section 2 requirements — Articles 9 (risk management), 10 (data governance), 11 (technical documentation), 12 (record-keeping), 13 (transparency), 14 (human oversight), and 15 (accuracy, robustness, cybersecurity).
4. Make the documentation available to national competent authorities and notified bodies in a clear and comprehensive form, in a language those authorities can understand.

The substantive content sits in Annex IV. That's where the eight mandatory sections are defined. Article 11 itself is the procedural shell — the obligation, the timing, and the audience.

Reg text — Article 11(1): "The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to-date."

Two things to underline. "Before placing on the market" is a hard gate — Article 16(c) makes lack of technical documentation an explicit provider non-conformity, and Article 49 registration in the EU database requires you to attest the file exists. "Kept up to date" means Annex IV is not a one-off deliverable. Every material change to the system — retraining, architectural change, new feature — has to flow into Section 5 of the file (lifecycle changes).

Who is covered

Article 11 applies to providers of high-risk AI systems, which means:

• The natural or legal person who develops the high-risk AI system, or has it developed, with a view to placing it on the market or putting it into service under their own name or trademark (Article 3(3)).
• Operators outside the EU whose systems' output is used in the Union (Article 2(1)(c)) — extraterritorial reach is roughly GDPR-style.
• Deployers who put their name on a third-party system, who substantially modify it, or who change its intended purpose to a high-risk one. Article 25 promotes them to "provider" for Article 11 purposes.

What about SMEs and start-ups? Article 11(1) second subparagraph allows providers that are SMEs (including start-ups, as defined in Commission Recommendation 2003/361/EC) to file Annex IV documentation in a simplified form. The Commission is required by Article 11(2) to publish that simplified template via implementing act. As of mid-2026 the simplified form is a Commission draft — until the official template is published, SMEs should still cover all eight Annex IV headings, but they can compress evidence to the essential paragraph per heading.

What about GPAI providers? Article 53 has its own technical documentation regime in Annex XI for general-purpose AI models, separate from Annex IV. A GPAI model integrated into a high-risk AI system can re-use the GPAI documentation as inputs but the integrator (provider of the high-risk system) still owes the Annex IV file under Article 11.

What to do — the eight Annex IV sections

The eight sections of Annex IV are, in order:

1. General description of the AI system — intended purpose, provider name, version, hardware/software interactions, instructions for use, user interface description.
2. Detailed description of elements and the development process — methods, design specifications, system architecture, computational resources, data requirements, validation and testing, cybersecurity measures.
3. Monitoring, functioning and control — accuracy levels, foreseeable unintended outcomes, risks to health/safety/fundamental rights, human oversight measures, input data specifications.
4. Risk management system — a description of the Article 9 system: identified risks, mitigations, residual risks, review cadence.
5. Lifecycle changes — every material change made by the provider through the system's life (model retrains, architecture changes, feature additions, hyperparameter shifts that change the risk profile).
6. Standards and specifications applied — list of harmonised standards under Article 40, common specifications under Article 41, and where deviations exist, the alternative solutions.
7. EU declaration of conformity — a copy of the Article 47 declaration, signed by a named accountable person.
8. Post-market monitoring plan — the Article 72 plan: performance evaluation in deployment, drift monitoring, complaint channels, incident triage tied to Article 79.

Each section deserves its own deep dive. We split them into dedicated reference pages: system description, data, risk management, accuracy, human oversight, change management, post-market monitoring, and conformity assessment.

What regulators look at first

From conversations with two EU national competent authorities during the 2025 pre-enforcement consultations (and from the public Commission FAQ updates of Q1 2026), three things get opened first when a market surveillance officer reaches for an Annex IV file:

1. The changelog in Section 5. Too regular and they assume the document is retroactive — you back-filled it the night before the inspection. Too sparse and they assume you're not maintaining it. Realistic teams produce 1–4 entries per quarter for an actively-developed system.
2. The data lineage paragraph in Section 2. Specifically: the legal basis under GDPR for using personal data in training, and (if you process special-category data) which Article 9 GDPR derogation you rely on. Article 10(5) of the AI Act creates a derogation for special-category data when used for bias detection, but the conditions are strict — state them explicitly.
3. Human oversight in Section 3. They'll ask for the training records of the overseers. If you can't produce them, your entire Article 14 compliance is in question regardless of how good the SOP looks on paper.

The eight-week build vs. the weekend draft

Most providers we work with go through two phases.

Weekend draft (v0.1). Fill Sections 1, 6, 7 first — they're short. Then Section 5 (changelog, pulled from your git log). Then Section 2 (architecture + data + hyperparameters). Sections 3, 4, 8 last — these reference the Article 9, 14 and 72 artefacts and need stub paragraphs naming the artefact and the date you'll have it complete. End of weekend: 15–25 pages. Defensible enough for an internal review, not yet defensible to a regulator.

Eight-week production build. Real risk register entries with quantified residual risk. Real validation results disaggregated by demographic group (Article 15(3) + Annex IV(2)(b)). Real adversarial-test reports (Annex IV(2)(g)). Real changelog populated by hooks in your CI pipeline. Real post-market monitoring data for at least 90 days of operation. End of week 8: a 40–80 page file that survives an Article 74 inspection.

Inline crosswalk to ISO 42001 and NIST AI RMF

The Article 11 technical file is the EU AI Act manifestation of two well-known governance controls: ISO/IEC 42001 lifecycle documentation and NIST AI RMF MAP 4.1 system-context documentation.

• ISO/IEC 42001:2023 Clause 7.5 — Documented information. The Article 11 file is the AIMS-required documented information evidencing AI system design, purpose, and risk decisions.
• ISO/IEC 42001:2023 Annex A.6.2 — AI system life cycle documentation. The Article 11 file is its EU AI Act manifestation.
• NIST AI RMF MAP 4.1 — Approaches and metrics for measurement of AI risks; documentation includes purpose, intended use, users, and limitations. The Article 11 file documents purpose, design and limitations — the system-context output expected by MAP 4.1.
• NIST AI RMF GOVERN 1.4 — The risk management process is documented and is regularly reviewed. Maintaining a living technical file is the documented and regularly reviewed risk-management evidence.

A team that has a complete Article 11 file is, in practice, 70–80% of the way to an ISO 42001 AIMS audit and a NIST AI RMF self-attestation. The remaining 20–30% is the management-system overlay: roles and responsibilities (ISO 42001 Clause 5), AI policy (Clause 5.2), internal audit programme (Clause 9.2). The Annex IV file evidences the technical depth; ISO/NIST evidences the organisational wrapper.

Penalties and enforcement realism

Article 99(4) sets non-compliance with provider obligations under Chapter III Section 2 — which Article 11 is — at up to €15 million or 3% of total worldwide annual turnover, whichever is higher. SMEs and start-ups are subject to the lower of the two figures (Article 99(6)).

But the realistic cost of an incomplete Annex IV file is not the fine. It's that under Article 79 a market surveillance authority can require you to withdraw the system from the market while you fix the documentation. For a revenue-generating product, that's the cost that matters.

A common misreading of Article 11

The most frequent misreading we see: teams treat Article 11 as a product launch deliverable and freeze the file the day they ship. Wrong. Article 11(1) explicitly says "kept up-to-date." Annex IV §5 (lifecycle changes) is an append-only obligation. A file that has not been touched in 12 months for an actively-deployed model is, by itself, non-conformity evidence.

The fix: bind documentation events to engineering events. Every model retrain triggers a Section 5 entry. Every architecture change triggers Section 2 + Section 5. Every accuracy-metric refresh updates Section 3. We write a 30-line GitHub Action that does this; it's not exotic.

Frequently asked questions

Q: Does my SaaS app need an Article 11 file if I integrate a third-party LLM?

It depends on whether you are a provider under Article 25. If you put the SaaS under your own brand, substantially modify the LLM, or change the intended purpose to a high-risk Annex III use case, yes — you owe the file. Your upstream vendor's GPAI Annex XI documentation is an input but not a substitute. See our EU AI Act for SaaS pillar for the full decision tree.

Q: Can I copy my ISO 42001 documentation into Annex IV?

Partially. ISO 42001 documented information overlaps Annex IV §1, §2 and §6 well. It does not cover Annex IV §3 (specific accuracy levels, foreseeable unintended outcomes), §5 (lifecycle changes log) or §8 (Article 72 post-market plan). Use ISO 42001 evidence as the spine; layer the AI-Act-specific paragraphs on top.

Q: What's the page count of a typical Annex IV file?

For a single high-risk system: 30–80 pages. For a platform with multiple high-risk models: a master section + one Annex IV file per model, or one consolidated file with model-specific subsections. The Commission has not specified a length. Quality of evidence matters; pagination doesn't.

Q: When does Article 11 apply?

For most high-risk AI systems, Article 11 obligations apply from 2 August 2026. Article 6(1) classification rules extend to 2 August 2027 for systems falling under the Annex I (Union harmonisation) path. Systems already on the market before those dates are covered by Article 111 transitional provisions but are not exempt from Article 11.

Q: Is the simplified SME form available yet?

The Commission was required by Article 11(2) to publish the simplified template via implementing act. As of mid-2026 it remains in draft. SMEs should still cover all eight Annex IV headings; the simplified form, when it lands, will reduce the evidence depth required per heading, not the heading list itself.

Reference checklist

The Governancer 30-item checklist contains six items directly tied to Article 11 / Annex IV: drafting the technical file (art11-tech-docs), training-data documentation (art11-training-data), adversarial cybersecurity testing (annexiv-cybersecurity), disaggregated performance metrics (annexiv-performance-groups), retrain changelog (annexiv-changes-log), and harmonised standards alignment (annexiv-harmonised-standards). They appear inline as the "What to do" section above and join to the ISO 42001 + NIST AI RMF crosswalk table.

---

Disclaimer. This page is a reference summary of EU AI Act Article 11 and Annex IV. It is not legal advice. Verify with qualified counsel before relying on it for compliance decisions. Reg text quoted from the Official Journal version of Regulation (EU) 2024/1689.