Quick answer: Annex IV of the EU AI Act lists the technical documentation every provider of a high-risk AI system must draw up before placing it on the EU market. It covers nine areas: a general system description, detailed development documentation (data, architecture, training), monitoring and control capabilities, performance and limitations, risk management records, lifecycle changes, standards applied, the EU declaration of conformity, and post-market monitoring. With the Omnibus deferrals, this lands with the high-risk obligations: 2 December 2027 for Annex III systems, 2 August 2028 for Annex I embedded systems. SMEs may provide the documentation in a simplified form. Deployers don't write Annex IV docs — but smart deployers demand them from vendors.
If you build and sell AI that touches hiring, credit, education, or safety components, Annex IV is the paper spine of your entire compliance story. Here's what goes in it, section by section, in plain language.
First: Are You a Provider?
Annex IV is a provider obligation. You're a provider if you develop an AI system and place it on the market under your own name or trademark. Three traps catch SMBs:
- White-labeling. Rebrand someone else's system as yours and you can become the provider, inheriting the documentation duty.
- Substantial modification. Significantly modify a high-risk system — including heavy fine-tuning for a new high-risk purpose — and provider obligations can shift to you.
- Purpose conversion. Take a general-purpose tool and market it for a high-risk use (say, candidate screening) and you may be providing a high-risk system.
If you only use AI tools, you're a deployer: no Annex IV authoring duty, but read the "For deployers" section below — this document matters to you in vendor negotiations.
What Annex IV Requires, Section by Section
1. General description of the AI system
Intended purpose, provider name, version and how versions interrelate; how the system interacts with hardware or other software; market forms (API, on-prem, embedded); the hardware it runs on; instructions for use for the deployer.
2. Detailed description of elements and development
- Methods and steps of development, including where pre-trained systems or third-party models were used
- Design specifications — the logic of the system, key design choices, what the system is optimizing for, and trade-offs accepted
- Architecture — how components feed into the overall processing
- Data requirements — datasheets describing training methodologies, datasets used (origin, scope, characteristics), labeling and cleaning procedures
- Human oversight assessment — what the deployer needs in order to oversee the system
- Validation and testing — procedures, metrics for accuracy, robustness, cybersecurity, potentially discriminatory impacts, test logs
3. Monitoring, functioning and control
How the system performs, its capabilities and limitations, foreseeable misuse, the human oversight measures built in, and input-data specifications.
4. Performance metrics and their appropriateness
Why your chosen metrics are the right ones for this purpose and population — not just what the scores are.
5. Risk management system
The documentation of your Article 9 risk management process: hazards identified, mitigations, residual risk judgments. Your internal risk register discipline scales up into this.
6. Lifecycle changes
A running log of relevant modifications through the system's life.
7. Standards and specifications applied
Harmonized standards applied in full or part; where none, the alternative solutions used to meet the requirements.
8. EU declaration of conformity
Copy of the signed declaration that accompanies CE marking.
9. Post-market monitoring plan
How you'll collect and evaluate real-world performance data and feed it back — including how deployers report issues to you.
Turn the list into a working document: the EU AI Act SME Compliance Kit ($149) includes an Annex IV template with all nine sections pre-structured, prompts for each subsection, and guidance on what evidence to attach.
The SME Simplification
The AI Act directs the Commission to provide a simplified technical documentation form for SMEs and startups. Simplified means lighter format — not waived content. Structure your documentation against the full Annex IV headings from day one and compress where the simplified form allows, rather than starting thin and backfilling under deadline pressure in 2027.
Build It as You Go (the Only Sane Approach)
- Decision log — one paragraph per significant design choice, dated
- Data sheets — fill a short template every time a dataset enters training or evaluation
- Versioned eval reports — every model release gets its metrics archived
- Change log — already standard practice; just keep it honest
That's 80% of sections 2, 4, and 6 generated as a byproduct of normal work.
For Deployers: Why You Should Care Anyway
You don't write Annex IV documentation — you consume its outputs. The provider's instructions for use are what let you meet your own deployer duties (oversight design, logging, FRIA where applicable). When assessing a high-risk AI vendor, ask: "Will you supply Annex IV-aligned documentation before the December 2027 deadline?" Question 21 of our AI vendor assessment questionnaire covers exactly this, and the SME deadline checklist shows where it fits in your timeline.
FAQ
Who must produce Annex IV technical documentation?
Providers of high-risk AI systems — those who develop and place such systems on the EU market under their own name. Deployers don't author it, but rely on the provider's documentation to meet their own obligations.
When does the Annex IV obligation apply?
2 December 2027 for Annex III standalone systems and 2 August 2028 for Annex I embedded systems. The documentation must exist before market placement and be kept up to date.
Is there a lighter version for small companies?
Yes — SMEs and startups may supply the Annex IV elements via a simplified documentation form. The content requirements remain; the format is lighter.
What happens if our documentation is inadequate?
Documentation failures are provider-obligation breaches, fined up to €15m or 3% of worldwide turnover. Weak documentation also stalls conformity assessment and enterprise sales.
Start the documentation habit now, not in 2027. The EU AI Act SME Compliance Kit ($149) includes the structured Annex IV template plus classification guides, obligation checklists, and the FRIA template — or get everything in the Complete AI Compliance Stack ($199).
This article is for general information only and is not legal advice. Consult qualified counsel for your specific situation.