← Vetro Attest · All free tools · High-risk classifier · FRIA generator · Annex IV documentation · Log retention · Log checker · Deutsch · Français · Italiano · Español

EU AI Act technical documentation generator (Annex IV) — free template for high-risk AI systems

Providers of high-risk AI systems must draw up technical documentation before the system is placed on the market or put into service, keep it up to date, and make it available to national competent authorities and notified bodies (Art. 11(1)). Annex IV of Regulation (EU) 2024/1689 lists what it must contain, in nine sections. Fill them below and download a draft. Nothing you type leaves your browser; the form is autosaved in this browser only.

Before you start

Who: providers of high-risk AI systems (Art. 6). Deployers do not write Annex IV documentation; they use the provider's instructions for use (Art. 13) and may need a FRIA (Art. 27).
SMEs and start-ups may provide the Annex IV elements in a simplified manner; the Commission is to establish a simplified technical documentation form for this purpose, which notified bodies accept for conformity assessment (Art. 11(1)).
Annex I products: where the high-risk AI system relates to a product covered by the Union harmonisation legislation in Annex I, Section A, a single set of technical documentation is drawn up, containing both the Annex IV information and the information required by that legislation (Art. 11(2)).
When: under Art. 113, the high-risk obligations apply from 2 August 2026 for systems listed in Annex III, and from 2 August 2027 for systems that are safety components of, or are themselves, products covered by Annex I (Art. 6(1)). Check whether later amendments to these dates are in force before relying on them.
Retention: keep the technical documentation at the disposal of the national competent authorities for 10 years after the system has been placed on the market or put into service (Art. 18(1)).

Document information Provider (name, registered trade name or trade mark, address) AI system name and version High-risk classificationAnnex III point, or the Annex I legislation for product-related systems. Document owner and revision

1. General description of the AI system Annex IV(1) (a) Intended purpose, provider, version and relation to previous versionsState the intended purpose precisely (who uses it, for what decision, in what context, on which persons). Name the version and how it differs from earlier ones. (b) Interaction with hardware or software, including other AI systems, not part of the systemAPIs, data sources, upstream and downstream systems, third-party models. Write "not applicable" where it is not. (c) Versions of relevant software or firmware and requirements for version updatesRuntime, libraries, model artefacts with version identifiers; how updates are delivered and what they require from deployers. (d) All forms in which the system is placed on the market or put into serviceE.g. software package embedded in hardware, download, API, SaaS. (e) Hardware on which the system is intended to runMinimum and recommended hardware, cloud or on-premises, accelerators. (f) Where the system is a component of products: photographs or illustrations of external features, marking and internal layoutReference the image files attached to the documentation; "not applicable" for stand-alone software. (g) Basic description of the user interface provided to the deployerScreens, controls, what the operator sees, how outputs and warnings are displayed. (h) Instructions for use for the deployerReference or attach the Art. 13 instructions for use (identity of provider, characteristics, capabilities and limitations, human oversight measures, expected lifetime, maintenance, log collection).

2. Elements of the system and development process Annex IV(2) (a) Methods and steps performed for the developmentInclude recourse to pre-trained systems or third-party tools and how they were used, integrated or modified. (b) Design specificationsGeneral logic of the system and algorithms; key design choices with rationale and assumptions, including about the persons or groups on which it is used; main classification choices; what it optimises for and relevance of parameters; expected output and output quality; trade-offs made to comply with Chapter III, Section 2. (c) System architecture and computational resourcesHow software components build on or feed into each other and integrate into overall processing; computational resources used to develop, train, test and validate. (d) Data requirements (datasheets)Where relevant: training methodologies and techniques, training data sets, their provenance, scope and main characteristics; how data was obtained and selected; labelling procedures; data cleaning methods (e.g. outlier detection). Link to Art. 10 data governance. (e) Assessment of the human oversight measures needed (Art. 14)Include the technical measures that help deployers interpret outputs (Art. 13(3)(d)): explanations, confidence indicators, override and stop functions. (f) Pre-determined changes to the system and its performanceWhere applicable: changes planned at the initial conformity assessment (e.g. scheduled retraining within defined bounds) and the technical solutions that keep the system compliant. (g) Validation and testing proceduresValidation and test data and their main characteristics; metrics for accuracy, robustness and other Chapter III, Section 2 requirements, and for potentially discriminatory impacts; test logs and test reports dated and signed by the responsible persons, including for pre-determined changes. (h) Cybersecurity measuresMeasures against unauthorised alteration, data poisoning, model poisoning, adversarial examples and confidentiality attacks (see Art. 15(5)); access control, supply chain, vulnerability handling.

3. Monitoring, functioning and control Annex IV(3) Capabilities and limitations in performanceDegrees of accuracy for the specific persons or groups on which the system is intended to be used, and the overall expected level of accuracy for the intended purpose. Foreseeable unintended outcomes and sources of riskRisks to health and safety, fundamental rights and of discrimination, in view of the intended purpose. Human oversight measures and interpretation aids (Art. 14)The measures actually put in place for deployers; you may reference section 2(e). Specifications on input dataFormats, ranges, required fields, languages, quality thresholds; what happens on out-of-scope input. Logging capability (Art. 12)Not a separate Annex IV item, but authorities will check that the system automatically records events over its lifetime: what is logged, where, and for how long.

4. Appropriateness of the performance metrics Annex IV(4) Why the chosen metrics fit this systemJustify each metric against the intended purpose and the cost of errors (e.g. why recall over precision, why per-group metrics, thresholds chosen). Accuracy metrics must also be declared in the instructions for use (Art. 15(3)).

5. Risk management system Annex IV(5), Art. 9 Detailed description of the risk management systemA continuous iterative process over the lifecycle: identification and analysis of known and reasonably foreseeable risks; estimation and evaluation, including under reasonably foreseeable misuse; evaluation of risks from post-market monitoring data; risk management measures and residual risk; testing; consideration of persons under 18 and other vulnerable groups (Art. 9(2)-(9)).

6. Relevant changes through the lifecycle Annex IV(6) Changes made by the provider to the systemA change log with date, version, description, impact on compliance, and whether it is a pre-determined change or a substantial modification requiring a new conformity assessment (Art. 43(4)).

7. Harmonised standards and common specifications Annex IV(7) Harmonised standards applied in full or in part (references published in the Official Journal)List with reference and the parts applied. Where none are applied: a detailed description of the solutions adopted to meet Chapter III, Section 2, and a list of other standards, common specifications (Art. 41) and technical specifications applied.

8. Copy of the EU declaration of conformity Annex IV(8), Art. 47 Reference to the declaration of conformityAttach a copy of the signed declaration (content per Annex V): system name and version, provider, statement of sole responsibility, conformity statement, standards applied, notified body where applicable, place and date, signature.

9. Post-market monitoring system Annex IV(9), Art. 72 System to evaluate performance in the post-market phaseHow data on performance is actively and systematically collected, documented and analysed over the lifetime (from deployers or other sources), to evaluate continuous compliance, including interaction with other AI systems where relevant (Art. 72(2)). Post-market monitoring plan (Art. 72(3))The plan is part of the technical documentation; the Commission is to adopt a template by implementing act. Include data sources, indicators, frequency, responsibilities and how serious incidents are reported (Art. 73).

Orientation tool, not legal advice. The structure follows Annex IV of Regulation (EU) 2024/1689 as published; the Commission may amend Annex IV by delegated act (Art. 11(3)). Empty items are marked "[to be completed]" in the export; write "not applicable" with a reason rather than leaving an item blank. The draft is saved only in this browser's localStorage; use "Clear form" on shared computers.

EU AI Act technical documentation generator (Annex IV) — free template for high-risk AI systems

Section 3 needs working logs, not a description

Get the complete compliance pack

Attach evidence to the documentation

${total - empty.length} of ${total} items completed

Preview

Need the documents, not just the answer?

EU AI Act deadline reminders + checklist