For high risk AI systems, the EU AI Act points to five bodies of evidence: technical documentation, a quality management system, automatic event logs, post market monitoring and the conformity assessment record. Which route applies depends on your system's category, so confirm that first. This is explanation, not legal advice.
Does the Act apply to you?
The detailed evidence duties below fall on providers of high risk AI systems. A system classed as high risk under the Act's annexes carries them. Many AI uses are not high risk and face lighter duties, so classification is the first piece of evidence you will need: a written reasoning of why your system is or is not high risk.
Timing matters too. The EU AI Act information site lists 2 December 2027 as the application date for the high risk obligations for Annex III systems and 2 August 2028 for Annex I systems. Check the official text for any later change.
What is the technical documentation?
Article 11 requires documentation prepared before the system is placed on the market, kept up to date, and clear enough for authorities and notified bodies to assess compliance. Annex IV sets the minimum content. The page we fetched did not list Annex IV's items, so open the annex itself. Small and medium companies may provide Annex IV information in a simplified form set by the Commission.
What does the quality management system need to show?
Article 17 lists what the system must cover, including: regulatory compliance strategy and change management, design and development procedures, testing and validation, technical specifications and standards applied, data management, risk management, post market monitoring, serious incident reporting, communication with authorities, record keeping, resource management and an accountability framework. Implementation can be proportionate to the provider's size, though the required rigor stays.
Auditors tend to ask for policies and for proof the policies are followed: meeting records, approvals, test reports and change tickets.
What about logs and monitoring?
Article 12 requires high risk systems to technically support automatic recording of events over their lifetime, so logs can help identify risk situations or substantial modifications, support post market monitoring and support monitoring of operation. Article 72 requires a documented post market monitoring system, built on a plan that forms part of the technical documentation, which actively and systematically gathers, records and analyses performance data. The page we fetched noted two differing versions of one paragraph of Article 72, so read the official text before relying on its deadlines.
How is conformity shown?
Article 43 says routes differ. For biometric systems, a provider may choose internal control or an assessment with a notified body, and must use the notified body route if harmonised standards are missing or only partly applied. For other Annex III systems, internal control applies, with no notified body involved. A substantial modification after market placement needs a new conformity assessment. Keep a record of what counts as substantial for your system.
What to do
- Write down your classification reasoning and who approved it.
- Create a document index mapped to Article 11 and Annex IV sections.
- Map your existing processes to the list in Article 17 and mark gaps.
- Turn on event logging and decide where logs are stored and for how long.
- Draft a post market monitoring plan with metrics, owners and review dates.
- Define what a substantial modification means for your system and how it triggers re-assessment.
- Keep a dated evidence folder so an auditor can follow a trail without asking you to recreate it.
Safeguard does not certify anyone; our compliance automation is meant to help collect and organize evidence you then own.
Quick check
Is a notified body always required?
No. Article 43 uses internal control for most Annex III systems, and a notified body in some cases.
Is the Annex IV list in this post?
No. Read Annex IV itself for the minimum content of technical documentation.
Sources
- EU AI Act: Article 11
- EU AI Act: Article 12
- EU AI Act: Article 17
- EU AI Act: Article 43
- EU AI Act: Article 72
- EU AI Act implementation timeline
Last reviewed: 18 October 2026.
