What counts as AI Act compliance evidence, and how do you keep the trail?

Written by Yobel Tzegai. Last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 and against our prices. The capability statuses below were read on 8 October 2026.

AI Act compliance evidence is the record a duty asks for: the documentation, the logs, the assessment or the measures, kept for as long as the article says. Complipath (complipath.io) links each file to the requirement it proves, with the passage quoted and the page it stands on, and keeps an audit log of who did what and when. Nothing changes until a person applies a match.

Check your AI systems, free

What Complipath does

Each row with its status on 8 October 2026, from the same table as what Complipath is. Rules decide. AI only drafts. A person confirms.

What Complipath does not do yet

What it costs

Starter is €499 a month and includes 20 AI systems. Archived systems don’t count toward your limit. Prices exclude VAT. Your first system is free, with no end date. Growth and Scale are not available yet. Pricing has the full terms.

What counts as evidence, article by article?

The Act has no single article called evidence. Each duty names its own record, and the record is the evidence. Chapter III, Sections 1, 2 and 3, other than Article 6(5), apply from 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III, and from 2 August 2028 for systems that are high-risk under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744). For a high-risk system, the records are these:

• Article 9(1): the risk management system itself, established, implemented, documented and maintained.
• Article 11(1): the technical documentation, drawn up before the system is placed on the market or put into service and kept up to date, with at least the elements of Annex IV. SMEs and SMCs, start-ups included, may provide those elements in a simplified manner, on a form the Commission is to establish (Article 11(1), second subparagraph, as replaced by Regulation (EU) 2026/1744).
• Article 12(1): logs. The system must technically allow the automatic recording of events over its lifetime.
• Article 19(1) for providers and Article 26(6) for deployers: keep the logs under your control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise, in particular on the protection of personal data.
• Article 17(1): the quality management system, documented in a systematic and orderly manner as written policies, procedures and instructions. Article 17(2), as replaced by Regulation (EU) 2026/1744, makes it proportionate to the size of the provider, in particular for SMEs and SMCs, start-ups included. The degree of rigour and the level of protection the Regulation requires still apply in any event.
• Article 18(1): for 10 years after the system is placed on the market or put into service, the provider keeps at the authorities' disposal the technical documentation, the quality management system documentation, the changes approved by notified bodies where applicable, the notified bodies' decisions and other documents where applicable, and the EU declaration of conformity.

What else counts, around the high-risk duties?

• Article 4(1), as replaced by Regulation (EU) 2026/1744: the measures you take to support the AI literacy of your staff and others operating or using AI systems on your behalf. The obligation does not require a guaranteed level of AI literacy for any individual, so the record is of the measures.
• Article 6(4): a provider who considers an Annex III system not high-risk documents that assessment before the system is placed on the market or put into service and registers under Article 49(2). When a national competent authority asks, the provider hands the documentation over.
• Article 27(1): before deploying a high-risk system referred to in Article 6(2), bodies governed by public law, private entities providing public services and deployers of the systems in points 5 (b) and (c) of Annex III perform a fundamental rights impact assessment. Systems intended for the area in point 2 of Annex III are excepted.

How does Complipath link a file to the requirement it proves?

Each requirement arrives with a status, an owner and a hint about what counts as evidence for it, shown on the requirement's page. An uploaded file is read against the workspace's requirements. Each match shows the passage quoted and the page it stands on, the quote is checked word for word against that page in code, and nothing changes until a person applies it. The reading is done by a language model (Anthropic). AI only drafts; a person confirms.

What is in the audit trail?

The audit log lists who did what and when, with filters and a CSV export, on Starter and in the trial, not on Free. No one can edit or delete a line, an owner included; only deleting the whole workspace removes it. Confirming a classification stamps it with the person and the time, a recorded classification is never rewritten, and the documentation PDF carries a SHA-256 fingerprint of its content. Not available yet: one file for an auditor with all of it, the audit pack, which is in progress and not in production.

Questions

Does the AI Act define compliance evidence?

Not as one list. Each duty names its own record: the risk management system under Article 9(1), the technical documentation under Article 11(1), the logs under Article 12(1), the quality management system under Article 17(1). The record the article asks for is the evidence, and the article sets how long it is kept.

How long must AI Act logs be kept?

Under Article 19(1) for providers and Article 26(6) for deployers, each for the logs under their control: for a period appropriate to the system's intended purpose, of at least six months, unless Union or national law provides otherwise, in particular on the protection of personal data.

How long must the technical documentation be kept?

Ten years after the high-risk system is placed on the market or put into service, at the disposal of the national competent authorities (Article 18(1)). The same period covers the quality management system documentation, the notified bodies' changes and decisions where applicable, and the EU declaration of conformity.

Does a language model decide whether a file proves a requirement?

No. In Complipath a language model reads the file and proposes a match, with the passage quoted and the page it stands on. The quote is checked word for word against that page in code, and nothing changes until a person applies it. Rules decide. AI only drafts. A person confirms.

• The same record, step by step: how Complipath proves AI Act compliance.
• Answering a customer with it: how to answer AI questions in a supplier questionnaire, topic by topic in the questionnaire answer library.
• What a classification records: risk classification.
• What the product is: what Complipath is.