Template · Written by Yobel Tzegai · Last checked 9 October 2026
What goes in the Annex IV technical documentation for a high-risk AI system?
Nine points, under Annex IV: a general description of the system; its elements and development; its monitoring, functioning and control; why its performance metrics fit; the risk management system; lifecycle changes; the standards applied; the EU declaration of conformity; and post-market evaluation. This free template from complipath.io gives each point its own section.
Check your AI systems, free
Download it, with no email asked
A template, not legal advice. Complipath fills what your register already holds.
What is in it
1. What the system is
- State its intended purpose, the name of the provider and the version of the system, reflecting its relation to previous versions.
- Complipath fills this from: the system name, the workspace name and the purpose recorded in your register. The version and its relation to previous versions: filled by you.
- Describe how the AI system interacts with, or can be used to interact with, hardware or software, including other AI systems, that are not part of the AI system itself, where applicable.
- Filled by you. Complipath pre-ticks one answer (a model from another company) where your register records the system as reached through a third party's interface or fine-tuned from a third party's model.
- List the versions of relevant software or firmware, and any requirements related to version updates.
- Filled by you.
- Describe all the forms in which the AI system is placed on the market or put into service, such as software packages embedded into hardware, downloads, or APIs.
- Filled by you. Complipath can write a draft from your answers for you to correct; it counts only once a named person confirms it.
- Describe the hardware on which the AI system is intended to run.
- Filled by you.
- Where the AI system is a component of products: attach photographs or illustrations showing external features, the marking and internal layout of those products. If it is not a component of a product, say so.
- Filled by you.
- Give a basic description of the user-interface provided to the deployer.
- Filled by you.
- Give the instructions for use for the deployer, and a basic description of the user-interface provided to the deployer, where applicable.
- Filled by you.
Provision: point 1 of Annex IV
2. How it was built
- Describe the methods and steps performed for the development of the AI system, including, where relevant, recourse to pre-trained systems or tools provided by third parties and how those were used, integrated or modified by the provider.
- Complipath fills this from: the system type recorded in your register (built in house, fine-tuned, off the shelf, through a third party's interface). The development steps and what was changed: filled by you.
- Design specifications. Describe: the general logic of the AI system and of the algorithms; the key design choices, including the rationale and assumptions made, including with regard to persons or groups of persons on whom the system is intended to be used; the main classification choices; what the system is designed to optimise for, and the relevance of the different parameters; the expected output and output quality of the system; and the decisions about any possible trade-off made regarding the technical solutions adopted to comply with the requirements set out in Chapter III, Section 2.
- Filled by you.
- Describe the system architecture, explaining how software components build on or feed into each other and integrate into the overall processing; and the computational resources used to develop, train, test and validate the AI system.
- Filled by you.
- Where relevant: the data requirements in terms of datasheets describing the training methodologies and techniques and the training data sets used, including a general description of these data sets, information about their provenance, scope and main characteristics; how the data was obtained and selected; labelling procedures (for example for supervised learning); data cleaning methodologies (for example outliers detection).
- Filled by you.
- Assess the human oversight measures needed in accordance with Article 14, including an assessment of the technical measures needed to facilitate the interpretation of the outputs of AI systems by the deployers, in accordance with Article 13(3), point (d).
- Complipath fills this from: your recorded classification answers on whether the output is acted on automatically and whether a person can overrule it. The technical measures for interpreting outputs: filled by you.
- Where applicable: describe in detail the pre-determined changes to the AI system and its performance, together with all the relevant information related to the technical solutions adopted to ensure continuous compliance of the AI system with the relevant requirements set out in Chapter III, Section 2.
- Filled by you.
- Describe the validation and testing procedures used, including information about the validation and testing data used and their main characteristics; the metrics used to measure accuracy, robustness and compliance with other relevant requirements set out in Chapter III, Section 2, as well as potentially discriminatory impacts. Attach test logs and all test reports, dated and signed by the responsible persons, including with regard to the pre-determined changes under point 2(f) of Annex IV.
- Filled by you.
- Describe the cybersecurity measures put in place.
- Filled by you.
Provision: point 2 of Annex IV
3. Monitoring, functioning and control
- Detailed information about the monitoring, functioning and control of the AI system. Describe its capabilities and limitations in performance, including the degrees of accuracy for specific persons or groups of persons on which the system is intended to be used and the overall expected level of accuracy in relation to its intended purpose.
- Filled by you. Complipath can write a draft from your answer to 'What are its known limits?'; it counts only once a named person confirms it.
- Describe the foreseeable unintended outcomes and sources of risks to health and safety, fundamental rights and discrimination in view of the intended purpose of the AI system.
- Filled by you.
- Describe the human oversight measures needed in accordance with Article 14, including the technical measures put in place to facilitate the interpretation of the outputs of AI systems by the deployers.
- Filled by you.
- Give specifications on input data, as appropriate.
- Filled by you.
Provision: point 3 of Annex IV
4. Why these performance metrics
- Describe the appropriateness of the performance metrics for the specific AI system.
- Filled by you.
Provision: point 4 of Annex IV
5. Risk management
- Give a detailed description of the risk management system in accordance with Article 9.
- Complipath fills this from: your Risks register (each recorded risk with its level, status, reason, action and owner), marked Needs your review. The list is material for the description; the description of the risk management system itself is filled by you.
Provision: point 5 of Annex IV
6. Changes over its lifecycle
- Describe the relevant changes made by the provider to the system through its lifecycle.
- Complipath fills this from: the system's change history in Complipath and the recorded assessments with their dates and engine versions, marked Needs your review. Changes made to the system itself that were never recorded in Complipath: filled by you.
Provision: point 6 of Annex IV
7. Standards applied
- List the harmonised standards applied in full or in part, the references of which have been published in the Official Journal of the European Union.
- Complipath fills this from: the standards a named person on your team ticks from the list the rules suggest, stored with that person's name and the date. Complipath does not say whether a standard is harmonised; that is filled by you.
- Where no such harmonised standards have been applied: give a detailed description of the solutions adopted to meet the requirements set out in Chapter III, Section 2, including a list of other relevant standards and technical specifications applied.
- Filled by you.
Provision: point 7 of Annex IV
8. EU declaration of conformity
- Attach a copy of the EU declaration of conformity referred to in Article 47.
- Complipath fills this from: a template of the contents Annex V lists, filled from your register (system name, register entry, provider name, country and the standards ticked under point 7 of Annex IV) and marked 'Draft – needs signature'. Issuing and signing the declaration: filled by you.
Provision: point 8 of Annex IV
9. Watching it after release
- Give a detailed description of the system in place to evaluate the AI system performance in the post-market phase in accordance with Article 72.
- Filled by you.
- Include the post-market monitoring plan referred to in Article 72(3). The Commission's guidance and template for that plan is due by 2 September 2027 under Article 72(3) as replaced by Regulation (EU) 2026/1744 (the Digital Omnibus on AI).
- Filled by you.
Provision: point 9 of Annex IV
The same work, in the app
In the app, the same nine points are a documentation workspace per system: parts of points 1, 2, 5, 6, 7 and 8 are filled from your register, the rest you answer. AI only drafts. A person confirms each section with a name and a date. Annex IV documentation.
The provisions it names
Article 11(1); Article 11(1), second subparagraph, as replaced by Regulation (EU) 2026/1744; Article 47; Article 72(3), as replaced by Regulation (EU) 2026/1744; Annex IV; Annex V. Each is in Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
Questions
Who has to draw up Annex IV technical documentation?
The provider of a high-risk AI system. Article 11(1) says the technical documentation shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date, and that it shall contain, at a minimum, the elements set out in Annex IV. A deployer does not draw it up.
Can a small company use a simpler form?
Yes, once the Commission publishes it. Article 11(1), second subparagraph, as replaced by Regulation (EU) 2026/1744, lets SMEs (start-ups included) and SMCs provide the Annex IV elements in a simplified manner, using a form the Commission shall establish. That form is not in our source corpus yet, so this template follows Annex IV in full.
Did Regulation (EU) 2026/1744 change Annex IV?
No amending instruction in it names Annex IV, so the nine points read as in 2024. It did replace Article 72(3), which point 9 relies on: the Commission shall now adopt guidance, including a template, on the post-market monitoring plan by 2 September 2027. That guidance is not in our source corpus yet.
Does Complipath fill this template for you?
In part. From your register it fills the system name and purpose under point 1(a), the system type under 2(a), your oversight answers under 2(e), the recorded risks, change history, ticked standards and a draft declaration under points 5 to 8. Every other limb is yours to answer. AI only drafts. A person confirms.
See what your customers will ask about your AI.No account needed. Every answer cites the article it rests on.