Annex IV Technical Documentation Template (Article 11)

Document 15 of the RegShelf kit is a fill-in skeleton that follows Annex IV section by section, so a completed copy demonstrates on its face that the documentation contains everything Annex IV asks for. Market surveillance authorities and notified bodies work from this structure; keeping it makes their review — and yours — faster. The template is designed as the hub of the technical file: risk management (doc 16), data governance (doc 17), human oversight (doc 18) and the accuracy and robustness test log (doc 19) plug into it by reference rather than duplication, and a final annex index makes the whole file navigable from one document.

Providers of high-risk AI systems — including SMEs that become providers by building on third-party models and offering the result under their own name, or by white-labelling. Deployers do not owe Annex IV documentation, but they should expect their high-risk vendors to have it (it is what question E2 of the kit's vendor questionnaire probes). The simplified documentation option matters here: the Digital Omnibus gave SMEs (Recommendation 2003/361/EC — in essence fewer than 250 staff within turnover/balance-sheet ceilings), including start-ups, and small mid-caps (Recommendation (EU) 2025/1099 of 21 May 2025 — in essence fewer than 750 employees within separate ceilings) an express right to provide the Annex IV information via the Commission's simplified form, which notified bodies and authorities must accept.

Article 11 requires the documentation to exist before the system is placed on the market or put into service, to demonstrate compliance with the Chapter III Section 2 requirements, and to be kept up to date. Article 18 requires the provider to keep it for 10 years after market placement. The simplified form condenses, but does not remove, the substance — you still need real answers on intended purpose, data, oversight, testing and risk management. Two honest caveats the template itself flags: SME or small mid-cap status should be re-checked yearly, and the Act does not say when a provider that loses the status must move to full documentation — the template's suggested transition (upgrade at the next significant change in design, anchored in the Article 111 concept) is labelled as an internal approach, not a statutory rule.

Eleven sections mirroring Annex IV, with [core] tags marking the minimum set to carry into the simplified form:

• Document control — including a simplified-form checkbox and the 10-year retention note;
• General description [core] — nine Annex IV point 1 items from intended purpose to instructions for use;
• Elements and development process — methods, third-party and pre-trained components, design specifications [core], architecture, data requirements [core] (referencing the doc 17 data governance log), human oversight assessment [core], predetermined changes, validation and testing [core], and cybersecurity with an AI-specific threat table (data poisoning, model poisoning, adversarial examples, extraction, model flaws);
• Monitoring, functioning and control [core] and appropriateness of performance metrics;
• Risk management system [core] — referencing doc 16;
• Lifecycle change log, harmonised standards applied, EU declaration of conformity (with the Annex V element list), post-market monitoring plan and an evidence index.

Complete one copy per high-risk system, starting from the classification assessment that made it high-risk. Attach or link evidence rather than duplicating it, and let docs 16–19 of the kit fill their sections by reference. If you qualify as an SME or small mid-cap, verify status, tick the simplified-form box and complete at least the [core] sections. Version-control every change in the lifecycle table — it is the audit trail an authority reads first — and keep the file 10 years after market placement. The Section 10 plan pairs with the post-market monitoring kit.