AI Act technical documentation and logs for high-risk systems: what you must keep

First: are you a provider or a deployer?

Your duties depend on your role. The provider develops the system or markets it under its own name; the deployer uses it in its activity. If you have not established this yet, start with the risk classification.

The pieces of the file

• Risk management system (Art. 9): a continuous process to identify, assess and reduce the system’s risks throughout its life cycle.
• Technical documentation (Art. 11 and Annex IV): description of the system, its purpose, design, data used, testing, metrics, human oversight and cybersecurity measures. It must be ready before the system is placed on the market and kept up to date.
• Automatic logs (Art. 12): the system must be able to record events while it operates, so that what happened can be reconstructed.
• Instructions for use (Art. 13): clear information for the deployer: capabilities, limits, accuracy level, required oversight.

What the technical documentation contains

Annex IV lists the content. In plain language, a reasonable file includes:

1. General description and intended purpose, versions and how it integrates with other systems.
2. How it was developed: design decisions, architecture and training, validation and test data (with their quality and origin).
3. How it is monitored, controlled and intervened in (see human oversight).
4. Accuracy and robustness metrics, and known risks.
5. The risk management system and the changes made over the system’s life.
6. The EU declaration of conformity and the post-market monitoring plan.

SMEs and start-ups may provide the Annex IV elements in a simplified way, using a form the European Commission is to establish.

Records: what to keep and for how long

• Provider’s technical documentation: 10 years from placing on the market or putting into service (Art. 18).
• Automatically generated logs: the provider keeps them for at least six months when under its control (Art. 19), unless other law, such as data protection law, requires otherwise.
• Deployer’s logs: also at least six months when under its control (Art. 26), adapted to the system’s purpose.

Logs often contain personal data, so your retention policy must balance the duty to keep them with the GDPR principle of data minimization. It helps to include them in your retention policy.

How to organize it without getting lost

1. Create a folder or record for each high-risk system, linked to your AI systems inventory.
2. Assign one person to keep the documentation up to date.
3. Define which events are logged, where they are stored, who can see them and when they are deleted.
4. Review the file whenever the system changes materially.

The application dates for high-risk obligations have moved with the Digital Omnibus; check the current timeline in our timeline article and in the official text.

Frequently asked questions

Do I have to document if I only use a vendor’s system?

The technical documentation belongs to the provider. But as a deployer you must follow the instructions for use, ensure human oversight and keep the logs under your control.

Can one document cover everything?

It can be a single file with sections, as long as it covers the required content and is kept up to date.

Do limited-risk systems need all this?

Not at this scope. They mainly have transparency duties, covered in the article on Art. 50.

Informational content, not legal advice. AI regulation changes quickly: always check the current official text before deciding. Information reviewed as of October 15, 2026.

This gives you the map. If you want the finished template: AI Systems Register.