Technical Documentation: [High-risk AI system name] [version]
Technical documentation file for a high-risk AI system, organised on the
nine headings of Annex IV of the EU Artificial Intelligence Act
(Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the
"Digital Omnibus on AI"). It gathers the evidence a provider keeps to
show that the system meets the requirements for high-risk AI systems.
Under the amended Article 113 these requirements apply from 2 December
2027 for Annex III systems and from 2 August 2028 for Annex I systems;
check the consolidated text for the dates that apply to you.
Replace every [bracketed] value and every row marked Example.
This is a documentation format, not legal advice.
Document control
| Field | Value |
|---|
| Document ID | [TD-AISYS-001] |
| AI system name and version | [Name] [version] |
| Unique identifier | [Internal ID; EU database registration number when assigned] |
| Provider | [Legal name, address] |
| Authorised representative (if provider outside the EU) | [Name, address] |
| Document version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@compliance-owner] |
| Classification | [Confidential] |
| Last updated | YYYY-MM-DD |
| Retention | Example: 10 years after the system is placed on the market or put into service |
Approvals
| Role | Name | Decision | Date |
|---|
| Head of AI engineering | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Quality management representative | [@name] | [Decision] | YYYY-MM-DD |
| Legal / regulatory affairs | [@name] | [Decision] | YYYY-MM-DD |
| Accountable executive | [@name] | [Decision] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change summary |
|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | Example: Baseline for conformity assessment |
| 1.1 | YYYY-MM-DD | [@name] | Example: Updated accuracy figures after retraining within the predetermined change plan |
Contents
1. General description of the AI system
1.1 Intended purpose
[State the intended purpose precisely: the task, the decisions it informs,
the deployers and the persons affected. Example: "Ranks job applications
for a vacancy by match to stated requirements, to help recruiters decide
whom to invite to interview. Used by trained HR staff of deploying
employers in the EU. Affected persons: job applicants."]
1.2 Provider and system identification
| Item | Value |
|---|
| Provider | [Name and contact] |
| System name, version and release date | [Name] [version], YYYY-MM-DD |
| Versions of relevant software or firmware | Example: Scoring service 3.4.1; model 2026.09; UI 5.2 |
| Forms in which it is placed on the market | Example: SaaS API and web application; no on-premises version |
| Hardware it runs on | Example: Provider-operated cloud, EU region; no specific deployer hardware |
| Product it is a component of (if any) | [None / Product name; include images showing external features and markings] |
1.3 High-risk classification
| Question | Answer |
|---|
| Basis for high-risk status | Example: Annex III area: employment, recruitment and selection of natural persons |
| Exceptions considered | [Whether an exception for narrow procedural or preparatory tasks was assessed, and the result] |
| Conformity assessment route | Example: Internal control by the provider |
1.4 Interaction with other systems
[Describe interfaces with hardware, software and other AI systems that
are not part of this system, including general-purpose AI models used.
Example: "Receives applications from the deployer's applicant tracking
system through a REST API; uses a third-party language model for CV
parsing under a contract that provides the documentation listed in 2.1."]
1.5 User interface and instructions for use
[Describe the interface provided to the deployer and link the instructions
for use. Example: "Recruiters see a ranked list with a score band and the
top three requirement matches for each candidate; instructions for use
document IFU-HR-3.4 explain limitations and oversight duties."]
2. Detailed description of elements and development process
2.1 Development methods and third-party components
| Element | Description | Source | Evidence |
|---|
| Pre-trained model | Example: Multilingual text encoder [name, version] | Third party | Supplier documentation, licence |
| Fine-tuned ranking model | Example: Gradient-boosted ranker on encoder features | In-house | Model card MC-HR-001 |
| Tools and libraries | Example: Training framework [name, version] | Open source | SBOM reference |
| [Element] | [Description] | [Source] | [Evidence] |
2.2 Design specifications
| Topic | Description |
|---|
| General logic and algorithms | [How inputs become outputs] |
| Key design choices and rationale | Example: Score bands instead of raw scores to reduce over-reliance |
| Assumptions about persons or groups | Example: Applications are in one of the 6 supported languages |
| Main classification or ranking choices | [Description] |
| What the system optimises and the relevance of parameters | Example: Agreement with recruiter shortlist decisions, constrained by group parity limits |
| Expected output and its quality | [Description] |
| Trade-offs to meet the requirements | Example: Removed free-text hobbies field; small accuracy loss, lower proxy risk |
2.3 System architecture and computational resources
The diagram shows how the components are connected and where data flows.
[Describe components, integration, and resources used to develop, train,
test and validate. Example: "Training on 8 GPUs for 6 hours per run;
serving on CPU instances in one EU cloud region."]
2.4 Data requirements and data governance
| Dataset | Purpose | Provenance and scope | Main characteristics | Labelling and cleaning | Datasheet |
|---|
| Example: Historic applications 2021-2025 | Training | Three consenting employer customers, EU | 410 000 applications, 6 languages | Shortlist outcomes; duplicates and incomplete CVs removed | DS-HR-001 |
| Example: Curated evaluation set | Validation and testing | Synthetic and consented real CVs | 12 000 applications, balanced by sex and age band | Two expert labellers per item | DS-HR-002 |
| [Dataset] | [Purpose] | [Provenance] | [Characteristics] | [Processing] | [Link] |
[Describe how relevance, representativeness, errors, completeness and
bias were examined, and any processing of special category data for bias
detection with its safeguards.]
2.5 Human oversight measures
[Describe the oversight measures built in and the technical aids that
help deployers interpret outputs. Example: "Recruiters must open each
candidate before rejection; the interface shows the evidence for each
match; a stop control disables automatic ranking for a vacancy."]
2.6 Predetermined changes
[Describe changes to the system and its performance that are planned in
advance, with the technical solutions that keep it compliant. Example:
"Quarterly retraining on new data within the same feature set, accepted
only if the criteria in 4 and the bias limits in 3.2 are met."]
2.7 Validation and testing
| Test | Data used | Metrics | Result | Report (dated, signed) |
|---|
| Example: Accuracy validation | DS-HR-002 | Top-10 recall, NDCG@10 | 0.86, 0.71 | TR-2026-031, YYYY-MM-DD, [@signatory] |
| Example: Group performance | DS-HR-002 by sex, age band, language | Selection rate ratio | Lowest ratio 0.87 | TR-2026-032 |
| Example: Robustness | Perturbed CVs (format, typos) | Rank stability | 94% unchanged in top 10 | TR-2026-033 |
| [Test] | [Data] | [Metrics] | [Result] | [Report] |
2.8 Cybersecurity measures
| Threat | Measure | Evidence |
|---|
| Example: Data poisoning through customer uploads | Training data only from vetted, signed snapshots | Procedure SEC-07 |
| Example: Prompt or input manipulation of the CV parser | Input sanitisation; parser output schema validation | Pen test report PT-2026-04 |
| Example: Model theft | Access control on registry; no model export | Access review log |
| [Threat] | [Measure] | [Evidence] |
3. Monitoring, functioning and control
3.1 Capabilities and limitations
| Aspect | Description |
|---|
| Overall expected accuracy | Example: Top-10 recall 0.86 (95% CI 0.84 to 0.88) on DS-HR-002 |
| Accuracy for specific persons or groups | See 3.2 |
| Known limitations | Example: Lower accuracy for CVs with non-standard layouts and for career changers |
| Conditions where it should not be used | Example: Roles with fewer than 20 applicants; languages not listed in 1.3 |
3.2 Group performance
| Group | n | Selection rate | Ratio to highest group | Accuracy (top-10 recall) |
|---|
| Example: Women | 5 900 | 0.31 | 0.94 | 0.85 |
| Example: Men | 5 800 | 0.33 | 1.00 | 0.87 |
| Example: Age 55 and over | 1 100 | 0.29 | 0.87 | 0.82 |
| [Group] | [n] | [rate] | [ratio] | [value] |
3.3 Foreseeable unintended outcomes and risk sources
[List risks to health, safety and fundamental rights, and risks of
discrimination, that may arise from the intended purpose or reasonably
foreseeable misuse. Example: "Recruiters may treat the ranking as a final
decision (automation bias); indirect discrimination through employment
gaps as a proxy for caring responsibilities."]
3.4 Human oversight and input data specifications
| Item | Description |
|---|
| Oversight measures for deployers | [Reference to 2.5 and instructions for use] |
| Input data specifications | Example: PDF or DOCX CV up to 5 pages; vacancy requirements as structured list |
| Behaviour on invalid input | Example: Candidate flagged "not scored" and shown unranked |
3.5 Logging
[Describe the automatic event logs that allow traceability: what is
logged, retention, and access. Example: "Each scoring event logs request
ID, model version, input hash, output band and reviewer actions; kept 24
months."]
4. Appropriateness of performance metrics
| Metric | Why it fits the intended purpose | Threshold | Why this threshold |
|---|
| Top-10 recall | Recruiters review the top 10; missing a qualified candidate harms that candidate | at least 0.80 | Equal to the recall of two independent human screeners |
| Selection rate ratio | Detects unequal shortlisting across groups | at least 0.80 for every group | Common practice for adverse impact screening; reviewed by legal |
| Rank stability under perturbation | Formatting must not change outcomes | at least 90% | Agreed with deployer panel |
| [Metric] | [Fit] | [Threshold] | [Reason] |
5. Risk management system
[Describe the process: roles, frequency, inputs (testing, post-market
data), and how residual risk is judged acceptable. Link the register.]
| ID | Risk | Affected | Severity | Likelihood | Mitigation | Residual | Owner |
|---|
| RM-01 | Example: Indirect age discrimination | Applicants 55+ | High | Medium | Removed graduation year; parity constraint; monitoring in 9 | Low | [@name] |
| RM-02 | Example: Automation bias | Applicants | High | Medium | Score bands; mandatory review; deployer training | Medium | [@name] |
| [RM-nn] | [Risk] | [Group] | [H / M / L] | [H / M / L] | [Measures] | [H / M / L] | [@name] |
6. Changes through the lifecycle
| Change ID | Date | Description | Within predetermined plan | Substantial modification | Reassessment |
|---|
| CH-01 | YYYY-MM-DD | Example: Quarterly retraining, same features | Yes | No | Tests TR-2026-041 |
| CH-02 | YYYY-MM-DD | Example: Added Polish language support | No | Under review | [Reference] |
| [CH-nn] | YYYY-MM-DD | [Description] | [Yes / No] | [Yes / No] | [Reference] |
7. Harmonised standards and other specifications applied
| Standard or specification | Applied | Requirements addressed | Notes |
|---|
| [Harmonised standard reference, once published in the Official Journal] | [Full / Partial] | [Requirement] | [Notes] |
| Example: ISO/IEC 42001:2023 | Partial | Quality management, risk management | Certified scope [reference] |
| Example: ISO/IEC 23894:2023 | Partial | AI risk management | Process in 5 |
| [Other specification] | [Full / Partial] | [Requirement] | [Notes] |
Where no harmonised standard applies: [describe the solutions adopted for
each requirement on risk management, data governance, documentation,
record-keeping, transparency, human oversight, and accuracy, robustness
and cybersecurity].
8. EU declaration of conformity
| Item | Value |
|---|
| Declaration reference | [DoC-AISYS-001] |
| Date signed | YYYY-MM-DD |
| Signed by | [Name, function] |
| Location of signed copy | [Controlled document location] |
| CE marking applied | [Yes / No, date] |
| EU database registration | [Registration reference, date] |
9. Post-market monitoring
| Element | Plan |
|---|
| Data collected | Example: Scoring logs, recruiter overrides, complaints, deployer feedback |
| Indicators | Example: Selection rate ratio per group monthly; override rate; top-10 recall on audited samples |
| Thresholds and actions | Example: Ratio below 0.80 for any group triggers investigation within 10 working days |
| Frequency of review | Example: Monthly operational, quarterly management review |
| Serious incident reporting | [Internal procedure reference and responsible role] |
| Feedback to risk management | Results update the register in 5 |
| Plan document | [PMM-AISYS-001] |
10. Appendices
10.1 Evidence index
| Ref | Document | Version | Location |
|---|
| E-01 | Instructions for use | [v] | [Link] |
| E-02 | Model card | [v] | [Link] |
| E-03 | Datasheets | [v] | [Link] |
| E-04 | Test reports | [v] | [Link] |
| E-05 | Risk register | [v] | [Link] |
| E-06 | Quality management system procedures | [v] | [Link] |
10.2 Glossary
| Term | Meaning in this document |
|---|
| Provider | The organisation that develops the system and places it on the market under its name |
| Deployer | The organisation using the system under its authority |
| Substantial modification | A change not foreseen in the initial assessment that affects compliance or intended purpose |
| Selection rate ratio | Selection rate of a group divided by that of the group with the highest rate |
Standard and licence note
Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, OJ L of
24 July 2026), Annex IV, technical documentation for high-risk AI
systems; EU legislative
texts are free to reuse. The headings are summarised in original wording
and no text of the Regulation is reproduced; consult the Official Journal
of the European Union for the binding text and current Commission
guidance. This is a documentation format, not legal advice. Template
licence: MIT.