# Technical Documentation: [High-risk AI system name] [version]

> Technical documentation file for a high-risk AI system, organised on the
> nine headings of Annex IV of the EU Artificial Intelligence Act
> (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the
> "Digital Omnibus on AI"). It gathers the evidence a provider keeps to
> show that the system meets the requirements for high-risk AI systems.
> Under the amended Article 113 these requirements apply from 2 December
> 2027 for Annex III systems and from 2 August 2028 for Annex I systems;
> check the consolidated text for the dates that apply to you.
> Replace every `[bracketed]` value and every row marked *Example*.
> This is a documentation format, not legal advice.

<!--
Guidance: How to use this template
- Confirm first that the system is high-risk (Article 6 and Annex III, or a
  safety component of a product under Annex I legislation). Record the
  reasoning in 1.3; if it is not high-risk, this full file is not required.
- Keep this file current for the whole lifecycle. The Act expects the
  documentation to exist before the system is placed on the market or put
  into service, and to be kept up to date.
- Link evidence instead of copying it: test reports, datasheets, risk
  register, quality management procedures. Each link must point to a
  controlled, versioned document.
- Small and medium-sized enterprises may be allowed a simplified form;
  check current guidance from the European Commission.
- Read the Regulation itself for the binding wording; this template only
  summarises the headings in its own words.
-->

## Document control

<!-- Guidance: The authority or notified body must be able to tell exactly which system version this file describes and who is responsible for it. -->

| Field | Value |
|---|---|
| Document ID | [TD-AISYS-001] |
| AI system name and version | [Name] [version] |
| Unique identifier | [Internal ID; EU database registration number when assigned] |
| Provider | [Legal name, address] |
| Authorised representative (if provider outside the EU) | [Name, address] |
| Document version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@compliance-owner] |
| Classification | [Confidential] |
| Last updated | YYYY-MM-DD |
| Retention | *Example:* 10 years after the system is placed on the market or put into service |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Head of AI engineering | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Quality management representative | [@name] | [Decision] | YYYY-MM-DD |
| Legal / regulatory affairs | [@name] | [Decision] | YYYY-MM-DD |
| Accountable executive | [@name] | [Decision] | YYYY-MM-DD |

## Revision history

<!-- Guidance: Every change to the system that affects these headings creates a new revision. Link to section 6 for substantial modifications. -->

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Baseline for conformity assessment |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Updated accuracy figures after retraining within the predetermined change plan |

## Contents

<!-- Guidance: Keep the nine Annex IV headings in order; add appendices after them. -->

1. [General description of the AI system](#1-general-description-of-the-ai-system)
2. [Detailed description of elements and development process](#2-detailed-description-of-elements-and-development-process)
3. [Monitoring, functioning and control](#3-monitoring-functioning-and-control)
4. [Appropriateness of performance metrics](#4-appropriateness-of-performance-metrics)
5. [Risk management system](#5-risk-management-system)
6. [Changes through the lifecycle](#6-changes-through-the-lifecycle)
7. [Harmonised standards and other specifications applied](#7-harmonised-standards-and-other-specifications-applied)
8. [EU declaration of conformity](#8-eu-declaration-of-conformity)
9. [Post-market monitoring](#9-post-market-monitoring)
10. [Appendices](#10-appendices)

## 1. General description of the AI system

<!-- Guidance: Describe the system so that a reader without technical background can understand what it does, for whom, and in what setting. Include how it is delivered and how deployers interact with it. -->

### 1.1 Intended purpose

[State the intended purpose precisely: the task, the decisions it informs,
the deployers and the persons affected. Example: "Ranks job applications
for a vacancy by match to stated requirements, to help recruiters decide
whom to invite to interview. Used by trained HR staff of deploying
employers in the EU. Affected persons: job applicants."]

### 1.2 Provider and system identification

| Item | Value |
|---|---|
| Provider | [Name and contact] |
| System name, version and release date | [Name] [version], YYYY-MM-DD |
| Versions of relevant software or firmware | *Example:* Scoring service 3.4.1; model 2026.09; UI 5.2 |
| Forms in which it is placed on the market | *Example:* SaaS API and web application; no on-premises version |
| Hardware it runs on | *Example:* Provider-operated cloud, EU region; no specific deployer hardware |
| Product it is a component of (if any) | [None / Product name; include images showing external features and markings] |

### 1.3 High-risk classification

| Question | Answer |
|---|---|
| Basis for high-risk status | *Example:* Annex III area: employment, recruitment and selection of natural persons |
| Exceptions considered | [Whether an exception for narrow procedural or preparatory tasks was assessed, and the result] |
| Conformity assessment route | *Example:* Internal control by the provider |

### 1.4 Interaction with other systems

[Describe interfaces with hardware, software and other AI systems that
are not part of this system, including general-purpose AI models used.
Example: "Receives applications from the deployer's applicant tracking
system through a REST API; uses a third-party language model for CV
parsing under a contract that provides the documentation listed in 2.1."]

### 1.5 User interface and instructions for use

[Describe the interface provided to the deployer and link the instructions
for use. Example: "Recruiters see a ranked list with a score band and the
top three requirement matches for each candidate; instructions for use
document IFU-HR-3.4 explain limitations and oversight duties."]

## 2. Detailed description of elements and development process

<!-- Guidance: Explain how the system was built, why key choices were made, and how it was tested. This is the core engineering evidence. -->

### 2.1 Development methods and third-party components

| Element | Description | Source | Evidence |
|---|---|---|---|
| Pre-trained model | *Example:* Multilingual text encoder [name, version] | Third party | Supplier documentation, licence |
| Fine-tuned ranking model | *Example:* Gradient-boosted ranker on encoder features | In-house | Model card MC-HR-001 |
| Tools and libraries | *Example:* Training framework [name, version] | Open source | SBOM reference |
| [Element] | [Description] | [Source] | [Evidence] |

### 2.2 Design specifications

| Topic | Description |
|---|---|
| General logic and algorithms | [How inputs become outputs] |
| Key design choices and rationale | *Example:* Score bands instead of raw scores to reduce over-reliance |
| Assumptions about persons or groups | *Example:* Applications are in one of the 6 supported languages |
| Main classification or ranking choices | [Description] |
| What the system optimises and the relevance of parameters | *Example:* Agreement with recruiter shortlist decisions, constrained by group parity limits |
| Expected output and its quality | [Description] |
| Trade-offs to meet the requirements | *Example:* Removed free-text hobbies field; small accuracy loss, lower proxy risk |

### 2.3 System architecture and computational resources

The diagram shows how the components are connected and where data flows.

```mermaid
flowchart LR
  ats["Deployer applicant tracking system"] --> api["Scoring API"]
  api --> parse["CV parser (third-party model)"]
  parse --> feat["Feature builder"]
  feat --> rank["Ranking model"]
  rank --> ui["Recruiter interface"]
  api --> logs[("Event logs, retained per 3.5")]
```

[Describe components, integration, and resources used to develop, train,
test and validate. Example: "Training on 8 GPUs for 6 hours per run;
serving on CPU instances in one EU cloud region."]

### 2.4 Data requirements and data governance

| Dataset | Purpose | Provenance and scope | Main characteristics | Labelling and cleaning | Datasheet |
|---|---|---|---|---|---|
| *Example:* Historic applications 2021-2025 | Training | Three consenting employer customers, EU | 410 000 applications, 6 languages | Shortlist outcomes; duplicates and incomplete CVs removed | DS-HR-001 |
| *Example:* Curated evaluation set | Validation and testing | Synthetic and consented real CVs | 12 000 applications, balanced by sex and age band | Two expert labellers per item | DS-HR-002 |
| [Dataset] | [Purpose] | [Provenance] | [Characteristics] | [Processing] | [Link] |

[Describe how relevance, representativeness, errors, completeness and
bias were examined, and any processing of special category data for bias
detection with its safeguards.]

### 2.5 Human oversight measures

[Describe the oversight measures built in and the technical aids that
help deployers interpret outputs. Example: "Recruiters must open each
candidate before rejection; the interface shows the evidence for each
match; a stop control disables automatic ranking for a vacancy."]

### 2.6 Predetermined changes

[Describe changes to the system and its performance that are planned in
advance, with the technical solutions that keep it compliant. Example:
"Quarterly retraining on new data within the same feature set, accepted
only if the criteria in 4 and the bias limits in 3.2 are met."]

### 2.7 Validation and testing

| Test | Data used | Metrics | Result | Report (dated, signed) |
|---|---|---|---|---|
| *Example:* Accuracy validation | DS-HR-002 | Top-10 recall, NDCG@10 | 0.86, 0.71 | TR-2026-031, YYYY-MM-DD, [@signatory] |
| *Example:* Group performance | DS-HR-002 by sex, age band, language | Selection rate ratio | Lowest ratio 0.87 | TR-2026-032 |
| *Example:* Robustness | Perturbed CVs (format, typos) | Rank stability | 94% unchanged in top 10 | TR-2026-033 |
| [Test] | [Data] | [Metrics] | [Result] | [Report] |

### 2.8 Cybersecurity measures

| Threat | Measure | Evidence |
|---|---|---|
| *Example:* Data poisoning through customer uploads | Training data only from vetted, signed snapshots | Procedure SEC-07 |
| *Example:* Prompt or input manipulation of the CV parser | Input sanitisation; parser output schema validation | Pen test report PT-2026-04 |
| *Example:* Model theft | Access control on registry; no model export | Access review log |
| [Threat] | [Measure] | [Evidence] |

## 3. Monitoring, functioning and control

<!-- Guidance: Describe capabilities and limits honestly, including accuracy for specific groups, foreseeable unintended outcomes, oversight measures, and input data specifications. -->

### 3.1 Capabilities and limitations

| Aspect | Description |
|---|---|
| Overall expected accuracy | *Example:* Top-10 recall 0.86 (95% CI 0.84 to 0.88) on DS-HR-002 |
| Accuracy for specific persons or groups | See 3.2 |
| Known limitations | *Example:* Lower accuracy for CVs with non-standard layouts and for career changers |
| Conditions where it should not be used | *Example:* Roles with fewer than 20 applicants; languages not listed in 1.3 |

### 3.2 Group performance

| Group | n | Selection rate | Ratio to highest group | Accuracy (top-10 recall) |
|---|---|---|---|---|
| *Example:* Women | 5 900 | 0.31 | 0.94 | 0.85 |
| *Example:* Men | 5 800 | 0.33 | 1.00 | 0.87 |
| *Example:* Age 55 and over | 1 100 | 0.29 | 0.87 | 0.82 |
| [Group] | [n] | [rate] | [ratio] | [value] |

### 3.3 Foreseeable unintended outcomes and risk sources

[List risks to health, safety and fundamental rights, and risks of
discrimination, that may arise from the intended purpose or reasonably
foreseeable misuse. Example: "Recruiters may treat the ranking as a final
decision (automation bias); indirect discrimination through employment
gaps as a proxy for caring responsibilities."]

### 3.4 Human oversight and input data specifications

| Item | Description |
|---|---|
| Oversight measures for deployers | [Reference to 2.5 and instructions for use] |
| Input data specifications | *Example:* PDF or DOCX CV up to 5 pages; vacancy requirements as structured list |
| Behaviour on invalid input | *Example:* Candidate flagged "not scored" and shown unranked |

### 3.5 Logging

[Describe the automatic event logs that allow traceability: what is
logged, retention, and access. Example: "Each scoring event logs request
ID, model version, input hash, output band and reviewer actions; kept 24
months."]

## 4. Appropriateness of performance metrics

<!-- Guidance: Explain why the chosen metrics are suitable for the intended purpose and the people affected, and why the thresholds are adequate. -->

| Metric | Why it fits the intended purpose | Threshold | Why this threshold |
|---|---|---|---|
| Top-10 recall | Recruiters review the top 10; missing a qualified candidate harms that candidate | at least 0.80 | Equal to the recall of two independent human screeners |
| Selection rate ratio | Detects unequal shortlisting across groups | at least 0.80 for every group | Common practice for adverse impact screening; reviewed by legal |
| Rank stability under perturbation | Formatting must not change outcomes | at least 90% | Agreed with deployer panel |
| [Metric] | [Fit] | [Threshold] | [Reason] |

## 5. Risk management system

<!-- Guidance: Summarise the continuous risk management process and link the full risk register. Show identification, estimation, evaluation, mitigation and residual risk. -->

[Describe the process: roles, frequency, inputs (testing, post-market
data), and how residual risk is judged acceptable. Link the register.]

| ID | Risk | Affected | Severity | Likelihood | Mitigation | Residual | Owner |
|---|---|---|---|---|---|---|---|
| RM-01 | *Example:* Indirect age discrimination | Applicants 55+ | High | Medium | Removed graduation year; parity constraint; monitoring in 9 | Low | [@name] |
| RM-02 | *Example:* Automation bias | Applicants | High | Medium | Score bands; mandatory review; deployer training | Medium | [@name] |
| [RM-nn] | [Risk] | [Group] | [H / M / L] | [H / M / L] | [Measures] | [H / M / L] | [@name] |

## 6. Changes through the lifecycle

<!-- Guidance: Record every relevant change made by the provider, and whether it is within the predetermined plan or a substantial modification needing new assessment. -->

| Change ID | Date | Description | Within predetermined plan | Substantial modification | Reassessment |
|---|---|---|---|---|---|
| CH-01 | YYYY-MM-DD | *Example:* Quarterly retraining, same features | Yes | No | Tests TR-2026-041 |
| CH-02 | YYYY-MM-DD | *Example:* Added Polish language support | No | Under review | [Reference] |
| [CH-nn] | YYYY-MM-DD | [Description] | [Yes / No] | [Yes / No] | [Reference] |

## 7. Harmonised standards and other specifications applied

<!-- Guidance: List standards applied in full or in part. Where no harmonised standard is applied, describe the solutions adopted to meet each requirement. -->

| Standard or specification | Applied | Requirements addressed | Notes |
|---|---|---|---|
| [Harmonised standard reference, once published in the Official Journal] | [Full / Partial] | [Requirement] | [Notes] |
| *Example:* ISO/IEC 42001:2023 | Partial | Quality management, risk management | Certified scope [reference] |
| *Example:* ISO/IEC 23894:2023 | Partial | AI risk management | Process in 5 |
| [Other specification] | [Full / Partial] | [Requirement] | [Notes] |

Where no harmonised standard applies: [describe the solutions adopted for
each requirement on risk management, data governance, documentation,
record-keeping, transparency, human oversight, and accuracy, robustness
and cybersecurity].

## 8. EU declaration of conformity

<!-- Guidance: Attach or reference a copy of the signed declaration. The declaration itself follows its own required content; this section only records it. -->

| Item | Value |
|---|---|
| Declaration reference | [DoC-AISYS-001] |
| Date signed | YYYY-MM-DD |
| Signed by | [Name, function] |
| Location of signed copy | [Controlled document location] |
| CE marking applied | [Yes / No, date] |
| EU database registration | [Registration reference, date] |

## 9. Post-market monitoring

<!-- Guidance: Describe how performance is evaluated once in use, including the post-market monitoring plan, data collected from deployers, and the serious incident process. -->

| Element | Plan |
|---|---|
| Data collected | *Example:* Scoring logs, recruiter overrides, complaints, deployer feedback |
| Indicators | *Example:* Selection rate ratio per group monthly; override rate; top-10 recall on audited samples |
| Thresholds and actions | *Example:* Ratio below 0.80 for any group triggers investigation within 10 working days |
| Frequency of review | *Example:* Monthly operational, quarterly management review |
| Serious incident reporting | [Internal procedure reference and responsible role] |
| Feedback to risk management | Results update the register in 5 |
| Plan document | [PMM-AISYS-001] |

## 10. Appendices

<!-- Guidance: Index of supporting evidence and the terms used. -->

### 10.1 Evidence index

| Ref | Document | Version | Location |
|---|---|---|---|
| E-01 | Instructions for use | [v] | [Link] |
| E-02 | Model card | [v] | [Link] |
| E-03 | Datasheets | [v] | [Link] |
| E-04 | Test reports | [v] | [Link] |
| E-05 | Risk register | [v] | [Link] |
| E-06 | Quality management system procedures | [v] | [Link] |

### 10.2 Glossary

| Term | Meaning in this document |
|---|---|
| Provider | The organisation that develops the system and places it on the market under its name |
| Deployer | The organisation using the system under its authority |
| Substantial modification | A change not foreseen in the initial assessment that affects compliance or intended purpose |
| Selection rate ratio | Selection rate of a group divided by that of the group with the highest rate |

## Standard and licence note

Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, OJ L of
24 July 2026), Annex IV, technical documentation for high-risk AI
systems; EU legislative
texts are free to reuse. The headings are summarised in original wording
and no text of the Regulation is reproduced; consult the Official Journal
of the European Union for the binding text and current Commission
guidance. This is a documentation format, not legal advice. Template
licence: MIT.