Anhang IV AI Act

Annex IV requires nine sections: (1) general description of the AI system, (2) detailed description of elements and development process, (3) monitoring and control information, (4) appropriateness of performance metrics, (5) risk management, (6) lifecycle changes, (7) applied standards, (8) EU declaration of conformity, and (9) post-market monitoring system.

Point 2d requires: data requirements including datasheets with training methodologies, description of training datasets, provenance and scope of data, how data was obtained and selected, labelling procedures (e.g. for supervised learning), and data cleaning methods (e.g. outlier detection).

Yes, point 2h of Annex IV explicitly requires that cybersecurity measures put in place are included in the technical documentation.

Point 2e requires an assessment of human oversight measures needed under Article 14, including an assessment of technical measures to facilitate interpretation of AI outputs by deployers (under Article 13(3)(d)).

Point 5 requires a detailed description of the risk management system under Article 9. This includes identification of risks to health, safety and fundamental rights, risk mitigation measures, and residual risk analysis.

Yes, point 2g requires: validation and testing procedures, information on test and validation data, metrics for accuracy, robustness and compliance, potentially discriminatory impacts, test logs and all test reports dated and signed.

Point 1 requires: (a) intended purpose, provider name and version, (b) interaction with hardware/software, (c) software versions, (d) forms of market placement (API, download, etc.), (e) intended hardware, (f) photos for embedded products, (g) user interface description, (h) instructions for use.

Yes, point 6 requires a description of relevant changes made by the provider throughout the lifecycle. Point 2f also requires documentation of pre-determined changes and how continuous compliance is ensured.

No, Annex IV is only mandatory for high-risk AI systems (under Article 11(1)). For general-purpose AI models (GPAI), Annex XI applies instead.

Point 9 requires a detailed description of the system for evaluating AI performance post-market, in accordance with Article 72, including the post-market monitoring plan of Article 72(3).

Yes, point 7 requires a list of applied harmonised standards. If no harmonised standards were applied, a detailed description must be provided of alternative solutions to meet the requirements of Chapter III, Section 2.

Under Article 18, technical documentation must be drawn up before the AI system is placed on the market and kept up to date. The documentation must be available to competent authorities for at least 10 years after market placement.

ISO/IEC 42001 (AI Management System) provides a framework that partially overlaps with Annex IV requirements. However, ISO 42001 certification does not automatically cover all requirements. Annex IV contains specific EU requirements around conformity declaration, post-market monitoring and CE marking that go beyond ISO 42001.

The technical documentation must be available to national market surveillance authorities upon request. You do not need to publish the documentation publicly. For high-risk AI systems requiring assessment by a notified body (Annex VII), the documentation must also be provided to that body.

The technical documentation must be prepared in a language accepted by the relevant Member State. In practice, most Member States accept English. Check with your national supervisory authority whether documentation in Dutch or English suffices for your market.