A practical guide to preparing the conformity file (technical documentation) for a high-risk AI system under the EU AI Act: the nine chapters it must include, the link to risk management and the declaration of conformity, the relief for small and medium businesses, and how long to keep it.
The conformity file, also known as the technical documentation of the AI system, is the document meant to prove to a competent authority or a notified body that the system meets the requirements of the EU AI Act. For a high-risk system, holding such a file is not a recommendation but an obligation, and it is the basis on which any conformity assessment is built.
This article walks through the structure of the file and the order of preparing it, step by step.
The EU AI Act requires a provider of a high-risk system to prepare technical documentation before the system goes to market, and to keep it updated throughout its life cycle. This documentation is not just an internal memo: it is what is shown to a supervisory authority or a notified body when the system's compliance is examined, and it is the basis on which the declaration of conformity is signed.
An organization that arrives at an examination without an orderly file exposes itself to a delayed market entry and to fines.
Based on a review of current interpretive sources for the relevant annex of the act, the conformity file is built from nine main parts: a general description of the system and its purpose; a detailed description of the development and design process (including data governance, architecture, testing, and cybersecurity measures); information on how the system's operation is monitored and controlled; a description of the metrics chosen to measure performance and their suitability; a description of the risk management system established for the system; documentation of the substantial changes made to the system over its life; a list of the applied harmonized standards or a description of the alternative solutions adopted in their place; a copy of the declaration of conformity itself; and a description of the post-market monitoring plan.
Each of these parts is examined separately, so a file missing one part can hold up the whole process.
The conformity file does not stand on its own. The risk management chapter in the file must reflect the risk management system the act requires to be established separately for every high-risk system, not be a general summary of it. Likewise, the declaration of conformity attached to the file is the formal document in which the provider declares compliance, and every claim in it must be backed by the matching chapter in the file itself.
A mismatch between the declaration and the documentation is exactly what an orderly examination is meant to reveal.
The obligation does not end at market entry. The conformity file also includes a plan to monitor the system's performance after launch, whose role is to detect early any performance drift or faults not foreseen at the development stage. Such a plan must be kept current, not a document written once and forgotten in a drawer.
A small or medium business, including a start-up, may prepare the chapters of the file in a relatively shortened format compared with a large company, provided the documentation still serves the file's purpose: to prove compliance. The relief is meant to keep the bureaucratic burden from blocking small companies from the market, but it does not exempt them from the obligation itself, only ease how it is carried out.
The conformity file is not a one-time document. It must be kept available and updated for many years after the system goes to market, so a competent authority can request it even years later. An organization that stops maintaining the file the moment the system launches, instead of treating it as a living document, risks that in a future examination it no longer reflects the system as it actually is.
Preparation starts early, not the moment the system is ready to launch: map which of the organization's systems fall under the documentation obligation, build a uniform template for the nine chapters so that not every team documents in its own way, make sure the risk management chapter in the file actually matches the risk management system established, and assign one owner to keep the file current throughout the system's life, not only at launch.
Note: the information above is based on a current review of interpretive sources for the EU AI Act, and is not a substitute for reading the binding text of the act or for individual legal advice. Using the organization's data to prepare the conformity file, including compliance with the privacy and data protection laws that apply to that data, is the organization's sole responsibility, and nothing here constitutes an examination, an approval, or advice regarding the organization's specific data.
נושא: בינה מלאכותית וממשל סיכונים
Real estate advisory & opinion · AI advisory & opinion · Advisory · Mediation & dispute resolution · Articles · Q&A · Readiness assessment · Book a call