Notifications
Clear all
Topic starter
02/08/2026 11:45 am
TL;DR: High-risk AI systems must have Annex IV technical documentation ready before market placement, covering nine sections from design through post-market monitoring, with documentation kept current for 10 years, according to Openlayer. The compliance problem is not writing the file once, but keeping evidence aligned with deployed behaviour as models and prompts change.
NHIMG editorial — based on content published by Openlayer: All posts Compliance Governance EU AI Act technical documentation requirements: Complete guide for April 2026
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should teams keep EU AI Act documentation aligned with deployed AI systems?
A: Treat documentation as a living control tied to release governance.
Q: When does AI documentation become a governance failure instead of a paperwork issue?
A: It becomes a governance failure when the documented system no longer matches the deployed system.
Q: What do organisations get wrong about post-market monitoring under the EU AI Act?
A: They often treat monitoring as a dashboard problem rather than an evidence problem.
Practitioner guidance
- Automate Annex IV evidence capture Generate documentation from the same CI/CD and model-release events that change the deployed system, so the evidence set reflects the live configuration rather than a prior approval snapshot.
- Tie privileged change approval to compliance records Require release approvals, model ownership, and deployment changes to be recorded together so auditors can trace who changed the AI system and under what authority.
- Build post-market monitoring into release criteria Make monitoring thresholds, drift checks, and exception handling part of the definition of done before a high-risk model can ship.
What's in the full article
Openlayer's full guide covers the operational detail this post intentionally leaves for the source:
- A section-by-section breakdown of Annex IV evidence requirements for teams preparing for conformity assessment.
- Examples of how continuous evaluation integrates into CI/CD workflows for regulated AI releases.
- Clarification on SME documentation relief and how the simplified Commission form maps to the same nine areas.
- Practical retention and access considerations for keeping documentation available to competent authorities.
👉 Read Openlayer's guide to EU AI Act technical documentation requirements →
EU AI Act documentation deadlines: are your AI controls ready?
Explore further
02/08/2026 12:56 pm
Documentation drift is the real EU AI Act control failure. The article is right to frame Annex IV as a pre-deployment obligation, but the deeper governance issue is keeping evidence synchronized with a system that keeps changing. That is the same structural weakness NHI programmes face when credentials, permissions, or ownership records lag behind runtime reality. Practitioners should treat documentation freshness as a control boundary, not an office process.
A question worth separating out:
Q: Who is accountable when high-risk AI documentation goes out of date?
A: The provider is primarily accountable, because the provider places the system on the market and owns the documentation burden. Importers and authorized representatives may carry secondary duties, but they do not replace the provider’s responsibility to keep evidence current, accessible, and aligned with the deployed system.
👉 Read our full editorial: EU AI Act technical documentation demands start before deployment
