AI Act Annex IV technical documentation: the checklist for SaaS publishers

1. General description of the system

• The intended purpose of the system and the identity of the provider.
• Versions and their update history.
• How the system interacts with third-party hardware or software.
• The forms in which the system is placed on the market (API, integration, application).

2. Design and development

• Design choices, including the general logic of the system and algorithms.
• The architecture and computational resources used.
• Where applicable, pre-trained or third-party models used (e.g. LLM API) and how they are integrated.
• Input data specifications.

3. Training, validation and testing data

• The provenance and nature of the datasets.
• Collection, labelling and cleaning methods.
• Examination of potential biases and mitigation measures.
• Criteria for representativeness and relevance of data.

4. Performance, robustness and cybersecurity

• Accuracy metrics and test results.
• Known limitations of the system and circumstances affecting its performance.
• Robustness measures against errors and manipulation attempts.
• Cybersecurity measures.

5. Risk management and human oversight

• Description of the risk management system in place.
• Human oversight measures built into the design (interface, control points).
• Instructions for use provided to the deployer (Art. 13).

6. Post-market monitoring

• The post-market monitoring plan: collection and analysis of incidents and usage feedback.
• Procedures for reporting serious incidents.
• The process for updating documentation as the system evolves.

Key takeaway: Annex IV documentation is not a static document. It is a living file, updated with each significant evolution. It must be accessible to deployer customers upon request and to authorities. Building it in advance rather than in the rush of an inspection is a factor of peace of mind — and commercial credibility. See am I a provider?.