To document AI use in accordance with the AI Act, you must maintain a technical file for each AI system that describes its purpose, risk class, operation, and responsibilities. The level of detail required in this documentation depends on your system’s risk class: high-risk AI requires a complete technical file and registration in an EU database, while AI with limited risk is subject to less stringent transparency requirements. In this article, we answer the most frequently asked questions about AI governance and documentation, so you know exactly what your organization needs to do.
Which AI systems are you required to document under the AI Act?
Under the AI Act, you are required to document your system as soon as you offer or deploy an AI system classified as high-risk, or when you use a system subject to the transparency requirements for limited risk. The majority of current AI applications fall into the minimal-risk or no-risk category and remain unregulated, but you must be able to demonstrate which category your system belongs to.
The law distinguishes between four risk levels. Prohibited AI (unacceptable risk) simply may not be used. High-risk AI requires extensive documentation and a conformity assessment. Low-risk AI is subject to less stringent transparency requirements, such as the obligation to inform users that they are interacting with an AI system. Minimal-risk AI is largely exempt from documentation requirements.
High-risk AI is defined in two categories. First, systems that serve as safety components of products covered by European harmonization legislation and require a third-party conformity assessment. Second, systems that fall under one of the eight domains listed in Annex III:
- Biometrics
- Critical Infrastructure
- Education and Vocational Training
- Employment and Human Resources Management
- Access to essential services (such as creditworthiness or emergency calls)
- Law Enforcement
- Migration and Border Control
- The Administration of Justice and Democratic Processes
Important: Systems that perform profiling of natural persons are always high-risk, regardless of the domain. A system that performs only a narrow procedural or preparatory task and does not pose a significant risk to fundamental rights may fall outside the high-risk category, but only if you provide substantiated documentation to support this.
What exactly must be included in AI Act-compliant documentation?
AI Act-compliant documentation for high-risk systems must include, at a minimum, a technical file containing a description of the system and its intended purpose, a risk analysis, information about the training data and the system’s operation, and a description of the human oversight measures. For low-risk systems, a more concise transparency documentation is sufficient.
For high-risk AI, the AI Act requires the following elements to be included in the technical dossier:
- General description: What does the system do, what is its intended use, and who are the end users?
- Risk Class Justification: Why does the system fall into the high-risk category—or why doesn’t it?
- Technical specifications: architecture, algorithms, training data, and performance metrics
- Risk Management System: What risks have been identified, and what measures have been taken?
- Human oversight: How and by whom is the system monitored?
- Declaration of Conformity: a statement that the system meets the requirements
- Registration: enrollment in the EU database for high-risk systems
Documentation must be retained for ten years after the system is placed on the market or put into service. This also applies to importers, who are required to verify that the conformity assessment has been conducted and that the CE marking is present before introducing a system.
How does documentation differ for AI providers and users?
Providers of AI systems bear the heaviest documentation obligations: they must prepare the complete technical file, conduct the conformity assessment, and register the system. Users (referred to as “deployers” in the AI Act) have a lighter obligation, but are required to use the system in accordance with the provider’s instructions and to report incidents.
In practice, the distinction isn’t always clear-cut. An organization that purchases a standard AI tool from an external vendor is a deployer. But as soon as you customize that tool, put your own name on it, or change its intended purpose in such a way that the system becomes high-risk, you yourself become a provider, with all the associated obligations.
Deployers are subject to the following obligations, among others, when using high-risk AI:
- Use the system only for its intended purpose as described by the provider
- Ensure human supervision by qualified staff
- Report serious incidents to the market surveillance authority
- Conduct a fundamental rights impact assessment for certain applications
- Keep logs of usage, to the extent that you have control over it
In addition, providers outside the EU must designate an authorized representative in the EU who will comply with the obligations on their behalf.
How do you set up a practical AI registry for your organization?
To create a practical AI registry, start by taking inventory of all AI systems in your organization, classifying them by risk level, and recording the key details for each system. The registry forms the backbone of your AI governance and makes it possible to quickly demonstrate which systems you use and how you ensure compliance.
Build your registry in three steps:
- Take stock: Identify all AI applications, including purchased tools, features embedded in software, and internally developed systems. Don’t forget AI features in existing software, such as automatic email sorting or predictive text.
- Classify: Determine the risk class for each system based on the AI Act criteria. Document your reasoning so that, in the event of an audit, you can demonstrate why you classified a system as low-risk.
- Document: For each system, record who the provider is, what the intended use is, who is responsible within your organization, what data the system uses, and what measures are in place for human oversight.
Keep the registry up to date by linking it to your procurement process: every new AI system you purchase or implement is immediately recorded and classified. Assign an owner for each system so that responsibilities are clear. The AI Act also requires organizations to ensure AI literacy (Article 4, effective as of February 2, 2025), which means that employees who work with AI systems must have sufficient knowledge of how they operate and the risks they pose.
What tools and templates can help with AI Act documentation?
For AI Act documentation, you can use risk assessment templates from national regulators, open standards such as model cards and data sheets for datasets, and specialized compliance software solutions. The European Commission and the AI Office also publish guidelines and standard forms that serve as a starting point.
Practical tools you can use:
- Risk Assessment Templates: The AI Office and national authorities provide templates for classifying AI systems and justifying your choice of risk class
- Model cards: standardized documents that describe the operation, limitations, and intended uses of an AI model, originally developed by the research community
- Data Impact Assessments: Templates for Assessing the Risks of Training Data, Including Bias and Privacy Considerations
- Fundamental Rights Impact Assessment: This is mandatory for certain high-risk applications; the Commission is working on a standardized format
- Compliance software: specialized platforms help you maintain your AI registry, schedule audits, and manage documentation across multiple systems
Where possible, align your AI documentation with existing information security and privacy management processes. If your organization already uses an Information Security Management System (ISMS) based on ISO 27001, you can logically integrate AI-related risks and documentation into it.
What are the consequences if your AI documentation isn’t in order?
If your AI documentation does not comply with the AI Act, you risk fines of up to 15 million euros or 3% of your global annual revenue for non-compliance with the requirements. For violations of prohibited practices, the fine can reach up to 35 million euros or 7% of annual revenue. In addition to financial penalties, you also risk reputational damage and operational shutdowns.
The penalty structure has three levels:
- Prohibited Practices (Article 5): up to 35 million euros or 7% of global annual revenue
- Non-compliance with other obligations: up to 15 million euros or 3% of annual revenue
- Inaccurate or misleading information provided to authorities: up to 7.5 million euros or 1% of annual revenue
For SMEs and startups, the lower of the percentage or the fixed amount applies in each case, which offers some protection. Most of the requirements for high-risk Annex III systems take effect on August 2, 2026, so organizations still have time to get their documentation in order. Oversight of high-risk AI rests with national market surveillance authorities, which may lead to differences in priorities among Member States. In January 2026, Finland became the first Member State to grant enforcement powers to its authority.
In addition to fines, there are also indirect consequences: without demonstrable AI governance, you lose the trust of customers and partners, you can no longer legally deploy high-risk systems, and you run the risk of liability if an AI system causes harm without you being able to demonstrate that you had taken the appropriate measures.
How Pegamento Helps with AI Governance and Documentation
Setting up effective AI governance requires more than just a spreadsheet listing systems. It requires a structured approach that aligns with your existing security, quality, and compliance processes. We help organizations establish a practical AI governance structure, from assessment to documentation and monitoring.
What specifically we can do for you:
- Identify which AI systems your organization uses, including features embedded in existing software
- Classifying systems based on the AI Act risk criteria, with supporting documentation
- Setting up an AI registry that aligns with your existing ISMS and ISO 27001 processes
- Implementation of Agentic AI assistants that comply with transparency and documentation requirements, including the necessary technical documentation
- Training employees in AI literacy in accordance with Article 4 of the AI Act
Our approach combines proven standard building blocks into a customized solution for your organization, without the need for costly custom development. Everything under one roof: from consulting and implementation to management and support. Want to know where you stand with your AI documentation and what you still need to do to meet the 2026 deadlines? Get in touch, and we’ll work together to find the best approach for your situation.
Frequently Asked Questions
As a small organization or SME, do I also have to comply with the AI Act’s documentation requirements?
Yes, the AI Act generally applies to all organizations that offer or deploy AI systems within the EU, regardless of their size. SMEs and startups do receive some protection through the fine structure (the lower of the fixed amount or the percentage of revenue applies), and the AI Office provides simplified guidelines specifically for smaller organizations. Nevertheless, even as an SME, it’s wise to start conducting a basic inventory of your AI systems now, so you won’t be caught off guard as the 2026 deadlines approach.
How do I know if an AI tool I’m purchasing from a third-party vendor is high-risk?
Actively ask the supplier about the system’s risk classification and whether a technical file and declaration of conformity are available. High-risk systems must be registered by the provider in the EU database and bear a CE marking. As a deployer, you are required to verify that the provider has fulfilled its obligations before putting the system into service—if this documentation is missing, you yourself are at risk in the event of an inspection.
What is the difference between an AI register and a technical dossier, and do I need both?
An AI register is an internal overview document of all AI systems your organization uses, including their risk class, owner, and intended use—it is your management tool for AI governance. A technical dossier is a detailed, legally required document for each high-risk system that includes its technical operation, risk analysis, and declaration of conformity. You need both: the register as the foundation for your governance structure, and the technical dossier as proof of compliance for high-risk applications.
What should I do if an AI system I’m using changes risk classes, for example, due to an update from the vendor?
As soon as a supplier implements a significant update that substantially alters the intended use or operation of the system, the risk classification may indeed change—and with it, your obligations as the deployer. Ensure that your contracts require suppliers to notify you of any changes that could affect the risk class, and update the classification in your AI registry with every material update. Integrate this into your procurement process so you don’t face any surprises later on.
How do I handle AI features that are already built into existing software, such as CRM or HR systems?
Embedded AI features in standard software are often overlooked, but they do fall under the AI Act if they support decision-making in high-risk areas such as human resources or lending. Actively identify which AI functionalities are present in your existing software packages—check with vendors if it’s unclear—and include them in your AI registry. If the vendor is the provider, verify that they have complied with their documentation obligations.
How do I ensure my AI documentation stays up to date as regulations evolve?
Designate a responsible person—for example, an AI coordinator or an existing compliance officer—who actively monitors developments related to the AI Act, including guidelines from the AI Office and updates from national regulators. Link your AI register to a fixed review cycle, at least annually or whenever there is a significant change to a system or the regulations. Subscribe to updates from the European AI Office and relevant national authorities to respond in a timely manner to new obligations or changes in interpretation.
Can employees be held personally liable if AI documentation is not in order?
The AI Act primarily targets organizations as legal entities, not individual employees. However, internal liability may arise within an organization if an employee is demonstrably negligent in complying with established procedures. Therefore, ensure a clear division of responsibilities in your AI governance—specify who is responsible for documentation, classification, and oversight—and ensure that employees are adequately trained on their obligations under Article 4 of the AI Act.
