AI-driven process automation is subject to documentation requirements that are primarily set forth in the European AI Regulation (EU AI Act). The extent of these requirements depends on your system’s risk class: the higher the risk, the more extensive the documentation requirements. In this article, we answer the most frequently asked questions about exactly what you need to document, who is responsible for it, and what’s at stake if your documentation isn’t in order. Would you like to first understand how AI-driven intelligence works in practice? That will help put the documentation requirements into context.
What laws and regulations govern the documentation requirements for AI systems?
The documentation requirements for AI systems in Europe are primarily governed by the EU AI Act, the European regulation on artificial intelligence that will take effect in phases. Prohibited practices take effect on February 2, 2025; the penalty structure applies starting August 2, 2025; and the obligations for providers of General Purpose AI models also took effect on August 2, 2025.
The law takes a risk-based approach. This means that not every AI system has to comply with the same rules. Most applications currently in use fall into the “minimal risk” or “no risk” categories and remain largely unregulated. Still, it’s wise to know where your system falls in the classification, because the consequences of an incorrect assessment can be severe.
In addition to the EU AI Act, the GDPR (for personal data processed by AI systems), sector-specific legislation, and national implementing rules may also play a role. In January 2026, Finland became the first member state to formally grant enforcement powers to its national authority, demonstrating that oversight is becoming increasingly concrete.
What exactly needs to be documented for an AI-driven automation system?
Exactly what you need to document for an AI-driven automation system depends on the risk class, but there are basic principles that apply to most systems: who developed the system, what it is intended for, how it works, and what data it uses. For high-risk systems, these requirements go much further.
For high-risk AI systems, the EU AI Act requires comprehensive technical documentation. Specifically, this includes:
- A description of the system, its intended purposes, and its technical architecture
- Information about training dates, validation methods, and test results
- Measures for Human Oversight and Risk Management
- A Fundamental Rights Impact Assessment in Specific Cases
- Logging and audit trails that show how the system makes decisions
- Information about the system’s accuracy, robustness, and cybersecurity
Additional requirements apply to General Purpose AI (GPAI) models, such as large language models that you integrate into your process automation. Providers of such models must prepare technical documentation in accordance with Annex XI of the regulation, inform downstream users about capabilities and limitations, implement a policy to comply with the Copyright Directive, and make a summary of the training data used publicly available.
Which risk class determines the extent of the documentation requirement?
The EU AI Act defines four risk levels, and the classification directly determines the extent of the documentation requirements. Prohibited applications may not be used; high-risk AI requires extensive documentation and conformity assessments; limited-risk AI is subject to lighter transparency obligations; and minimal-risk AI remains largely unregulated.
High-Risk AI: The Most Stringent Documentation Requirements
An AI system is considered high-risk if it is a safety-critical component of a product subject to European harmonization legislation and requires a third-party conformity assessment, or if it falls within one of the eight domains listed in Annex III. These domains are: biometrics, critical infrastructure, education and vocational training, employment and workforce management, access to essential services (such as credit scoring or health insurance), law enforcement, migration and border control, and the administration of justice and democratic processes.
Important: A system that performs only a narrow procedural or preparatory task and does not pose a significant risk to fundamental rights may fall outside the high-risk category, provided that the provider documents this with supporting evidence. However, systems that perform profiling of natural persons are always high-risk, without exception.
Limited risk: transparency as a minimum requirement
Systems with limited risk, such as chatbots or AI that generates text, must clearly inform users that they are communicating with an AI system. This transparency requirement is less stringent, but it is enforceable. This is an important consideration for process automation that supports customer contact.
Who within the organization is responsible for AI documentation?
The primary responsibility for AI documentation lies with the system provider, but if your organization deploys, modifies, or offers an AI system under its own name, you may be considered a provider yourself, with all the associated obligations. Deployers, importers, and distributors each have their own responsibilities.
In practice, this means that as an organization, you must clearly define who fulfills which role:
- Suppliers are responsible for the complete technical documentation, conformity assessment, and CE marking
- Deployers (those who put the system into operation) must ensure that it is used for its intended purpose and guarantee human oversight
- Importers must verify, prior to placing the product on the market, that the conformity assessment has been conducted and must retain the documentation for ten years
- Distributors verify that the required documents are present and suspend distribution if non-compliance is suspected
Please note: A distributor, importer, deployer, or third party becomes a provider itself if it adds its name to a system, makes a substantial modification, or changes the intended purpose in such a way that the system becomes high-risk. Internally, it is advisable to designate a responsible party, such as an AI compliance officer or an existing official who oversees documentation management.
How long should AI documentation and log files be retained?
For high-risk AI systems, the technical documentation and declaration of conformity must be retained for ten years. This applies to importers and suppliers. Log files generated by the system itself must be retained for at least six months, unless other legislation, such as the GDPR, requires a shorter retention period.
For organizations that use AI in process automation, it is advisable to align retention periods with multiple legal frameworks simultaneously. The EU AI Act, the GDPR, and any sector-specific regulations may stipulate different retention periods. A layered documentation strategy—in which you distinguish between technical system data, personal data, and audit logs—helps you comply with all obligations without retaining unnecessary data.
What are the consequences of insufficient documentation during an AI audit?
Insufficient documentation during an AI audit can result in hefty fines, mandatory changes to your system, or even a ban on further use. The EU AI Act’s fine structure has three levels, depending on the nature of the violation.
- Violations of prohibited practices (Article 5): up to 35 million euros or 7% of global annual revenue
- Non-compliance with other obligations: up to 15 million euros or 3% of global annual revenue
- Inaccurate or misleading information provided to authorities: up to 7.5 million euros or 1% of global annual revenue
For small and medium-sized enterprises, the lower of the percentage or the fixed amount applies in each case, which offers some protection. But even without fines, the consequences of inadequate documentation are significant: a regulator may request additional information, impose a corrective measure, or issue a warning that could damage a company’s reputation.
Oversight of high-risk AI rests with national market surveillance authorities, which in practice can lead to differences in priorities among Member States. The European AI Office oversees GPAI models in all 27 member states. Well-organized documentation is therefore not only a compliance requirement but also a way to quickly and convincingly demonstrate that your system is being used responsibly.
How Pegamento Helps with AI-Driven Process Automation and Compliance
We understand that the documentation requirements surrounding AI-driven process automation can seem complex, especially if you also want to take advantage of the operational benefits. At Pegamento, we offer customized solutions built on standard building blocks—not costly custom development, but a smart combination of proven modules that help your organization move forward quickly and responsibly.
Our Agentic AI for customer service is a good example of how we implement process automation in practice. What used to be called RPA, we now refer to as Agentic AI: an evolution from task-executing bots to self-thinking assistants that not only follow instructions but also take the initiative and act independently. This requires clear documentation, and we’re here to help you with that.
Specifically, we offer:
- Understanding the risk class of your AI applications and what that means for your documentation requirements
- Implementation of AI systems built with compliance as a guiding principle
- Everything under one roof: from development and implementation to management and support, without complex supplier structures
- Support in setting up logging, audit trails, and retention periods in accordance with the EU AI Act
- Certification in the areas of information security (ISO 27001), quality management (ISO 9001), and corporate social responsibility (ISO 26000) as the foundation for reliable AI deployment
Would you like to know where your organization currently stands in terms of AI documentation and process automation? Contact us, and we’d be happy to help you figure it out.
Frequently Asked Questions
Geldt de EU AI Act ook als ik een AI-systeem van een externe leverancier gebruik en niet zelf ontwikkel?
Ja, ook als deployer heb je verplichtingen onder de EU AI Act. Zodra jouw organisatie een AI-systeem in gebruik neemt, ben je verantwoordelijk voor gebruik conform het beoogde doel en het waarborgen van menselijk toezicht. Bovendien word je automatisch aangemerkt als aanbieder — met alle bijbehorende documentatieverplichtingen — als je het systeem onder eigen naam aanbiedt, substantieel aanpast, of het beoogde doel zodanig wijzigt dat het systeem hoog-risico wordt. Controleer dus altijd welke rol jouw organisatie precies vervult vóórdat je een AI-oplossing in productie neemt.
Hoe bepaal ik praktisch gezien in welke risicoklasse mijn AI-systeem valt?
Begin met de vraag of jouw systeem voorkomt in Annex III van de EU AI Act, de lijst met acht hoog-risico domeinen zoals personeelsbeheer, kredietbeoordeling of rechtshandhaving. Voer vervolgens een interne risicoanalyse uit waarbij je kijkt naar de impact op grondrechten, de mate van autonome besluitvorming en of het systeem persoonsprofilering uitvoert. Leg deze beoordeling altijd schriftelijk vast: een onderbouwde classificatie beschermt je bij een eventuele audit en is vereist als je claimt buiten de hoog-risico-categorie te vallen.
Wat is een praktisch startpunt voor organisaties die hun AI-documentatie nog niet op orde hebben?
Begin met een inventarisatie van alle AI-systemen die je organisatie momenteel gebruikt of ontwikkelt, inclusief ingekochte SaaS-oplossingen met AI-functionaliteit. Classificeer elk systeem op basis van de risicocategorieën uit de EU AI Act en stel per systeem een basisregistratie op met minimaal het doel, de werking, de gebruikte data en de verantwoordelijke persoon of afdeling. Wijs daarna een interne eigenaar aan — een AI-compliance officer of bestaande functionaris — die de documentatie actueel houdt en als aanspreekpunt fungeert bij toezicht.
Moet ik mijn AI-documentatie ook aanpassen als ik een bestaand systeem update of uitbreid?
Ja, documentatie is geen eenmalige exercitie maar een continu proces. Bij elke substantiële wijziging aan een hoog-risico AI-systeem — denk aan nieuwe trainingsdata, gewijzigde beslislogica of een uitgebreid toepassingsgebied — moet je beoordelen of de bestaande documentatie nog accuraat is en of een nieuwe conformiteitsbeoordeling nodig is. Een substantiële wijziging kan er bovendien toe leiden dat een systeem dat eerder buiten de hoog-risico-categorie viel, daar nu wél onder valt. Bouw daarom een changemanagementproces in waarbij AI-documentatie standaard onderdeel is van elke release.
Hoe verhoudt de documentatieplicht uit de EU AI Act zich tot wat ik al vastleg onder de AVG?
De AVG en de EU AI Act overlappen op het gebied van persoonsgegevens, maar ze vragen om verschillende soorten documentatie. Waar de AVG focust op verwerkingsactiviteiten, rechtsgronden en betrokkenenrechten, vraagt de EU AI Act om technische systeembeschrijvingen, trainingsdata-informatie en audittrails over besluitvorming. Voor AI-systemen die persoonsgegevens verwerken, is het verstandig om beide kaders samen te lezen en een geïntegreerde documentatiestrategie te hanteren, zodat je niet dubbel werk doet maar ook geen gaten laat vallen.
Wat als mijn AI-leverancier geen volledige technische documentatie wil of kan aanleveren?
Dit is een veelvoorkomend knelpunt, met name bij gebruik van grote internationale AI-platformen. Leg in je contracten met leveranciers expliciet vast welke documentatie zij moeten aanleveren en welke informatieverplichtingen op hen rusten als aanbieder of GPAI-modelaanbieder. Als een leverancier geen adequate documentatie kan leveren voor een hoog-risico toepassing, loop je als deployer zelf risico bij een audit. Overweeg in dat geval een alternatieve leverancier of beperk het gebruik tot toepassingen die buiten de hoog-risico-categorie vallen.
Zijn er uitzonderingen of verlichte verplichtingen voor kleine organisaties of start-ups?
De EU AI Act voorziet in enkele verzachtende maatregelen voor kleine en middelgrote ondernemingen en start-ups: bij boetes geldt altijd het laagste van het vaste bedrag of het omzetpercentage, en nationale autoriteiten kunnen vereenvoudigde conformiteitsbeoordelingsprocedures aanbieden. De inhoudelijke documentatieverplichtingen voor hoog-risico systemen gelden echter onverkort, ongeacht de omvang van je organisatie. Kleinere organisaties profiteren er dus van om vroeg te investeren in een schaalbare documentatieaanpak, zodat compliance geen bottleneck wordt bij groei.
