High-Risk AI Technical File and Quality Management System

How to use this document

• What it is for. It provides a reference structure for the provider of a high-risk AI system to prepare and maintain its technical documentation (art. 11 and Annex IV of Regulation (EU) 2024/1689, the "AI Act"), the outline of its quality management system (art. 17), the EU declaration of conformity (art. 47 and Annex V) and the information for registration in the EU database (art. 49 and Annex VIII). It does not replace harmonized standards, common specifications or the guidance and forms published by the Commission.
• Who should own it. The system's product owner, with quality, engineering and data science, security, legal and, where involved, the notified body. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Confirm with your advisor: whether the system is high-risk and why (section 2), whether the organization acts as provider (or becomes one by putting its name on the system, substantially modifying it or changing its intended purpose), which conformity assessment procedure applies (section 9) and which harmonized standards or specifications it will apply (section 3.7).
• Dates. The application dates for these obligations changed with Regulation (EU) 2026/1744 and may differ depending on whether the system is in Annex III or is a component of an Annex I product. See the dates in "Related regulatory references" and confirm them with your advisor.
• Simplified documentation. Art. 11(1) provides that certain smaller companies may provide the Annex IV elements in a simplified manner, using a Commission form. [COMPLETE: confirm with your advisor whether your organization qualifies (SMEs, start-ups and, under the amended text, small mid-caps) and whether the form has been published].
• Fields to complete. Replace [AI SYSTEM], [LEGAL ENTITY NAME], [OWNER] and the [COMPLETE] fields. Each item in Part A states what it should contain and where to link the evidence; do not copy long documents here, refer to them by code and version.
• Related documents. This file relies on other documents used as annexes; the list is at the end of the implementation aids. If your organization is not the provider but the deployer of the system, use the "High-Risk AI System Deployer Checklist" instead.
• Review and approval. Have your legal counsel and, where applicable, the notified body review the file before the conformity assessment. Management signs the EU declaration of conformity; record each version in "Version history."

High-Risk AI Technical File and Quality Management System

1. File control data

Field	Value
AI system	[AI SYSTEM]
System version	[COMPLETE]
Provider	[LEGAL ENTITY NAME]; [COMPLETE: address and contact]
EU authorized representative (if the provider is not established in the EU)	[COMPLETE]
Applicable Annex III point or Annex I act	[COMPLETE]
Conformity assessment procedure	[COMPLETE: internal control (Annex VI) or with a notified body (Annex VII)]
Notified body (if involved)	[COMPLETE: name and number]
File owner	[OWNER]
Owning function	[RESPONSIBLE FUNCTION]
File version and date	[COMPLETE]; [DATE]
Status	[COMPLETE: in preparation, submitted, current, withdrawn]

[ORGANIZATION NAME] keeps this file up to date throughout the lifecycle of [AI SYSTEM] and makes it available to the competent authorities and, where applicable, the notified body on request.

2. Classification and role

2.1 Why the system is high-risk

Question	Answer	Evidence
Is it a safety component of a product, or a product, covered by Annex I legislation requiring third-party assessment?	[COMPLETE]	[COMPLETE]
Does its intended purpose fall under any Annex III point? Which?	[COMPLETE]	[COMPLETE]
Does it perform profiling of natural persons? (if so, an Annex III system is always considered high-risk)	[COMPLETE]	[COMPLETE]
Conclusion	[COMPLETE: high-risk / not high-risk under art. 6(3)]	[COMPLETE]

2.2 Art. 6(3) assessment (only if the conclusion is not high-risk)

If [ORGANIZATION NAME] concludes that an Annex III system is not high-risk because it does not pose a significant risk of harm, it documents before placing it on the market which art. 6(3) condition is met and why:

• It performs a narrow procedural task.
• It improves the result of a previously completed human activity.
• It detects decision-making patterns or deviations from prior patterns, without replacing or influencing the previously completed human assessment without proper human review.
• It performs a preparatory task to an assessment relevant to the Annex III use cases.

Rationale: [COMPLETE]. This assessment is kept and registered under section 8.2.

2.3 The organization's role

Question	Answer
Does it develop the system, or have it developed, and place it on the market under its name or trademark?	[COMPLETE]
Has it substantially modified another provider's high-risk system or changed its intended purpose?	[COMPLETE]
Does it integrate a third party's general-purpose AI model? What information has that provider given it?	[COMPLETE]
Resulting role	[COMPLETE: provider / other, with rationale]