For a high-risk AI system the EU AI Act names the file you must hold: the technical documentation set out in Annex IV. This pack provides that Annex IV documentation together with the thirteen other compliance areas around it. 60 editable Word documents, downloadable the moment you check out. On this page:
- What is in the Annex IV documentation pack
- The deadlines moved, but not the ones most people assume
- Who needs Annex IV documentation
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the Annex IV documentation pack
The fourteen sections map to the structure of the Regulation rather than to a generic AI policy:
- 1. Governance and Accountability – AI governance framework, roles, and the accountability structure the Act expects
- 2. Risk Classification and Assessment – the determination of whether a system is prohibited, high-risk, limited-risk or minimal, recorded as a defensible decision
- 3. High-Risk AI Systems – the risk management system, accuracy, robustness and cybersecurity requirements, and record-keeping obligations
- 4. Prohibited AI Practices – the assessment against Article 5, which has applied since February 2025
- 5. Transparency and Disclosure – the Article 50 obligations for systems interacting with people, and for synthetic content
- 6. General-Purpose AI Models – the GPAI obligations that have applied since August 2025, including documentation and copyright policy
- 7. Conformity Assessment – the route to declaration of conformity and CE marking for high-risk systems
- 8. Post-Market Monitoring – the monitoring plan and the serious incident reporting process
- 9. Data Governance – training, validation and testing data requirements, including bias examination
- 10. Human Oversight – the oversight measures and the competence of the people exercising them
- 11. Technical Documentation – the Annex IV file itself, which is the deliverable a notified body or authority requests
- 12. Training and Awareness – the AI literacy obligation, which has applied since February 2025 and is widely overlooked
- 13. Audit and Compliance – internal audit and the compliance monitoring set
- 14. Toolkit Resources – guidance and the implementation support material
The deadlines moved, but not the ones most people assume
Regulation (EU) 2024/1689 phases in. Prohibited practices and the AI literacy obligation have applied since 2 February 2025. Obligations for general-purpose AI models have applied since 2 August 2025. Those dates are live now.
The Digital Omnibus, provisionally agreed in May 2026, postpones the high-risk deadlines: Annex III high-risk systems move from 2 August 2026 to 2 December 2027, and Annex I from 2 August 2027 to 2 August 2028. That change is pending publication in the Official Journal, so treat it as the expected position rather than as settled law and confirm before relying on it.
Article 50 transparency obligations remain at 2 August 2026, with a grace period for watermarking to 2 December 2026. The practical read: your AI literacy programme and prohibited-practice assessment are overdue rather than upcoming, while the Annex IV documentation for high-risk systems has more runway than originally planned.
Who needs Annex IV documentation
Providers placing AI systems on the EU market, who carry the heaviest obligations including conformity assessment. Deployers using high-risk systems, who have their own duties around human oversight, monitoring and logging. Importers and distributors, who must verify conformity before placing systems on the market. And any organisation with EU staff or users, because the AI literacy obligation applies broadly regardless of risk tier.
How the Annex IV documentation maps to the framework
The Act allocates duties by role – provider, deployer, importer, distributor – and the same organisation is often more than one. Getting that determination wrong means documenting the wrong obligations entirely, which is why role determination sits in section 1 rather than being assumed. Risk classification in section 2 then drives how much of the rest applies.
Frequently asked questions
Have the high-risk deadlines really been pushed back?
The Digital Omnibus provisionally agreed in May 2026 moves Annex III high-risk to 2 December 2027 and Annex I to 2 August 2028. It is pending publication in the Official Journal – confirm the final text before planning around it.
What applies right now?
Prohibited practices and AI literacy since February 2025, and GPAI model obligations since August 2025. Article 50 transparency follows on 2 August 2026.
What is the AI literacy obligation?
Providers and deployers must ensure staff dealing with AI systems have a sufficient level of AI literacy. It has applied since February 2025, carries no risk-tier threshold, and is the obligation most organisations have not documented.
How does this relate to ISO 42001?
The Act is law; ISO 42001 is a certifiable management system. Many organisations run the AIMS as the operating framework and use it to generate AI Act evidence. See the ISO 42001 Toolkit.
How many documents are included?
60 editable Word documents across the fourteen sections, plus a licence file.
Related toolkits
AI obligations stack. See the ISO 42001 Toolkit for the certifiable management system, the NIST AI RMF Toolkit for the US framework, the GDPR Toolkit for the personal data in your training sets and the Data Governance Toolkit for data lineage.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your Annex IV documentation downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the Annex IV documentation are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.