EU AI Act Technical Documentation Services
EU AI Act Technical Files, Drafted per System
EU AI Act compliance documentation is a file, not an opinion. Eicra Soft Limited is a Dhaka-based company that drafts that file from your design and test records, one AI system at a time, at a fixed price per file. It covers the Annex IV technical file, risk management, data governance, instructions for use and the post-market plan. Your counsel classifies; your owner approves.
You can stop after every step; none obliges you to buy the next. We start with the one AI system your counsel has placed, or may place, in scope: the hiring screen, the credit model, the safety component, the chatbot that needs a notice. Its role and category as counsel states them are recorded, existing records are collected, the missing Annex IV sections are listed, and the file is priced from your own figures.
You get a written verdict — a scope record first, one system’s technical file, deployer records instead of a provider file, transparency notices only, or a governance inventory before any law-specific work. If nothing is in scope, you stop here and keep the gap review.
30 minutes 01 Scope · free call
2 weeks 02 Diagnose · $1,500 scope review, half credited
4 weeks 03 Pilot · $4,000, one Annex IV file
Per system 04 Production · from $6,000 per file
Quarterly 05 Managed Ops · quarterly file review
What does EU AI Act documentation include?
EU AI Act compliance documentation covers six records drafted from your own design, data and test records: a scope and applicability record, the Annex IV technical file, the risk management description, the data governance record, instructions for use and transparency notices, and a post-market plan with a change log. Each card below is one deliverable.
The scope record also settles reach. Under Article 2, the Act covers providers that place AI systems on the EU market, wherever they are established. It also covers providers and deployers outside the EU when their system’s output is used in the EU. On the Article 50 notices, the European Commission’s Article 50 guidance adds: “Published text that has undergone human review or editorial control – does not need to be labelled.”
Scope and applicability record
Your role as provider or deployer and the risk category are recorded exactly as your counsel states them. The articles that follow, and the records each asks for, are written down before drafting. Nothing else is drafted until this record exists, because every later document depends on it.
Annex IV technical file
The nine Annex IV sections are drafted from your design, development, test and monitoring records. They run from the general description to metrics, risk management, changes and the post-market plan. Missing evidence is requested by section, and your owner signs the file at the end.
Risk management description
The Article 9 risk management system is written as a document. It covers known and foreseeable risks, the measures taken, residual risk, testing against the measures and the review cycle. It is drafted from the testing you already run, so it describes your system, not a template.
Data governance record
The Article 10 record covers training, validation and testing data: origin, collection, annotation, labelling and enrichment, assumptions, gaps and bias examination. Each dataset gets an owner. Where a vendor model or scraped data is involved, its origin is recorded too.
Instructions and transparency notices
Article 13 instructions for deployers are drafted in plain language. So are the Article 50 notices users must see when they talk to a machine or view synthetic content. The user-facing disclosures and the marking of generated content are drafted and placed.
Post-market plan and file upkeep
The Article 72 post-market monitoring plan comes with a change log that keeps Annex IV section six true as the system evolves. A handover session follows, then optional quarterly reviews. Under Managed Ops, the change log is reconciled each quarter with what actually shipped.
Not included: Legal advice or deciding your role or risk category · conformity assessment, notified-body work or any declaration · general AI governance packs, which sit on their own page.
Which EU AI Act record comes first?
EU AI Act compliance documentation for a high-risk provider rests on four records; the scope review says which you lack first. The Annex IV technical file is the spine; the Article 9 risk description and the Article 10 data record feed it; the Article 72 post-market plan keeps it true after release. All four sit inside our AI services.
Article 11 of the EU AI Act requires that “the technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date”. The Act’s other requirements follow risk. Article 5 bans a short list of AI practices outright. High-risk systems must meet Articles 9 to 15: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy, robustness and cybersecurity. Chatbots and generated content need Article 50 notices, and general-purpose AI models carry their own duties under Article 53. To comply, list your AI systems, have counsel fix each one’s role and risk category, then draft and keep up the records those articles require.
The technical file
The nine Annex IV sections in one document, when your counsel has placed a system in Annex III and no file exists yet. It is the spine of the file set, and the risk description and data record both feed into it.
The risk description
The Article 9 risk management system written out with measures and residual risk, when testing exists, but nobody has described it. It covers known and foreseeable risks, the measures taken, residual risk, testing against those measures and the review cycle.
The data record
The Article 10 account of training, validation and test data, when a vendor model or scraped data leaves the origin of the data unanswered. It records origin, collection, labelling, gaps and bias examination, and it gives every dataset a named owner.
The post-market plan
The Article 72 plan and change log, when the system is already live and the file must stay true as it changes. It keeps Annex IV section six current, and under Managed Ops the change log is reconciled with what shipped each quarter.
When do EU AI Act obligations apply?
EU AI Act obligations apply on different dates, and the high-risk dates moved in 2026. Regulation (EU) 2026/1744 deferred stand-alone Annex III systems to 2 December 2027 and product-embedded Annex I systems to 2 August 2028. The Article 5 prohibitions, the general-purpose model duties and the Article 50 transparency obligations were not deferred.
| Obligation | Applies from | Status |
|---|---|---|
| Article 5 prohibited practices | 2 February 2025 | In force |
| General-purpose AI model duties, Article 53 | 2 August 2025 | In force |
| Article 50 transparency notices | 2 August 2026 | In force |
| Article 50(2) marking of synthetic content | 2 December 2026 | Deferred from 2 August 2026 |
| Annex III stand-alone high-risk systems | 2 December 2027 | Deferred from 2 August 2026 |
| Annex I product-embedded high-risk systems | 2 August 2028 | Deferred from 2 August 2027 |
What the deferral changes for your file: an Annex III technical file is no longer due in 2026, but the Article 50 notices are already in force and the marking of synthetic content follows in December 2026. The amending act is Regulation (EU) 2026/1744. Dates on this page were checked on 4 October 2026.
How long does EU AI Act documentation take?
EU AI Act compliance documentation for one AI system takes four weeks in the pilot, after a two-week scope review. The example is a curriculum vitae (CV) screening tool whose provider role and Annex III category counsel had stated; each item traces to an Annex IV section and an approver.
| Step | Time | Price | What you receive |
|---|---|---|---|
| Scope | 30 minutes | Free | Your system, the role counsel assigns and the records that exist |
| Diagnose | 2 weeks | $1,500, half credited to the pilot | Each Annex IV section marked present, partial or missing |
| Pilot | 4 weeks | $4,000, fixed | One system’s Annex IV file, signed by your owner |
| Production | Per system | From $6,000 per file | Further files, instructions, notices, post-market plan and change log |
| Managed Ops | Quarterly | Optional | Change log reconciled and Annex IV section six updated |
Pilot log · CV-screening tool
The file at that step · its result
Scope signed
The position your counsel states, on record first.
| Scope item | Sample system |
|---|---|
| System | CV-screening tool |
| Role | Provider, as counsel states |
| Category | Annex III, as counsel states |
| Annex IV sections | 9 |
| Owner | Named |
9
Annex IV sections in scoperole and category recorded before drafting
Records collected
What your existing records already cover.
General descriptionDevelopment processMonitoring and controlPerformance metricsRisk managementLifecycle changesStandards appliedDeclaration copyPost-market plan
6 of 9
Sections draftable from existing recordsdesign documents, 3 test reports and data sheets
Gaps closed
Missing evidence requested from named owners.
Risk descriptionwritten
Data recordcompleted
Test records3 missing, requested and received
3
Missing test records receivedrisk description and data record done
Owner sign-off · a person signs
Your owner reviews every section.
General descriptionDevelopment processMonitoring and controlPerformance metricsRisk managementLifecycle changesStandards appliedDeclaration copyPost-market plan
9 of 9
Sections approved by your ownercounsel confirms the scope record · approval logged
Handed over
The file stays in your own system.
File approved→Your document system→Change log opened→Post-market plan dated
Handed overchange log opened · post-market plan dated
Open a step, or a number below, to see the file at that stage
Every quarter the change log is reconciled with what shipped, and Annex IV section six is updated.
Illustrative example. Yellow is where your owner signs; your counsel classifies the system, and we draft to that position.
How is EU AI Act documentation written?
EU AI Act technical documentation gets written in five steps, each an exit, because documentation fails when it starts from a template and ends in a legal opinion: a free scoping call, a two-week scope and gap review, a four-week pilot drafting one system’s file, production for further systems, then quarterly Managed Ops; every stage ends in a signed document.
01 30 min · free
Scope We discuss the system, the role your counsel assigns you, the category they have stated or are still deciding, and which records exist. A diagnostic quote follows.
02 2 weeks · credited
Diagnose Role and category recorded as counsel states them; design, data, test and monitoring records collected; each Annex IV section marked present, partial or missing; the pilot priced in writing.
03 4 weeks · fixed price
Pilot One system’s Annex IV file drafted section by section from your records, the risk management description and data governance record written, missing evidence requested, and your owner signs off at the end.
04 Per system · quoted after pilot
Production The remaining systems follow the scope review’s order, each with its own file, plus instructions for use, transparency notices, the post-market plan, a change log and a handover session.
05 Quarterly · optional
Managed Ops A quarterly review: the change log reconciled with what shipped, section six updated, new guidance, standards and Commission templates reflected, with a documentation lead who knows your files.
Who drafts your EU AI Act documentation?
A documentation lead who owns the file and the section list, an engineer who reads the architecture, data and tests, and a reviewer who checks each section against Annex IV. All three work inside your document system, and your named owner approves each section before it is final.
Communication One review call a week and a shared Slack or Microsoft Teams channel
Delivery Files stay in your document system and ticketing tool
Quality assurance (QA) Every section checked by a second person, with versioning and a named approver
References The EU AI Act as amended, which every section follows
Boundary Your counsel classifies; we draft to that position
Ownership Every file, record and template in your name
Which EU AI Act starting point fits you?
The first piece of EU AI Act documentation you need depends on your situation; five questions show which fits. Role and category unstated means a scope record first; a provider of an Annex III system, one system’s technical file; a deployer, deployer records; a chatbot or synthetic content, transparency notices; no list of AI systems, AI governance documentation first.
1. Has your counsel stated your role?
2. Has your counsel stated the risk category?
3. Is there a list of your AI systems?
4. Which records exist for the system?
5. Does the system talk to people or generate content?
Answer five questions to find your file
A scope and applicability record first
Nothing in this law can be drafted before the role and the category are on record: your counsel’s position is written down with the articles that follow from it, existing records are collected, and each required document is marked present, partial or missing.
A first estimate; the scope review confirms it.
How the verdict is decided
No list of systems → the governance inventory first
Role or category not stated → a scope record first
Deployer → deployer records
Provider of a high-risk system → the technical file
A chatbot or synthetic content only → transparency notices
Why choose us for EU AI Act documentation?
An EU AI Act documentation company is judged on whether its file survives a market-surveillance request, not on the articles it quotes. We draft to Article 11 and Annex IV of the EU AI Act from your design, data and test records, put your counsel’s classification on page one, and keep the file true with a change log.
Without a drafted file
Without a drafted file, a vendor’s marketing sets the risk category, the supplier keeps the technical details, and the compliance PDF names articles without attaching records. When a market-surveillance authority asks for the file, nothing in it traces back to the system you actually run.
!!!!!
- A compliance PDF that names articles but attaches no records
- A risk category chosen by a vendor’s marketing, not by your counsel
- Technical details held by a supplier who will not share them
- A file frozen on the day it was written while the system keeps changing
With Eicra Soft Limited
After the pilot, every Annex IV section is drafted from your own design, data and test records. Your counsel’s classification sits on page one, gaps are listed with the owner who can close them, and a change log keeps the file true. The illustrative report shows one CV-screening tool.
Pilot report · CV-screening tool
Annex IV sections9 of 9Source records used17Gaps closed3Approvals recorded2VerdictFile accepted
Illustrative example
- Every Annex IV section drafted from your real design, data and test records
- Your counsel’s classification recorded on page one; ours never substituted
- Gaps listed by section with the named owner who can close them
- A change log and review date that keep the file true after handover
Is outsourcing EU AI Act documentation safe?
Outsourcing EU AI Act compliance documentation is safe when classification stays with your counsel and access stays read-only, because the risk is who decides scope and who sees design and data records. As a Bangladesh-based company, we draft inside your document system under a non-disclosure agreement, read records only and leave legal advice to counsel.
Which agreements are signed, and when?
Every agreement below is signed before any design document, dataset description or test report reaches us. That covers a mutual NDA, a data processing agreement where personal data appears, and the transfer terms your jurisdiction prescribes. We never assert that your system conforms.
Non-disclosure agreement (NDA) — mutual, and signed before any design document, dataset description, test report or draft changes hands.
Data processing agreement (DPA) — for personal data in data records or examples, the processor terms are those of Article 28(3) of the General Data Protection Regulation (GDPR) or its national equivalent.
International data transfers — standard contractual clauses, or the instrument your jurisdiction prescribes, are signed before any personal data travels.
Access — we read design, data and test records and your document system, nothing more: no production systems, no live data, no credentials held by us.
Certifications — a certification is named only when held; none is claimed here, and we never assert that your system conforms.
Which ownership and rework terms apply?
You own every file from the first draft, and we store none of them. A section becomes final only when your named owner approves that version, and the scope record carries your counsel’s confirmation. Rework is free within thirty days of handover.
Your accounts Files, records and templates live in your document system from the first draft; we store none of them.
Document ownership The contract assigns you all intellectual property (IP) in the files, so counsel, an assessor or another provider can have them at any time.
Boundary We draft technical documentation; we do not give legal advice, decide your role or risk category, perform conformity assessments or issue any declaration.
Approval A section is final only once your named owner approves that version, and the scope record carries your counsel’s confirmation.
Rework Sections that fail their agreed acceptance list within thirty days of handover are reworked free; new systems, roles or changes in the law are quoted first.
What EU AI Act proof comes before payment?
Before you pay for EU AI Act documentation, you get evidence, not promises: a two-week scope and gap review with your own section-by-section gap list, a pilot file your owner signs before production is quoted, and a free 30-minute call. Client results appear once clients agree to be named.
2 weeks
For the scope and gap review, with each Annex IV section marked present, partial or missing.
4 weeks
To one AI system’s Annex IV technical file, drafted from your records and signed by your owner.
30 days
After handover, a section that misses its agreed acceptance list is redrafted free.
Case studies: files for named clients are shown here only with their consent. For references in your sector, ask on the scoping call.
What do EU AI Act documentation buyers ask?
Eighteen questions buyers ask before they commission EU AI Act documentation, each answered in its first sentence. They cover cost, what the documentation is, Article 11, Annex IV, deployer duties, the steps after you enquire, classification, ownership, data handling, location, switching providers, conformity, authorised representatives, retention, penalties, reclassification, registration and incident reporting.
What does EU AI Act documentation cost?
Our documentation is priced per file rather than per hour, and the cards at the top list every figure. A two-week scope and gap review ends in a written verdict, half credited to the pilot. One AI system’s Annex IV technical file is then drafted, reviewed and signed by your owner, and further systems are quoted after the pilot.
What is EU AI Act compliance documentation?
EU AI Act compliance documentation is the set of written records the law expects a provider or deployer to hold. For a high-risk system: the Annex IV technical file, the Article 9 risk management description, the Article 10 data governance record, Article 13 instructions for use and an Article 72 post-market plan. For other systems, the Article 50 notices.
What does AI Act Article 11 require?
Article 11 requires the provider of a high-risk AI system to draw up technical documentation before it is placed on the market or put into service, keep it up to date, and include at least the Annex IV elements, so authorities can assess compliance. Small and medium-sized enterprises, including start-ups, may provide those elements in a simplified form.
What does Annex IV documentation include?
Nine items: a general description of the system; its elements and development process; monitoring, functioning and control information; the performance metrics and their appropriateness; the risk management system; changes made through the lifecycle; the harmonised standards or other solutions applied; a copy of the EU declaration of conformity; and the post-market monitoring plan. Each is drafted from your records.
What must a deployer document?
A deployer keeps its own records, not the provider’s technical file. They show the instructions for use are followed, name the people on human oversight, keep logs under a retention policy and inform workers and affected people where required. Where Article 27 applies, a fundamental rights impact assessment is added. We draft to the deployer articles only.
What happens after I book a diagnostic?
A free 30-minute scoping call comes first, and every later step is yours to approve. No step obliges you to buy the next, and if nothing is in scope, you stop after the review and keep it. The steps run in this order.
- We discuss the system, the role your counsel assigns you and which records exist.
- A two-week scope and gap review marks each Annex IV section present, partial or missing.
- A four-week pilot drafts one system’s file, signed off by your owner.
- Further systems are quoted only after the pilot.
Do you decide our risk category?
No. Your counsel decides your role as provider or deployer and the risk category, and we record that position exactly as stated. We draft technical documentation; we do not give legal advice, perform conformity assessments or issue any declaration. The scope record carries your counsel’s confirmation.
Who owns the files you draft?
You do, from the first draft. The contract assigns you all intellectual property in the files, records and templates, and every file lives in your own document system. We store none of them, so counsel, an assessor or another provider can have them at any time.
How do you handle our data records?
We read design, data and test records and nothing more: no production systems, no live data and no credentials held by us. A mutual NDA is signed first, a data processing agreement under Article 28(3) GDPR covers personal data, and standard contractual clauses come before any transfer.
Where is your team based?
Our team is based in Dhaka, Bangladesh, and drafts for international companies. Reviewers work remotely inside your document system under a non-disclosure agreement and read records only. Personal data travels only after standard contractual clauses, or the instrument your jurisdiction prescribes, are signed.
Can we switch from our current provider?
Yes. The two-week scope review collects the records and drafts you already hold and marks each Annex IV section present, partial or missing. The pilot is then priced from that gap list. Because every file stays in your own document system, nothing has to be handed back by a provider.
Do you certify that our system conforms?
No. We draft technical documentation only; we perform no conformity assessment, do no notified-body work and issue no declaration of conformity. A certification is named only when held, none is claimed here, and we never assert that your system conforms. That decision stays with you and your counsel.
Do we need an EU authorised representative?
Yes, if you are established outside the EU and place a high-risk AI system on the Union market. Article 22 requires a written mandate appointing an authorised representative established in the Union, who keeps a copy of the technical documentation at the disposal of the authorities. We draft the file; appointing the representative stays with you and your counsel.
How long must the file be kept?
Ten years. Article 18 requires the provider to keep the technical documentation at the disposal of the national competent authorities for ten years after the system is placed on the market or put into service. That is why the file carries a change log rather than a single dated draft, and why the audit trail and evidence records have to stay current alongside it.
What are the penalties for non-compliance?
Article 99 sets three tiers. Breaching the Article 5 prohibitions carries up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Other breaches, including the provider obligations that cover technical documentation and the Article 50 transparency duties, carry up to EUR 15 million or 3%. Supplying incorrect or misleading information to authorities carries up to EUR 7.5 million or 1%. For small and medium-sized enterprises and start-ups, the lower of the two figures applies.
Can a deployer become a provider?
Yes. Under Article 25 you take on the provider obligations if you put your own name or trade mark on a high-risk system already on the market, make a substantial modification to it, or change its intended purpose so that it becomes high-risk. If that happens, the Annex IV file becomes yours to draw up, and the system needs fresh testing evidence behind it.
Does our system need EU registration?
If it is a high-risk system listed in Annex III, yes. Article 49 requires the provider to register itself and the system in the EU database before the system is placed on the market or put into service, and public-authority deployers register themselves as well. Registration is a separate step from the technical file, and the file supplies much of what it asks for.
Who reports a serious AI incident?
The provider does. Article 73 requires the provider of a high-risk AI system to report a serious incident to the market surveillance authority of the Member State where it occurred, within the deadlines that article sets, and deployers inform the provider. What makes that possible is a record written as the incident happens, which is why error and incident documentation sits alongside the Annex IV file.
Start with a free 30-minute scoping call or the two-week scope review.