EU AI Act compliance documentation is a file, not an opinion. Eicra Soft Limited is a Dhaka-based company that drafts that file from your design and test records, one AI system at a time, at a fixed price per file. It covers the Annex IV technical file, risk management, data governance, instructions for use and the post-market plan. Your counsel classifies; your owner approves.
You can stop after every step; none obliges you to buy the next. We start with the one AI system your counsel has placed, or may place, in scope: the hiring screen, the credit model, the safety component, the chatbot that needs a notice. Its role and category as counsel states them are recorded, existing records are collected, the missing Annex IV sections are listed, and the file is priced from your own figures.
You get a written verdict — a scope record first, one system’s technical file, deployer records instead of a provider file, transparency notices only, or a governance inventory before any law-specific work. If nothing is in scope, you stop here and keep the gap review.
EU AI Act compliance documentation covers six records drafted from your own design, data and test records: a scope and applicability record, the Annex IV technical file, the risk management description, the data governance record, instructions for use and transparency notices, and a post-market plan with a change log. Each card below is one deliverable.
The scope record also settles reach. Under Article 2, the Act covers providers that place AI systems on the EU market, wherever they are established. It also covers providers and deployers outside the EU when their system’s output is used in the EU. On the Article 50 notices, the European Commission’s Article 50 guidance adds: “Published text that has undergone human review or editorial control – does not need to be labelled.”
Your role as provider or deployer and the risk category are recorded exactly as your counsel states them. The articles that follow, and the records each asks for, are written down before drafting. Nothing else is drafted until this record exists, because every later document depends on it.
The nine Annex IV sections are drafted from your design, development, test and monitoring records. They run from the general description to metrics, risk management, changes and the post-market plan. Missing evidence is requested by section, and your owner signs the file at the end.
The Article 9 risk management system is written as a document. It covers known and foreseeable risks, the measures taken, residual risk, testing against the measures and the review cycle. It is drafted from the testing you already run, so it describes your system, not a template.
The Article 10 record covers training, validation and testing data: origin, collection, annotation, labelling and enrichment, assumptions, gaps and bias examination. Each dataset gets an owner. Where a vendor model or scraped data is involved, its origin is recorded too.
Article 13 instructions for deployers are drafted in plain language. So are the Article 50 notices users must see when they talk to a machine or view synthetic content. The user-facing disclosures and the marking of generated content are drafted and placed.
The Article 72 post-market monitoring plan comes with a change log that keeps Annex IV section six true as the system evolves. A handover session follows, then optional quarterly reviews. Under Managed Ops, the change log is reconciled each quarter with what actually shipped.
EU AI Act compliance documentation for a high-risk provider rests on four records; the scope review says which you lack first. The Annex IV technical file is the spine; the Article 9 risk description and the Article 10 data record feed it; the Article 72 post-market plan keeps it true after release. All four sit inside our AI services.
Article 11 of the EU AI Act requires that “the technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date”. The Act’s other requirements follow risk. Article 5 bans a short list of AI practices outright. High-risk systems must meet Articles 9 to 15: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy, robustness and cybersecurity. Chatbots and generated content need Article 50 notices, and general-purpose AI models carry their own duties under Article 53. To comply, list your AI systems, have counsel fix each one’s role and risk category, then draft and keep up the records those articles require.
The nine Annex IV sections in one document, when your counsel has placed a system in Annex III and no file exists yet. It is the spine of the file set, and the risk description and data record both feed into it.
The Article 9 risk management system written out with measures and residual risk, when testing exists, but nobody has described it. It covers known and foreseeable risks, the measures taken, residual risk, testing against those measures and the review cycle.
The Article 10 account of training, validation and test data, when a vendor model or scraped data leaves the origin of the data unanswered. It records origin, collection, labelling, gaps and bias examination, and it gives every dataset a named owner.
The Article 72 plan and change log, when the system is already live and the file must stay true as it changes. It keeps Annex IV section six current, and under Managed Ops the change log is reconciled with what shipped each quarter.
EU AI Act obligations apply on different dates, and the high-risk dates moved in 2026. Regulation (EU) 2026/1744 deferred stand-alone Annex III systems to 2 December 2027 and product-embedded Annex I systems to 2 August 2028. The Article 5 prohibitions, the general-purpose model duties and the Article 50 transparency obligations were not deferred.
| Obligation | Applies from | Status |
|---|---|---|
| Article 5 prohibited practices | 2 February 2025 | In force |
| General-purpose AI model duties, Article 53 | 2 August 2025 | In force |
| Article 50 transparency notices | 2 August 2026 | In force |
| Article 50(2) marking of synthetic content | 2 December 2026 | Deferred from 2 August 2026 |
| Annex III stand-alone high-risk systems | 2 December 2027 | Deferred from 2 August 2026 |
| Annex I product-embedded high-risk systems | 2 August 2028 | Deferred from 2 August 2027 |
EU AI Act compliance documentation for one AI system takes four weeks in the pilot, after a two-week scope review. The example is a curriculum vitae (CV) screening tool whose provider role and Annex III category counsel had stated; each item traces to an Annex IV section and an approver.
| Step | Time | Price | What you receive |
|---|---|---|---|
| Scope | 30 minutes | Free | Your system, the role counsel assigns and the records that exist |
| Diagnose | 2 weeks | $1,500, half credited to the pilot | Each Annex IV section marked present, partial or missing |
| Pilot | 4 weeks | $4,000, fixed | One system’s Annex IV file, signed by your owner |
| Production | Per system | From $6,000 per file | Further files, instructions, notices, post-market plan and change log |
| Managed Ops | Quarterly | Optional | Change log reconciled and Annex IV section six updated |
Pilot log · CV-screening tool
The file at that step · its result
Scope signed
The position your counsel states, on record first.
| Scope item | Sample system |
|---|---|
| System | CV-screening tool |
| Role | Provider, as counsel states |
| Category | Annex III, as counsel states |
| Annex IV sections | 9 |
| Owner | Named |
Records collected
What your existing records already cover.
Gaps closed
Missing evidence requested from named owners.
Owner sign-off · a person signs
Your owner reviews every section.
Handed over
The file stays in your own system.
Open a step, or a number below, to see the file at that stage
Every quarter the change log is reconciled with what shipped, and Annex IV section six is updated.
Illustrative example. Yellow is where your owner signs; your counsel classifies the system, and we draft to that position.
EU AI Act technical documentation gets written in five steps, each an exit, because documentation fails when it starts from a template and ends in a legal opinion: a free scoping call, a two-week scope and gap review, a four-week pilot drafting one system’s file, production for further systems, then quarterly Managed Ops; every stage ends in a signed document.
A documentation lead who owns the file and the section list, an engineer who reads the architecture, data and tests, and a reviewer who checks each section against Annex IV. All three work inside your document system, and your named owner approves each section before it is final.
The first piece of EU AI Act documentation you need depends on your situation; five questions show which fits. Role and category unstated means a scope record first; a provider of an Annex III system, one system’s technical file; a deployer, deployer records; a chatbot or synthetic content, transparency notices; no list of AI systems, AI governance documentation first.
1. Has your counsel stated your role?
2. Has your counsel stated the risk category?
3. Is there a list of your AI systems?
4. Which records exist for the system?
5. Does the system talk to people or generate content?
Nothing in this law can be drafted before the role and the category are on record: your counsel’s position is written down with the articles that follow from it, existing records are collected, and each required document is marked present, partial or missing.
A first estimate; the scope review confirms it.
How the verdict is decided
An EU AI Act documentation company is judged on whether its file survives a market-surveillance request, not on the articles it quotes. We draft to Article 11 and Annex IV of the EU AI Act from your design, data and test records, put your counsel’s classification on page one, and keep the file true with a change log.
Without a drafted file, a vendor’s marketing sets the risk category, the supplier keeps the technical details, and the compliance PDF names articles without attaching records. When a market-surveillance authority asks for the file, nothing in it traces back to the system you actually run.
After the pilot, every Annex IV section is drafted from your own design, data and test records. Your counsel’s classification sits on page one, gaps are listed with the owner who can close them, and a change log keeps the file true. The illustrative report shows one CV-screening tool.
Outsourcing EU AI Act compliance documentation is safe when classification stays with your counsel and access stays read-only, because the risk is who decides scope and who sees design and data records. As a Bangladesh-based company, we draft inside your document system under a non-disclosure agreement, read records only and leave legal advice to counsel.
Every agreement below is signed before any design document, dataset description or test report reaches us. That covers a mutual NDA, a data processing agreement where personal data appears, and the transfer terms your jurisdiction prescribes. We never assert that your system conforms.
You own every file from the first draft, and we store none of them. A section becomes final only when your named owner approves that version, and the scope record carries your counsel’s confirmation. Rework is free within thirty days of handover.
Before you pay for EU AI Act documentation, you get evidence, not promises: a two-week scope and gap review with your own section-by-section gap list, a pilot file your owner signs before production is quoted, and a free 30-minute call. Client results appear once clients agree to be named.
2 weeks
For the scope and gap review, with each Annex IV section marked present, partial or missing.
4 weeks
To one AI system’s Annex IV technical file, drafted from your records and signed by your owner.
30 days
After handover, a section that misses its agreed acceptance list is redrafted free.
Eighteen questions buyers ask before they commission EU AI Act documentation, each answered in its first sentence. They cover cost, what the documentation is, Article 11, Annex IV, deployer duties, the steps after you enquire, classification, ownership, data handling, location, switching providers, conformity, authorised representatives, retention, penalties, reclassification, registration and incident reporting.
More answersOur documentation is priced per file rather than per hour, and the cards at the top list every figure. A two-week scope and gap review ends in a written verdict, half credited to the pilot. One AI system’s Annex IV technical file is then drafted, reviewed and signed by your owner, and further systems are quoted after the pilot.
EU AI Act compliance documentation is the set of written records the law expects a provider or deployer to hold. For a high-risk system: the Annex IV technical file, the Article 9 risk management description, the Article 10 data governance record, Article 13 instructions for use and an Article 72 post-market plan. For other systems, the Article 50 notices.
Article 11 requires the provider of a high-risk AI system to draw up technical documentation before it is placed on the market or put into service, keep it up to date, and include at least the Annex IV elements, so authorities can assess compliance. Small and medium-sized enterprises, including start-ups, may provide those elements in a simplified form.
Nine items: a general description of the system; its elements and development process; monitoring, functioning and control information; the performance metrics and their appropriateness; the risk management system; changes made through the lifecycle; the harmonised standards or other solutions applied; a copy of the EU declaration of conformity; and the post-market monitoring plan. Each is drafted from your records.
A deployer keeps its own records, not the provider’s technical file. They show the instructions for use are followed, name the people on human oversight, keep logs under a retention policy and inform workers and affected people where required. Where Article 27 applies, a fundamental rights impact assessment is added. We draft to the deployer articles only.
A free 30-minute scoping call comes first, and every later step is yours to approve. No step obliges you to buy the next, and if nothing is in scope, you stop after the review and keep it. The steps run in this order.
No. Your counsel decides your role as provider or deployer and the risk category, and we record that position exactly as stated. We draft technical documentation; we do not give legal advice, perform conformity assessments or issue any declaration. The scope record carries your counsel’s confirmation.
You do, from the first draft. The contract assigns you all intellectual property in the files, records and templates, and every file lives in your own document system. We store none of them, so counsel, an assessor or another provider can have them at any time.
We read design, data and test records and nothing more: no production systems, no live data and no credentials held by us. A mutual NDA is signed first, a data processing agreement under Article 28(3) GDPR covers personal data, and standard contractual clauses come before any transfer.
Our team is based in Dhaka, Bangladesh, and drafts for international companies. Reviewers work remotely inside your document system under a non-disclosure agreement and read records only. Personal data travels only after standard contractual clauses, or the instrument your jurisdiction prescribes, are signed.
Yes. The two-week scope review collects the records and drafts you already hold and marks each Annex IV section present, partial or missing. The pilot is then priced from that gap list. Because every file stays in your own document system, nothing has to be handed back by a provider.
No. We draft technical documentation only; we perform no conformity assessment, do no notified-body work and issue no declaration of conformity. A certification is named only when held, none is claimed here, and we never assert that your system conforms. That decision stays with you and your counsel.
Yes, if you are established outside the EU and place a high-risk AI system on the Union market. Article 22 requires a written mandate appointing an authorised representative established in the Union, who keeps a copy of the technical documentation at the disposal of the authorities. We draft the file; appointing the representative stays with you and your counsel.
Ten years. Article 18 requires the provider to keep the technical documentation at the disposal of the national competent authorities for ten years after the system is placed on the market or put into service. That is why the file carries a change log rather than a single dated draft, and why the audit trail and evidence records have to stay current alongside it.
Article 99 sets three tiers. Breaching the Article 5 prohibitions carries up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Other breaches, including the provider obligations that cover technical documentation and the Article 50 transparency duties, carry up to EUR 15 million or 3%. Supplying incorrect or misleading information to authorities carries up to EUR 7.5 million or 1%. For small and medium-sized enterprises and start-ups, the lower of the two figures applies.
Yes. Under Article 25 you take on the provider obligations if you put your own name or trade mark on a high-risk system already on the market, make a substantial modification to it, or change its intended purpose so that it becomes high-risk. If that happens, the Annex IV file becomes yours to draw up, and the system needs fresh testing evidence behind it.
If it is a high-risk system listed in Annex III, yes. Article 49 requires the provider to register itself and the system in the EU database before the system is placed on the market or put into service, and public-authority deployers register themselves as well. Registration is a separate step from the technical file, and the file supplies much of what it asks for.
The provider does. Article 73 requires the provider of a high-risk AI system to report a serious incident to the market surveillance authority of the Member State where it occurred, within the deadlines that article sets, and deployers inform the provider. What makes that possible is a record written as the incident happens, which is why error and incident documentation sits alongside the Annex IV file.
Start with a free 30-minute scoping call or the two-week scope review.
Request A QuoteBook a DiagnosticYour request is subject to our Terms and Privacy Policy.
