AI System Technical Documentation
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The AI System Technical Documentation is a free DOCX and XLSX kit for EU AI Act and ISO/IEC 42001. The technical file a high-risk system needs: one section per element the recorded documentation duties name, with placeholders, plus a document register. Version v4, built 12 November 2026, cites 22 recorded duties from 4 instruments, each linked to its official source.
- Format
- DOCX and XLSX · Kit
- Version
- v4, built 12 Nov 2026
- Duties cited
- 12 from 4 instruments
- Rows from the records
- 12
- Frameworks
- EU AI Act, ISO/IEC 42001
- Written for
- Provider / developer, Deployer / user organisation, General-purpose AI model provider
- Price and licence
- Free · CC BY 4.0
What's inside
- Document: general description, development process, data, monitoring, risk management, changes, standards, with placeholders
- Register sheet: documents, versions, owners, last review
- Duties sheet: every recorded documentation and record-keeping duty
Preview
The sheets and sections of version v4, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Document register
| Doc ID | Document | Section of the technical file ▾ | Version | Owner | Last review | Next review ƒ | Location / link |
|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||
Sheet: Documentation duties
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Submit risk assessment information to the California Privacy Protection Agency each year | Record keeping and logging | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7157 | 2028-04-01 | For risk assessments conducted in 2026 and 2027, the business submits information to the Agency by 1 April 2028, and for later years by 1 April of the following | The register of risk assessments by year and processing activity; Each year's submission and its confirmation | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission | ||
| Keep records of consequential decisions influenced by the technology for three years | Record keeping and logging | Colorado ADMT law (SB 26-189) | Colorado (United States) | Deployer / user organisation | Legal requirement | 2027-01-01 | Deployers must retain records showing how automated decision-making technology was used in consequential decisions, for three years, according to secondary repo | Pending review · source-linked | https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping | ||||
| Developers must supply deployers with documentation of the technology | Technical documentation | Colorado ADMT law (SB 26-189) | Colorado (United States) | Provider / developer | Legal requirement | 2027-01-01 | Developers of automated decision-making technology must provide deployers with the documentation the statute lists, so that deployers can meet their notice, dis | Pending review · source-linked | https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation | ||||
| Draw up technical documentation before placing a high-risk system on the market | Technical documentation | EU AI Act | European Union | Provider / developer | Legal requirement | Article 11 and Annex IV | 2027-12-02 | Technical documentation must be drawn up before a high-risk system is placed on the market or put into service and kept up to date. It must demonstrate complian | Annex IV technical file | Clause 7.5 Documented information; Annex A control on system documentation | GOVERN 1.4, MAP 3.x | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation |
| Design high-risk systems to log events automatically | Record keeping and logging | EU AI Act | European Union | Provider / developer, Deployer / user organisation | Legal requirement | Article 12; Article 26(6) for deployers | 2027-12-02 | High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operati | Logging specification and retention policy | Annex A control on event logging | MEASURE 2.x, MANAGE 4.1 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-record-keeping |
| Achieve appropriate accuracy, robustness and cybersecurity | Accuracy, robustness and cybersecurity | EU AI Act | European Union | Provider / developer | Legal requirement | Article 15 | 2027-12-02 | High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy l | Accuracy metrics and test evidence; AI security assessment | Annex A controls on AI system verification and validation | MEASURE 2.5, 2.6, 2.7 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity |
Document outline (DOCX)
- Purpose of the technical file
- General description
- Development process
- Data and data governance
- Monitoring and control
- Risk management
- Changes over the lifecycle
- Standards applied
- Post-market monitoring
- Duties this file serves
- Submit risk assessment information to the California Privacy Protection Agency each year
- Keep records of consequential decisions influenced by the technology for three years
- Developers must supply deployers with documentation of the technology
- Draw up technical documentation before placing a high-risk system on the market
- Design high-risk systems to log events automatically
- Achieve appropriate accuracy, robustness and cybersecurity
- Providers must keep high-risk AI documentation for ten years
- Providers must retain automatically generated logs under their control
- Providers must document and register a conclusion that an Annex III system is not high-risk
- Providers of GPAI models must maintain technical documentation and inform downstream providers
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The DOCX and XLSX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v4), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Fill in your rows. Complete the "Document register" sheet for your own systems. Dropdowns, formulas and colour rules are already set.
- 4Check the duties against your situation. The "Documentation duties" sheet lists the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 5Complete the document. Work through the DOCX sections (Purpose of the technical file, General description, Development process, Data and data governance) and replace each placeholder with your organisation's answer.
- 6Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (12)
Each is cited in the file with its source reference and a link back to the record.
- Submit risk assessment information to the California Privacy Protection Agency each year
- Keep records of consequential decisions influenced by the technology for three years
- Developers must supply deployers with documentation of the technology
- Draw up technical documentation before placing a high-risk system on the market
- Design high-risk systems to log events automatically
- Achieve appropriate accuracy, robustness and cybersecurity
- Providers must keep high-risk AI documentation for ten years
- Providers must retain automatically generated logs under their control
- Providers must document and register a conclusion that an Annex III system is not high-risk
- Providers of GPAI models must maintain technical documentation and inform downstream providers
- Providers of systemic-risk GPAI models must secure the model and its infrastructure
- Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v4 | ef1018b7a6a2 | Dataset 52bd836b1d6b → ef1018b7a6a2. Sheet "Documentation duties": 11 → 12 rows (+1). Record citations: 21 → 22. | |
| v3 | 52bd836b1d6b | Dataset 3335c39da4b7 → 52bd836b1d6b. | |
| v2 | 3335c39da4b7 | Dataset 914895c3103e → 3335c39da4b7. Sheet "Documentation duties": 10 → 11 rows (+1). Document: 87 → 85 blocks. Record citations: 20 → 21. | |
| v1 | 914895c3103e | First version, built from dataset 914895c3103e. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the AI System Technical Documentation?
Document: general description, development process, data, monitoring, risk management, changes, standards, with placeholders. Register sheet: documents, versions, owners, last review. Duties sheet: every recorded documentation and record-keeping duty.
Which duties does it cite?
12 recorded duties from California CPPA automated decision-making rules, Colorado ADMT law (SB 26-189), EU AI Act and NYC Local Law 144 (automated employment decision tools), including Cal. Code Regs. tit. 11, § 7157, Article 11 and Annex IV, Article 12; Article 26(6) for deployers, Article 15, Article 18 and Article 19. Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on provider / developer, deployer / user organisation and general-purpose ai model provider. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the DOCX and XLSX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v4 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.