Compliance documentation checklist

• Risk classification recordArt. 6The intended purpose and the classification decision (high-risk or carve-out) with reasoning.
• Risk management system fileArt. 9Hazards, risk estimation, mitigation hierarchy, testing, and residual-risk acceptance.
• Data governance & bias recordsArt. 10Data sheets, representativeness analysis, and bias detection/correction documentation.
• Technical documentation (Annex IV)Art. 11System description, architecture, design specs, performance and testing results.
• Automatic logging & retentionArt. 12Logging schema for usage, inputs, outputs, human review — retained at least 6 months.
• Instructions for useArt. 13Capabilities, limitations, performance metrics, oversight measures, foreseeable misuse.
• Human oversight planArt. 14Who oversees, training records, override capability, and automation-bias safeguards.
• Accuracy & robustness evidenceArt. 15Declared metrics, subgroup accuracy, adversarial testing, and cybersecurity measures.
• FRIA (where applicable)Art. 27Fundamental rights impact assessment filed before deployment by in-scope deployers.
• Conformity assessment & EU declarationArt. 43Self-assessment or notified-body assessment plus the EU declaration of conformity.

Guidance for high-risk systems. Not legal advice — the article links take you to the full explainers.