# EU AI Act Annex IV Documentation Checklist

Part of the Ship-Safe LLM Features Kit — ventrova.dev/kit

A working checklist mapped to the EU AI Act's Annex IV technical-documentation requirements, for teams that want to start capturing this information as they ship rather than reconstruct it later under deadline. This is a practical capture checklist, not legal advice; confirm applicability and completeness with counsel for your specific system and risk classification.

## 1. General description of the system

- [ ] Intended purpose, and the provider/deployer relationship if applicable.
- [ ] How the system interacts with other software or hardware (APIs, plugins, tool calls).
- [ ] Versions of relevant software/firmware and any version-related documentation requirements.
- [ ] Description of all forms in which the system is placed on the market (SaaS, on-prem, embedded, API).
- [ ] Hardware on which the system runs or is intended to run.
- [ ] Where the system is a component, photos/illustrations of relevant external features and layout.
- [ ] User interface description provided to the deployer.
- [ ] Instructions for use provided to the deployer, or a reference to where these are located.

## 2. Detailed description of the elements of the system and its development process

- [ ] Methods and steps used for development, including third-party tools/pretrained systems or components used, and how these were used, integrated, or modified.
- [ ] System architecture explaining how software components build on or feed into each other and integrate into overall processing.
- [ ] Design specifications: general logic, key design choices including rationale and assumptions (including regarding persons/groups the system is intended to be used on), main classification choices, what the system is designed to optimize for, and relevance of different parameters.
- [ ] Description of the expected output and output quality of the system.
- [ ] Decisions about possible trade-off changes made regarding technical solutions to comply with Chapter III Section 2 requirements.
- [ ] Description of relevant changes made through the system's lifecycle.

## 3. Data provenance and management

- [ ] Description of training, validation, and testing datasets: origin, scope, characteristics, how data was obtained/selected, labelling procedures, data cleaning methods.
- [ ] Assessment of data availability, quantity, and suitability for the intended purpose.
- [ ] Examination of possible biases likely to affect health/safety or lead to discrimination, and mitigation measures.
- [ ] For an LLM feature specifically: what user-supplied, retrieved, or tool-output content is stored or logged, retention period, and access controls.

## 4. Human oversight

- [ ] Human-oversight measures built into the system (interface tools included).
- [ ] Technical measures allowing outputs to be interpreted and appropriately used by deployers.
- [ ] Specification of input data or control of operation, as relevant.

## 5. Performance metrics

- [ ] Metrics used to measure accuracy, robustness, and cybersecurity, and why they are appropriate.
- [ ] Expected/foreseeable levels of accuracy against those metrics.
- [ ] Foreseeable unintended outcomes and sources of risk to health/safety/fundamental rights/discrimination.
- [ ] Where relevant: input specifications, and any other information relevant to explain the output.

## 6. Risk management

- [ ] Description of the risk-management system per Article 9.
- [ ] Validation and testing procedures used, including test logs dated and signed, and details on metrics/thresholds.
- [ ] For LLM/prompt-injection-relevant systems specifically: what adversarial and red-team testing was performed (see this kit's `red-team-test-templates.md`), what was found, and what mitigations were applied.

## 7. Change log

- [ ] A running record of relevant changes made to the system after its initial deployment, keyed by date and description, sufficient to reconstruct the system's history for audit.

---

Cross-reference: `ship-safe-checklist.md` in this kit covers the technical shipping controls this documentation should describe; `prompt-injection-defense-guide.md` explains the reasoning behind the risk-management choices this checklist asks you to record.

© Ventrova. This is a practical documentation-capture checklist derived from Annex IV of the EU AI Act; it is not legal advice, and does not determine whether your system is in scope or how it should be classified.