SkarpChapter 13 of 25
High-Risk System Evidence and Provider Controls
Compliance must be built into the system and preserved as evidence. Articles 11–21 connect documentation, automatic logs, instructions, oversight and resilience with the provider’s quality system, retention, corrective action and regulatory cooperation.
Article 11: Technical Documentation Before Market Access
Build evidence before launch
Article 11 requires this exact timing: "The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date."
What the documentation must prove
It must demonstrate compliance with this Section and provide authorities and notified bodies clear, comprehensive information for compliance assessment. At minimum, it contains the Annex IV elements.
One file and simplified routes
SMEs may use the Commission's simplified Annex IV form, which notified bodies shall accept. Article 11(2) requires one combined file for relevant Annex I Section A product systems.
Article 12: Logs as Traceability Evidence
Automatic logging is mandatory
Article 12 requires: "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." Logging must be a technical capability, not an improvised manual practice.
Why record events?
Logs must support traceability: identifying possible Article 79(1) risks or substantial modifications, facilitating Article 72 post-market monitoring, and monitoring Article 26(5) systems.
Special minimum for Annex III 1(a)
For those systems, record each use period, the checked reference database, matched input data, and the identities of natural persons who verified results under Article 14(5).
Article 13: Transparency Means Usable Information
Transparency has an operational goal
Article 13 requires systems to be designed and developed so "their operation is sufficiently transparent to enable deployers to interpret a system’s output and use it appropriately".
Instructions must be usable
Instructions must be provided in an appropriate digital format or otherwise, and must be concise, complete, correct, clear, relevant, accessible, and comprehensible to deployers.
Minimum instruction content
Cover intended purpose; tested performance and limitations; foreseeable risks; interpretation tools; data specifications where appropriate; human oversight; maintenance; lifetime; and relevant log-handling mechanisms.
Article 14: Designing Human Oversight That Works
Oversight must be effective
Article 14 requires systems, including through appropriate interfaces, to be designed so "they can be effectively overseen by natural persons during the period in which they are in use".
What an overseer must be enabled to do
Understand limits, monitor anomalies, resist automation bias, interpret outputs, decline or override outputs, and intervene or stop the system safely. Measures must fit risk, autonomy, and context.
Identification systems: added safeguard
For Annex III point 1(a), identification normally needs separate verification and confirmation by at least two competent, trained, and authorised natural persons before a deployer acts.
Article 15: Performance Throughout the Lifecycle
No one-time compliance snapshot
Article 15 requires that systems "achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle".
Robustness and learning systems
Use technical and organisational measures against errors and inconsistencies. Backup or fail-safe plans may support robustness. Continuing-learning systems must reduce and mitigate biased feedback loops.
AI-specific cybersecurity
Security measures must fit the risks and may address data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks, and model flaws.
Knowledge Check: Documentation, Logs, and Oversight
Choose the statement that most accurately reflects Articles 11, 12, and 14.
Which statement is correct?
- Technical documentation may be created after market placement if the provider can reconstruct it from logs.
- Logs only need to be technically possible during an investigation, rather than over the system's lifetime.
- Human oversight must enable assigned natural persons, as appropriate and proportionate, to override or reverse output and to intervene or interrupt the system safely.
- All high-risk AI systems require exactly two natural persons to confirm every output.
Show Answer
Answer: C) Human oversight must enable assigned natural persons, as appropriate and proportionate, to override or reverse output and to intervene or interrupt the system safely.
Article 14(4) requires that assigned overseers be enabled, as appropriate and proportionate, to disregard, override, or reverse output and to intervene or interrupt the system through a stop button or similar safe procedure. Article 11 requires documentation before placement or service entry, Article 12 requires lifetime logging capability, and the two-person rule is specifically for Annex III point 1(a) identifications, subject to the stated exception.
Article 16: The Provider as Compliance Owner
The primary provider duty
Article 16(a) requires providers to "ensure that their high-risk AI systems are compliant with the requirements set out in Section 2". This connects Articles 11-15 to provider accountability.
Pre-market and evidence responsibilities
Providers shall operate an Article 17 quality system, keep Article 18 documentation and controlled logs, complete the relevant conformity assessment, make a declaration, affix CE marking, and register where required.
The provider remains answerable
Article 16 also requires corrective action, information provision, cooperation on reasoned authority requests, and compliance with the named accessibility requirements.
Article 17: Quality Management as the Control System
Written, systematic, and orderly
"Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation." The system must be documented through written policies, procedures, and instructions.
What it must cover
At minimum: compliance and modification strategy; design and development controls; testing; technical specifications; data management; risk management; post-market monitoring; incident reporting; communications; records; resources; accountability.
Proportionate does not mean optional
Implementation is proportionate to provider size, but required rigour and protection remain. Financial-institution treatment does not deem Article 17(1)(g), (h), or (i) fulfilled.
Articles 18 and 19: Keep the File, Keep the Logs
Documentation: ten years
Article 18 requires specified materials to remain available to national competent authorities "for a period ending 10 years after the high-risk AI system has been placed on the market or put into service".
What is in the retained file?
Keep Article 11 technical documentation, Article 17 quality-system documentation, relevant notified-body change records and decisions, and the Article 47 EU declaration of conformity.
Logs: at least six months
For controlled automatic logs, "the logs shall be kept for a period appropriate to the intended purpose of the high-risk AI system, of at least six months", subject to applicable law.
Evidence Triage Activity: What Happens After a Defect?
Apply Articles 20 and 21
Imagine that a provider learns from a deployer that its high-risk AI system has produced outputs inconsistent with its validated performance and may create a risk within Article 79(1).
Put the response in order
- Assess conformity immediately. Article 20(1) applies when the provider considers, or has reason to consider, that a system it placed on the market or put into service is not in conformity.
- Take an appropriate correction without delay. The source says the provider "shall immediately take the necessary corrective actions to bring that system into conformity, to withdraw it, to disable it, or to recall it, as appropriate".
- Inform affected supply-chain and use-side parties. Inform distributors and, where applicable, deployers, the authorised representative, and importers.
- If there is an Article 79(1) risk, investigate immediately. Collaborate with the reporting deployer where applicable.
- Notify the relevant authorities. Inform competent market-surveillance authorities and, where applicable, the notified body that issued the Article 44 certificate. Provide the nature of the non-compliance and relevant corrective action.
- Cooperate with a reasoned request. Under Article 21, provide necessary information and documentation demonstrating Section 2 conformity in a language the authority can easily understand, chosen from an official language of the Union as indicated by the relevant Member State. Give access, where applicable, to controlled automatically generated logs.
Reflection prompt
A team proposes: "We will quietly deploy a software patch first, then decide whether to tell anyone." Identify the problem. Article 20 does not make notice conditional on completing a patch. It requires immediate appropriate corrective action and specified information duties. Where the system presents an Article 79(1) risk, it also requires immediate investigation and notification.
Article 21(3) adds that information obtained by a competent authority under that Article shall be treated according to Article 78 confidentiality obligations.
Flashcards: High-Risk Evidence and Controls
Flip each card, then explain the rule aloud in your own words without weakening a mandatory "shall" requirement.
- Article 11 timing rule
- "The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date."
- Article 12 core obligation
- The system shall technically allow automatic recording of events, or logs, over its lifetime.
- Article 13 transparency outcome
- Deployers must be able to interpret the output and use the system appropriately.
- Article 14 automation bias
- The possible tendency to automatically rely or over-rely on AI output, especially where it supplies information or recommendations for human decisions.
- Article 15 lifecycle requirement
- Appropriate accuracy, robustness, and cybersecurity must be achieved and performed consistently throughout the lifecycle.
- Article 18 retention period
- Specified documentation must be available to national competent authorities for a period ending 10 years after market placement or putting into service.
- Article 19 log minimum
- Controlled logs must be retained for a period appropriate to the intended purpose, of at least six months, unless applicable law provides otherwise.
- Article 20 response
- Immediately take necessary corrective action to bring into conformity, withdraw, disable, or recall, as appropriate; then meet the information duties.
Final Check: Provider Controls and Retention
Select the best answer based strictly on Articles 16 to 21.
A provider retains technical documentation for six months, retains controlled logs for ten years, and refuses an authority's reasoned request unless the authority uses the provider's preferred language. Which assessment is most accurate?
- The provider complies because a longer log-retention period cures the short documentation period.
- The provider does not comply: Article 18 requires specified documentation to be available for a period ending 10 years after placement or service entry, and Article 21 requires required information and documentation in the relevant easily understood official Union language.
- The provider complies if it is an SME, because SMEs are exempt from Article 18 and Article 21.
- The provider only has to cooperate after a serious incident has been confirmed by a notified body.
Show Answer
Answer: B) The provider does not comply: Article 18 requires specified documentation to be available for a period ending 10 years after placement or service entry, and Article 21 requires required information and documentation in the relevant easily understood official Union language.
Article 18 sets the ten-year documentation availability period. Article 19 sets a separate minimum rule for controlled logs: a purpose-appropriate period of at least six months, subject to applicable law. Article 21 requires cooperation upon a reasoned request and specifies the language condition. SME simplification in Article 11 does not create the stated exemptions.
Key Terms
- deployer
- The party for whom Article 13 requires usable instructions and whom Article 14 treats as potentially implementing provider-identified human-oversight measures.
- provider
- The party to which Article 16 assigns the listed duties, including ensuring Section 2 compliance, maintaining a quality management system, retaining specified evidence, and taking corrective action.
- traceability
- The ability of logging capabilities to record events relevant to risk or substantial modification, post-market monitoring, and specified operational monitoring.
- automatic logs
- Automatically recorded events that high-risk AI systems must technically allow over their lifetime under Article 12.
- automation bias
- The possible tendency to automatically rely or over-rely on output from a high-risk AI system.
- corrective action
- An immediate appropriate action under Article 20 to bring a non-conforming system into conformity, withdraw it, disable it, or recall it.
- high-risk AI system
- The category of AI system addressed by Articles 11 to 21 in the supplied text, subject to the listed technical, documentation, provider, and cooperation obligations.
- conformity assessment
- The relevant procedure Article 16 requires before a high-risk AI system is placed on the market or put into service, as referred to in Article 43.
- technical documentation
- The Article 11 evidence package demonstrating Section 2 compliance and enabling authorities and notified bodies to assess it; it contains at least Annex IV elements.
- quality management system
- The documented, systematic, and orderly written policies, procedures, and instructions required by Article 17 to ensure compliance.