Documentation Obligation
The duty the EU AI Act places on a high-risk AI system to be documented and to have a risk management process. It attaches to the system and its risk, whichever supplier or platform runs it.
What it means in practice
The HR training article says a system in the high-risk category under the EU AI Act carries a documentation and risk-management obligation whichever platform runs it. The EU AI Act and GDPR review lists meeting documentation rules for high-risk use among a business’s key duties, alongside classifying each use, overseeing it and keeping staff AI literate. For a deployer, the ownership article adds keeping the system’s logs for at least six months.
How we use it
The site’s pages do not set out the full contents of the documentation, so treat this page as a pointer, not legal advice. The governance article says the only way to know whether a use case is high-risk is to classify each one, rather than assume small size is an exemption. The review suggests one short record per AI use either way.
FAQ
Questions about Documentation Obligation
Does a Small Business have to meet the documentation obligation?
The governance article says the EU AI Act applies by what the AI is used for, not by headcount or turnover, so a small business with a high-risk use carries the same core obligations as a large one. It reports that qualifying small mid-cap companies were given a simplified documentation route, which eases the paperwork but does not remove the obligation. This page is not legal advice, so confirm your own position with an adviser.
What record should a Business keep for each AI use?
The EU AI Act and GDPR review suggests a short written record per AI use: what the tool does, what data goes in, which account type is used, who reviews the output and what the risk tier is. It says a record like this answers most of the questions a customer or regulator would ask.
What it means for a Business
The site's governance article says the cost of building and certifying a high-risk system sits with the vendor that develops it, not with most businesses that only deploy it. A business that deploys one still has duties of its own, including keeping the system's logs for at least six months, according to the ownership article.
Ready to Put This to Work?
Tell us where your team is with AI and we will tell you honestly what would make the biggest difference.