GASP AICF

Search controls and profiles

Search by control ID, name, domain or profile

AIG-015 AI System Technical Documentation

Tier 2+AIProviderDeployerGPAI Model ProviderManaged Service Provider

Description

Technical documentation exists for each AI system before it is deployed and its current version corresponds to the deployed version of the system. The documentation covers the system architecture and its components, the intended purpose and the use cases in scope, performance measures and the limits of that performance, a summary of the training data, known failure modes and edge cases, the human oversight mechanisms in place, the hardware and compute the system requires and the maintenance and update schedule. The documentation is released to deployers, operators and competent authorities on request. Each release is recorded.

Rationale

Technical documentation is the artefact every AI governance audit opens with. A system that exists only in the heads of the engineers who built it cannot be assessed at all. Version correspondence fails most often: documentation written at first release and never updated describes a model that is no longer deployed. The public summary of training content that a general-purpose AI model provider publishes is a duty of that role and belongs to the GPAI provider bundle rather than here. AIG-010 holds the model registry, AIG-034 the instructions for use given to a deployer and AIG-013 the provenance record the training data summary draws on. A general-purpose model as such is documented under AIG-047; a model served inside the organisation's own product carries both controls, this one for the product and AIG-047 for the model.

Applicability (9 profiles)

SaaS AI Providerstablerequiredcore
Enterprise AI Deployerstablerequiredsatisfied by provider

The documentation is the provider's. The deployer's evidence is the released version, held against the inventory entry and matching the deployed version.

GPAI Model Providerstablerequiredcore
High-Risk Provider (EU)stablerequiredrisk class duty

Art.11(1) fixes the artefact and its moment: the technical documentation is drawn up before the system is placed on the market or put into service, kept up to date and contains at minimum the Annex IV elements, so version correspondence is a condition of lawful placing and not a documentation habit. Art.72(3) puts the post-market monitoring plan inside that Annex IV documentation, with a Commission template due by 2 September 2027 (ADR-025), so the plan AIG-018 writes is versioned and produced with this documentation. Art.18(1) sets the retention at 10 years after the system is placed on the market or put into service, covering the technical documentation, the quality management system documentation, the documents and decisions of the notified body and the EU declaration of conformity. One thing here is a relief rather than a duty and is not a row of its own: the Art.11(1) second subparagraph as amended lets an SME, a start-up or a small mid-cap give the Annex IV elements in the Commission's simplified form, requires that form to be used where the option is taken and requires notified bodies to accept it (extract row EU-AI-Art.11.2).

Public Body Deployer (EU)stablerequiredsatisfied by provider

The documentation is the provider's. The deployer's evidence is the released version, held against the inventory entry and matching the deployed version.

DORA ICT Provider (EU)stablerequiredcore
NIS2 Cloud Provider (EU)stablerequiredcore

Framework Mappings (24)

DSP-20Data Provenance and Transparencyinformative
GRC-14Explainability Evaluationinformative
MDS-03Model Documentationpartial
MDS-04Model Documentation Requirementsfull
MDS-05Model Documentation Validationpartial
EU-AI-Art.11.1Technical Documentation — Preparation and Maintenancefull
EU-AI-Art.11.2Technical Documentation — Simplified Format for SMEs and Small Mid-Capsinformative
EU-AI-Art.18.1Documentation Retention — 10-Year Retention Obligationpartial
EU-AI-Art.53.1GPAI Model Obligations — Technical Documentationinformative
COP-S-10Additional documentation and transparencyinformative
COP-S-10.1Additional documentationpartial
COP-S-7.1Model description and behaviourinformative
COP-T-1Documentationinformative
COP-T-1.1Drawing up and keeping up-to-date model documentationinformative
COP-T-1.2Providing relevant informationinformative
A.4.4Tooling resourcespartial
A.4.5System and computing resourcesfull
A.6.2.7AI system technical documentationfull
SA-5System Documentationinformative
MG-3.2-002Pre-Trained Model Monitoring | MG-3.2-002informative
MG-3.2-003Pre-Trained Model Monitoring | MG-3.2-003partial
MS-2.5-002AI System Validity and Reliability | MS-2.5-002partial
MS-2.9-002AI Model Explainability and Validation | MS-2.9-002partial
MEASURE 2.8AI Transparency and Accountability Riskspartial

Evidence (2)

recorddocumentmanual

AI system technical documentation for each production system, covering system architecture, intended purpose, performance metrics, known limitations, training data summary, failure modes, and human oversight mechanisms.

Example: Technical Documentation · AI Underwriting Assistant v3 (Confluence, version-controlled), covering architecture diagram, intended use cases, accuracy/recall metrics, 8 documented known limitations, training data summary, fail-safe behaviour description, and instructions for oversight personnel

Test: Request the technical documentation for a sample of production AI systems. Verify: (1) every section the control names is present, (2) the documentation is version-controlled and its current version corresponds to the deployed version in the model registry, (3) it is retrievable on request rather than held informally, (4) releases to deployers, operators or competent authorities are recorded with the date and the recipient.

system_exporttechnicalautomated

Registry export pairing each production system's deployed version with the version of its technical documentation.

Example: Model registry export, 2026-08-31: 9 production entries, each carrying deployed_version and doc_version with the documentation URI

Test: Export the deployed version and the documentation version for every production AI system. Verify: (1) each production entry carries a documentation reference, (2) the documentation version recorded matches the version of the documentation held, (3) the documentation version is not older than the deployed version, (4) a system deployed in the period carries a documentation version dated on or before its deployment date, (5) entries with no documentation reference are reported rather than filtered out of the export.

Questions (3)

boolean

Does technical documentation exist for each AI system before it is deployed?

Technical documentation is the primary evidence artefact for AI governance audits and regulatory inspections. It must be version-controlled and the current version should correspond to the deployed model version.

multi

Which of the following sections are included in your AI system technical documentation?

System architecture and componentsIntended purpose and the use cases in scopePerformance measures and the limits of that performanceTraining data summaryKnown failure modes and edge casesHuman oversight mechanismsHardware and compute requirementsMaintenance and update scheduleNone of the above

All eight sections are expected. Known failure modes and human oversight mechanisms are the two sections most often missing from documentation inherited from a general software template. They are also the two an enterprise buyer reads first.

boolean

Does the current version of each system's technical documentation correspond to the version of the system in production?

Compare the documentation version against the model or release version recorded in the registry for a sample of systems. Documentation that describes a version no longer deployed fails this question even where every required section is present.