What Annex IV content is most often underdeveloped in existing device technical files?

Data governance evidence required under Article 10, covering training, validation, and testing data methodology, provenance, labeling practices, and data cleaning steps, is the section most commonly found lacking, since traditional device technical files were not built with this level of dataset transparency in mind. Manufacturers transitioning existing devices to include AI Act compliance often need to retroactively reconstruct or newly generate this documentation.

How do Notified Bodies typically probe Annex IV documentation during review?

Notified Bodies specifically probe training-data provenance and labeling processes rather than accepting boilerplate summaries, asking pointed questions about how data was sourced, whether appropriate consent or licensing existed, how labeling accuracy was assured, and whether the dataset composition reflects the device's intended population. Treating Annex IV documentation as a generic template filled in after the fact, rather than as evidence built up during development, is a common source of review delays.

Does Annex IV documentation need to be updated after the device is on the market?

Yes, Article 11 requires that the technical documentation be kept up to date, which for AI systems means the documentation must reflect model updates, retraining events, or changes to data governance practices as they occur, not just the state of the system at initial CE marking. This links directly to the post-market monitoring plan also required under Annex IV, since ongoing performance data should feed back into keeping the technical documentation current.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Quality System

AI Act Technical Documentation (Annex IV)

The information set a provider must maintain to demonstrate a high-risk AI system's compliance with Articles 8 to 15.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 11 and Annex IV require providers of high-risk AI systems to prepare and keep up to date technical documentation covering system description, design specification, monitoring and control, risk management, training and testing data (methodology, provenance, labelling, cleaning), validation and testing procedures, cybersecurity, and the post-market monitoring plan.

What the regulation says

Regulation (EU) 2024/1689, adopted on 13 June 2024 and in force since 1 August 2024, establishes technical documentation requirements in Article 11 and Annex IV. Providers must prepare documentation before a high-risk AI system is placed on the market or put into service and keep it updated. It must demonstrate compliance with Articles 8 to 15 and give competent authorities and notified bodies clear, comprehensive information for assessing conformity. Annex IV specifies content covering intended purpose, system design, development methods, data provenance and preparation, validation and testing, performance limitations, human oversight, cybersecurity, risk management, changes, and the post-market monitoring plan. For MedTech AI covered by Article 6(1), Article 113 sets 2 August 2027 as the application date for that provision and its corresponding obligations. Article 11(2) requires a single technical documentation set combining AI Act information with documentation required by applicable product legislation. Relevant instruments include Regulation (EU) 2017/745 on medical devices, applicable since 26 May 2021, and Regulation (EU) 2017/746 on in vitro diagnostic medical devices, applicable since 26 May 2022, particularly their Annexes II and III. Existing device documentation therefore needs to address applicable AI Act requirements, not simply reference them.

What this means in practice

For medical devices, Annex IV elements fold into the MDR Annex II or IVDR Annex II technical documentation rather than sitting in a separate file. Data-governance evidence (Article 10) is the section most often underdeveloped in existing device technical files.

Examples

A manufacturer developing an AI-powered diagnostic imaging system includes detailed descriptions of its architecture, data sources for training, validation protocols, and cybersecurity safeguards in its technical documentation.
A provider of an AI system for surgical planning ensures their technical documentation comprehensively details their risk management procedures, including identified risks, mitigation strategies, and residual risk assessment.
A company providing an AI system for chronic disease management includes evidence of data governance, data labelling processes, and the methodology used for testing the system's accuracy and robustness within its Annex IV documentation.

Common pitfalls

•Treating Annex IV as boilerplate. Notified bodies specifically probe training-data provenance and labelling processes.

Frequently asked questions

No, for medical devices the Annex IV elements are intended to fold into the existing MDR Annex II or IVDR Annex II technical documentation rather than existing as a standalone parallel file. The practical approach is to map each Annex IV requirement, such as training data provenance or the post-market monitoring plan, to the corresponding section of the device technical file and ensure that section is built out to the depth the AI Act requires.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

AI Act Conformity Assessment (Medical Devices)

For AI-enabled medical devices, AI Act requirements are assessed through the MDR/IVDR notified-body procedure, not a separate CE route.

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

Regulatory

Technical Documentation

The dossier of design, manufacturing, risk, and clinical/performance evidence a manufacturer compiles under MDR/IVDR Annexes II and III to demonstrate conformity.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 1Tier 4Trade press and expert commentary· 1

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1IMDRF·1RAPS·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

The information set a provider must maintain to demonstrate a high-risk AI system's compliance with Articles 8 to 15.

·For medical devices, Annex IV elements fold into the MDR Annex II or IVDR Annex II technical documentation rather than sitting in a separate file.
·Data-governance evidence (Article 10) is the section most often underdeveloped in existing device technical files.

Remember this

Watch out: Treating Annex IV as boilerplate. Notified bodies specifically probe training-data provenance and labelling processes.

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.