Chapter III Section 2, Articles 8 to 15: the design and documentation requirements every high-risk AI system must meet before it is placed on the market, and the evidence that shows it.
The umbrella requirement: high-risk systems must meet Articles 9 to 15 in light of their intended purpose and the state of the art, with the risk management system as the reference, and providers of Annex I products may fold the evidence into existing sectoral files.
The continuous, lifecycle risk management process for high-risk AI: identifying and evaluating risks to health, safety and fundamental rights, acceptable residual risk, testing against predefined metrics, and attention to minors and vulnerable groups.
Governance and quality criteria for training, validation and testing data: provenance, preparation, representativeness, bias examination and mitigation, and the 2026 move of the special-category data rules for bias detection into Article 4a.
The technical file a provider must draw up before market placement and keep current: the nine Annex IV headings, the simplified form for SMEs and small mid-caps added in 2026, single documentation for Annex I products and the 10-year retention period.
The design requirement for automatic event logging over a high-risk system's lifetime: what the logs must make traceable, the minimum fields for remote biometric identification, and how long providers and deployers keep them.
Transparency toward deployers rather than the public: systems interpretable enough for appropriate use, and instructions for use covering purpose, accuracy metrics, risks, oversight measures, resources and logs.
Designing high-risk systems so people can oversee them: oversight measures built in or assigned to deployers, what overseers must be able to do including override and stop, and the two-person verification rule for remote biometric identification.
Performance and security requirements over the lifecycle: declared accuracy, resilience to errors and feedback loops, defenses against AI-specific attacks such as data poisoning and adversarial examples, and the cybersecurity presumptions in Article 42.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.