Technical Documentation Every GPAI Provider Must Maintain
Technical documentation forms a central part of the EU AI Act’s obligations for Generative AI Providers (GPAIs). The documentation must support compliance with the Act’s requirements and demonstrate due diligence in the development, deployment, and governance of AI systems. The level of detail required depends on the risk classification of the AI system, but all GPAIs must maintain records that allow for audit, review, and validation by supervisory authorities or certification bodies.
Essential Technical Documentation Elements
GPAIs must maintain records that cover the entire lifecycle of their AI models. These records must include data sources, training methodologies, model architecture, validation processes, and risk mitigation strategies. For example, a GPAI developing a large language model must document the composition of training data, including any third-party datasets, and explain how data was preprocessed or filtered to reduce bias or harmful content. The documentation must also reflect the steps taken to ensure the model aligns with EU AI Act requirements, such as avoiding prohibited practices or ensuring appropriate transparency.
- Training data composition and curation processes
- Model architecture and design decisions
- Validation and testing protocols
- Monitoring and logging mechanisms
- Measures to prevent or detect harmful outputs
Documentation for Risk Classification and Compliance
Under the EU AI Act, AI systems are categorised into different risk levels, including prohibited, high-risk, and limited-risk categories. Technical documentation must reflect these classifications and support the claims made during the system’s conformity assessment. For instance, a GPAI placing a generative AI system on the market must ensure that documentation clearly shows how the system meets the requirements for transparency, human oversight, and data governance. The documentation must also indicate whether the system was tested for bias or discrimination, and how such issues were addressed.
ISO/IEC 42001:2023 provides a framework for AI management systems, which includes requirements for maintaining technical records. The standard specifies that documentation must be sufficient to demonstrate compliance with applicable laws and regulations. This includes records of decisions made during development, such as the choice of algorithms or data filtering techniques. The documentation must also support any certification claims or audit processes that may be required by national supervisory authorities or certification bodies.
Implementation and Ongoing Maintenance
GPAIs must ensure that technical documentation is not static but evolves with the AI system. Regular updates are required to reflect changes in data, model versions, or operational procedures. For example, if a GPAI updates a generative model to reduce hallucinations or improve factual accuracy, these changes must be recorded in the technical documentation. The documentation must also include records of any incident reports or feedback from users that led to modifications or improvements.
Organisations must designate roles responsible for maintaining these records. This might include data scientists, compliance officers, or technical leads. The documentation must be stored securely and accessible to relevant personnel, including auditors or regulatory officials. The EU AI Act requires that such records be available upon request, and failure to maintain or provide them can result in penalties of up to 35 million EUR or 7 percent of global turnover.
As of 2 August 2026, national supervisory authorities have the power to enforce these documentation requirements. The Digital Omnibus on AI, which came into force on 27 July 2026, also introduces further deadlines for compliance. For example, generative AI systems placed on the market before 2 August 2026 must meet machine-readable marking requirements by 2 December 2026. This highlights the importance of maintaining accurate records from the start of development through to deployment and beyond.
By maintaining detailed and accurate technical documentation, GPAIs not only meet regulatory obligations but also support internal governance, risk management, and continuous improvement. The documentation serves as evidence of due care and adherence to EU AI Act principles, which is essential for avoiding penalties and maintaining trust with users and regulators.