EU AI Act documentation duties and how an AIBOM supports them

The AI Act asks providers to document how their systems are built, what data trained them and which third-party components they rely on. An AIBOM does not replace that documentation, but it supplies much of its content and keeps it current.

Key dates

The Regulation itself is Regulation (EU) 2024/1689 ^[3]. The AI Omnibus also extended some SME measures to small mid-caps and simplified certain registration obligations ^[2].

High-risk AI: technical documentation

Article 11 requires the provider of a high-risk AI system to draw up technical documentation before the system is placed on the market or put into service, and to keep it up to date. Minimum contents are set out in Annex IV ^[4]. Annex IV items that an AIBOM directly supports include ^[5]:

• "the versions of relevant software or firmware, and any requirements related to version updates";
• "recourse to pre-trained systems or tools provided by third parties and how those were used, integrated or modified";
• "datasheets describing the training methodologies and techniques and the training data sets used", including provenance, scope and main characteristics;
• validation and testing data, and the metrics used to measure accuracy, robustness and compliance;
• cybersecurity measures, and "relevant changes made by the provider to the system through its lifecycle".

Article 10 adds data-governance duties, including documenting data collection processes and the origin of data, and data-preparation operations such as labelling and cleaning ^[6]. Article 18 requires the documentation to be kept for ten years after the system is placed on the market or put into service ^[7].

The value chain

Article 25(4) requires the provider of a high-risk system and any third party supplying AI systems, tools, services, components or processes used in it to agree in writing the information, capabilities, technical access and assistance needed for compliance. Third parties supplying components under free and open-source licences are exempt from this requirement ^[8]. In practice, providers will ask suppliers for AIBOM-style information, and an AIBOM delivered under contract is a clear way to meet that request. See AI procurement requirements.

General-purpose AI models

Article 53 requires GPAI model providers to keep technical documentation, including training and testing processes (Annex XI); to give downstream providers information about capabilities and limitations (Annex XII); to maintain a copyright policy; and to publish a sufficiently detailed summary of training content ^[9]. The Commission published the voluntary GPAI Code of Practice on 10 July 2025, and its Transparency chapter includes a Model Documentation Form ^[10]. The template for the public training-content summary, released on 24 July 2025, asks for data sources, including large datasets and top domain names for scraped content ^[11].

For downstream providers, the Annex XII information they receive belongs in their own AIBOM as the record of the GPAI component they integrate.

Mapping AI Act duties to AIBOM content

Article 15 specifically names data poisoning and model poisoning of pre-trained components as threats to address ^[12]; see AI supply-chain risks.

What an AIBOM does not cover

The technical documentation also includes the risk-management system, human-oversight measures, the EU declaration of conformity and post-market monitoring ^[5]. These are organisational records. An AIBOM supplies the component, data and change information they refer to.

How IntelliXBOM helps

IntelliXBOM keeps AIBOMs for each AI system with version history and diffs, which supports Annex IV's lifecycle-change requirement. It validates the fields your AI Act policy requires, correlates components with vulnerabilities, and maps the inventory to AI Act articles with timestamped evidence.

This article summarises public guidance and is not legal advice.