EU AI Act Technical Documentation: Building Annex IV Evidence with an AI BOM
High-risk AI systems must ship with technical documentation detailed enough to assess their compliance. Article 11 and Annex IV set the contents; an AI BOM is how you keep that evidence accurate and current.
- The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases; most high-risk obligations apply from 2 August 2026.
- Article 11 and Annex IV require technical documentation covering the system, its data, and its components.
- An AI BOM is a structured, machine-readable way to hold the model, dataset and dependency parts of that documentation.
- Because models and data change, the documentation must be kept up to date, which a generated AI BOM makes practical.
What Annex IV requires
The EU AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in phases: prohibited practices from 2 February 2025, general-purpose AI obligations from 2 August 2025, and most high-risk system obligations from 2 August 2026 (with product-embedded high-risk AI under Annex I from 2 August 2027) [1]. For high-risk systems, Article 11 requires technical documentation, and Annex IV lists its contents: a general description, the development process, the data used, and the system's capabilities and limitations [2].
Where an AI BOM fits
Much of Annex IV is, in effect, a structured inventory of what the system is made of and how it was built. An AI BOM captures that in machine-readable form: models and versions, training and evaluation datasets, frameworks and libraries, and the pipeline that produced them. It turns a document that is hard to keep current into generated evidence.
| Annex IV topic | AI BOM contribution |
|---|---|
| Components and versions | Model, dataset, framework and library inventory with versions and hashes |
| Data used | Dataset lineage and provenance |
| Third-party elements | Dependencies and their licences and vulnerabilities |
| Changes over versions | Drift between model and pipeline versions |
Keeping documentation current
Annex IV documentation must stay accurate as the system evolves. Retraining, a new dataset or an upgraded library all change the technical picture. A generated AI BOM, refreshed on each build, keeps the component record in step with the system, rather than drifting away from a document written once at launch.
Transparency and security build on the same inventory
Article 13 transparency and the overall AI Act obligations draw on the same facts, and Article 15 cybersecurity depends on knowing the components you must protect. One accurate AI BOM supports all of them.
How IntelliXBOM helps
IntelliXBOM generates AI BOMs covering models, datasets, pipelines and libraries with versions and hashes, tracks drift between versions, and correlates AI dependencies with vulnerabilities and licences. It produces evidence that supports Annex IV; it does not itself certify AI Act conformity, which stays with the provider.
Frequently asked questions
Who has to produce AI Act technical documentation?
Providers of high-risk AI systems, under Article 11 and Annex IV. It must exist before the system is placed on the market and be kept up to date thereafter.
When do high-risk AI obligations apply?
The AI Act applies in phases. Most high-risk obligations apply from 2 August 2026; high-risk AI that is a safety component of products under existing EU law applies from 2 August 2027.
Does an AI BOM satisfy Annex IV on its own?
No. Annex IV also needs narrative elements such as intended purpose, risk management and human oversight. An AI BOM supplies the structured component, data and dependency evidence that underpins several Annex IV sections.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/1689/oj
- AI Act Article 11 and Annex IV: Technical documentationEU AI Act explorerartificialintelligenceact.eu/article/11/
- AI Act Article 13: Transparency and provision of informationEU AI Act explorerartificialintelligenceact.eu/article/13/
- CycloneDX Bill of Materials standardOWASP CycloneDXcyclonedx.org/
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.