Anyone looking for a fixed list of documents for the AI Regulation will be disappointed: that one list does not exist. What the Regulation requires depends on the role your company has in the AI system you use or provide. A company that purchases an off-the-shelf chatbot or a recruitment filter typically keeps different documents than a company that develops such a system itself or brings it to market under its own name.
That distinction is precisely the detail where most of the confusion comes from. The Regulation speaks of the provider of an AI system and of the user who deploys the system. For most SMEs in electronics and ICT, the latter applies: they deploy AI within their own organisation, but did not build the system themselves. The document list that goes with that is shorter and focuses mainly on how you use the system, not on how it was built.
Documents that a provider collects
A party that qualifies as a provider typically builds a file around the system itself: a description of its purpose and operation, the risk classification that has been applied, data about the data on which the system was trained or tested, and a description of the measures for human oversight. For most SMEs that purchase AI, this is not the list that applies to them; the supplier prepares those documents and they belong to the system, not to your company. Nevertheless, it is useful to know that these documents exist, because part of them you should actually receive as a user.
Documents that a user retains
If your company deploys an AI system built by another party, your file revolves mainly around three types of documents. First, the instructions for use and information that the supplier is obliged to provide: what the system is intended for, what limitations it has, and which risk category applies to it. Second, a record of how your company actually uses the system, including who is internally responsible for human oversight. Third, documentation of the information that employees received before they started working with the system, something in which worker participation can also play a role. These three categories together form the file that a supervisory authority, should it ever ask for it, would want to see first.
What you ask your software supplier
Because much of your file depends on what the supplier provides, it is wise to ask about that specifically before you start using a system. Ask for the risk classification that the supplier has assigned to the system, for the instructions for use in understandable language, and for contact details in case something goes wrong with the system. If you do not receive these documents or the answers remain vague, that in itself is already information: it says something about how maturely the supplier deals with the Regulation. A more comprehensive overview of questions you can ask a software supplier can be found in the knowledge base with explanations per topic.
Why this is not separate from the digital product passport
Companies that import or place on the market electrical or ICT equipment will, in addition to the AI Regulation, also have to deal with the digital product passport. Both regulations require a file, but these are not obligations you can combine into one document: the passport concerns the origin and composition of a physical product, the AI documentation concerns the operation and use of a system. However, it is wise to structure both files in the same way, so that you do not have to do the same research work twice. How such a file for the product passport looks, you can read in the knowledge base.
How you organise this for your company
The key is to first determine what role your company has with each AI system in use, before you start compiling a list of documents. This prevents you from spending time on documents that belong to the supplier, or conversely, missing documents that do belong to you. If you are unsure about your company's role in a specific system, the competent supervisory authority or a lawyer is the appropriate party to assess that; this text provides an overview, not a judgment of your situation.
Would you like to first get an impression of where your company stands, without immediately building a file? Take the free quick-scan via see where you stand in a few questions, or browse through the topics in the overview of all topics per situation.