Article 11 — Technical documentation

Article 11 requires one document. It must be finished before the system is placed on the market, kept up to date afterwards, and it must contain at least the nine heads of Annex IV. Almost nothing in it is new. Annex IV asks the provider to describe the risk management system from Article 9, the data governance from Article 10, the logging from Article 12, the instructions from Article 13, the oversight measures from Article 14, the accuracy and robustness characteristics from Article 15, and the post-market plan from Article 72. Article 11 is where the rest of Section 2 is written down.

Two things follow. The document can be wrong while the system is right, and right while the system is wrong, and nothing in the Act says whether a single defect is then one infringement or two. And the Article names its readers: national competent authorities and notified bodies. The deployer gets the instructions for use instead. A person affected by a decision gets an explanation under Article 86. The public gets a registration entry. Four documents describe the same system to four audiences, and no provision requires them to agree with one another.

The Digital Omnibus changed one part of this. A small or medium provider, and now a small mid-cap company, may document in a simplified manner. But a provider that chooses that route must use a form the Commission supplies, and a notified body must accept that form. A template therefore sets the documentation standard for a whole class of providers, and the body assessing conformity cannot insist on Annex IV in full.