What an EU AI Act compliance deliverable actually contains

What does an EU AI Act compliance deliverable actually contain? This article describes the pack LMXAI produces for teams shipping LLM, RAG and agent systems in the EU: risk classification, technical documentation, logging, human oversight and general-purpose AI evidence. It explains what the pack is not, and relates its contents to the Regulation and to established documentation and audit formats from the machine-learning literature.

Keywords EU AI Act · compliance · technical documentation · logging · human oversight · audit

The obligations come from the Regulation: for high-risk systems, risk management, data governance, technical documentation, automatic logging, transparency, human oversight, and accuracy, robustness and cybersecurity (Articles 9–15), with transparency duties for limited-risk systems under Article 50^[1]. The literature on the proposal describes conformity assessment and post-market monitoring as its two primary enforcement mechanisms and reads them as an auditing regime^[2].

What an audit needs is evidence, and the machine-learning community has established formats for it: model cards for intended use and evaluation across relevant conditions^[3], datasheets for the motivation, composition and collection of datasets^[4], and an end-to-end framework for internal algorithmic auditing^[5]. The compliance pack described here assembles the same kinds of evidence from a running system.

An EU AI Act compliance deliverable is the set of artefacts that let you operate an AI system in the Union without guessing — while Article 50 already applies and Annex III high-risk rules follow in 2027 under the current timetable. It answers four questions in writing: what the system is, which risk tier it falls in, which articles apply, and which evidence you can show — logs, evals, human-oversight design and a technical file — if a market-surveillance authority asks.

A law firm can interpret the text. It cannot produce the logging pipeline, the evaluation set or the deployment diagram. LMXAI’s deliverable is the engineering half of that pair. For the legal landscape itself, see the practical EU AI Act guide.

1. AI inventory and intended purpose. One record per system: users, data classes, deployment region, and whether you are a provider or a deployer under the Act.
2. Risk classification. Mapping against Annex III, the Article 6(3) exception analysis, and a written rationale if you claim limited or minimal risk.
3. Technical documentation draft. Architecture, training or adaptation data, evaluation protocol, known limitations — the skeleton of Annex IV, filled from the real stack.
4. Logging and traceability. Event-level records aligned with Article 12: who asked what, which model version answered, which documents were retrieved.
5. Human-oversight design. Where a person can stop, override or escalate — not a checkbox that “a human is somewhere in the company”.
6. GPAI / model notes. If you host open weights or wrap a general-purpose model, the transparency and (where relevant) systemic-risk obligations that attach to that choice.
7. Gap list and 90-day plan. What is already true in production versus what must be built before full enforcement.

It is not a CE-marking factory for every Annex III system, and it is not a substitute for notified-body work where that is required. It is also not “we used an EU cloud, therefore we are compliant.” Residency helps GDPR. The AI Act cares about risk, documentation and operational control.

When to commission this: you already have a prototype or a Copilot-class rollout, and legal has asked “are we a provider?” LMXAI runs the classification and the evidence map in weeks, then stays on to implement the gaps — logging, eval, sovereign serving — as the same partner.

The same traces that satisfy Article 12 are the traces you need to debug a RAG agent. The same model card that feeds Annex IV is the card you need to swap vLLM weights without losing the plot. Compliance work that is detached from the serving stack becomes fiction the first time the model is updated.

Need more detail? Chat with Savion’s AI legal assistants for EU AI Act questions — obligations, risk tiers and documentation checklists.

Open Savion

• Practical EU AI Act guide
• High-risk classification and 2027 timeline
• Article 50 transparency obligations
• GPAI provider vs downstream integrator
• EU AI Act FAQ for enterprise teams
• Risk classification service
• Fractional AI CTO