The AI documentation pack: write it now, not under deadline

Less than most people fear. The heavy technical file belongs to providers of high-risk systems, and most business software is not high-risk. What everyone owes is smaller: evidence that staff know what they are doing with AI, plus transparency disclosures since August 2026. Five short records cover that and most of what buyers ask, and they take an afternoon to write.

What changed on 28 September 2026: since 27 July the AI literacy duty asks for supporting measures, not a sufficient level, and the UK automated-decision paragraph below now carries every safeguard Article 22C requires.

Which parts land on you depends on two answers worth settling first. Whether you count as a provider or a deployer of each system you run, and whether any of them falls into a high-risk category under Annex III. Most of the small companies we work with end up in the same place, as deployers of systems that are not high-risk. That tier still has paperwork worth writing, just not the paperwork most compliance vendors are selling.

An AI documentation pack is a short set of records answering five questions: which AI systems you run, what each is for, where its data comes from, who reviews the output, and what gets logged.

What the Act asks you to keep

Two duties reach every company that uses AI at all, whatever tier it sits in. The first is AI literacy. Article 4 has bound providers and deployers alike since 2 February 2025. Since the Omnibus rewrite took effect on 27 July 2026, it asks only for measures that support the literacy of the people operating AI on your behalf. A dated line naming who was told what is the whole evidential answer.

The second is transparency, and it arrived on 2 August 2026. Providers of systems built to interact with people have to make clear that the thing on the other end is software. Providers of generative AI have to mark outputs in a machine-readable way. Deployers have to disclose deepfakes, and AI-written text published to inform the public on matters of public interest unless a person took editorial responsibility for it (a practical guide to Article 50).

The bulky obligations, the technical file and the conformity assessment, sit with providers of high-risk systems, and those deadlines moved. Stand-alone Annex III systems now bite on 2 December 2027 and embedded ones on 2 August 2028 (Gibson Dunn on the Omnibus agreement, May 2026; European Commission timeline). Since 27 July 2026 those dates have been fixed in law by Regulation (EU) 2026/1744. Nothing about transparency moved with them.

The AI system inventory

One row per system. Name, vendor, who owns it internally, what data it sees, whether its output reaches a customer without a person in between.

The value is in how uncomfortable the list gets. Expect it to run longer than anyone guessed, because AI arrives through features rather than through procurement. The transcription in the meeting tool counts. The suggested-reply box in the helpdesk counts. So does every AI coding tool that proposes changes to a repository. Its row should say who approves those changes, where that approval is recorded, and whether the tool can write to the repository without it.

The fastest way to build the list is to read a quarter of card statements. A subscription list does not round down.

Write this one first. Every other record hangs off a row in it, and the rows you forget are the ones that turn up later in somebody's questionnaire.

Purpose statements, one paragraph each

What the system is for, what it must not be used for, and who is affected by its output.

The middle clause carries the weight. "This tool drafts client emails" tells a reviewer nothing. "This tool drafts client emails, is not used to decide anything about a client's account, and every draft is read by the account owner before it goes out" answers the reviewer's next question. That saves a round trip that usually costs a week.

Purpose statements do a job internally too. When somebody proposes automating the last step, point at the clause that has the account owner read every draft. Written down, a purpose becomes a boundary. Left undocumented, it drifts towards whatever the busiest person needed on a Friday afternoon.

Where the data came from

For each system: what data goes in, whether the vendor trains on it, what is excluded by policy, and where the reference material originated.

Code counts as data here, and this is the part small companies skip. If anyone builds your software with AI coding tools, in-house or at a supplier, find out whether the tools run on business accounts with terms that bar training on your code. Then record the answer on that tool's row in the inventory, along with who owns the account, which repositories it can see and whether any client data or credentials sit in them. Investors in technical diligence are now asking about this too, and a written answer beats one pieced together from memory.

Provenance has the shortest shelf life of anything in the pack, because vendors change their training defaults without telling anyone twice. Note the date you checked, not just the answer.

Human oversight points that are real

For each system, where a person sits in the loop and what they can do about it. "Reviewed by a human" is not an oversight point unless someone is rostered, has the time, and has authority to overrule the output.

There is a UK reason to be precise here beyond the AI Act. The Data (Use and Access) Act 2025 reforms came into force on 5 February 2026 and replaced UK GDPR Article 22 with new Articles 22A to 22D. Explicit consent is no longer needed for significant automated decisions outside two restricted cases: decisions using special category data, and processing carried out under the new "recognised legitimate interest" basis. The safeguards stayed: the person must be told about the decision and be able to make representations, obtain human intervention and contest it (legislation.gov.uk, section 80; ICO guidance on the DUAA).

Human review on request is an operational promise. If your policy offers it and nobody owns the rota, you have documented a liability.

What you log, and for how long

Four decisions, written down: what each system records, how long you keep it, who can read it, and what never enters the store.

Most teams drift into one of two accidental defaults. Either nothing is kept, so any review after an incident is guesswork. Or everything is kept indefinitely, including prompt text with client details in it, which turns a retention question into a data protection one. Neither is a decision. Both pass for one in a questionnaire, until somebody asks for the retention period and the call goes quiet.

A workable version is unimpressive on the page: a retention window in days, a rule about what never appears in a stored prompt, and the names of the people who can read it. Nobody praises that paragraph. It ends the question.

Who asks for each record, and when

The overlap is the reason to write it once and properly. An enterprise security questionnaire and an investor's diligence list ask the same things in different words, and the Article 50 duty sits inside the answers to both.

Writing the pack without ceremony

The format that has survived for us is a decision record per choice that mattered, each one carrying a status line and a date. On one platform, one of them was superseded the day after it was accepted, and we left it in the repository with its banner and its original comparison table intact.

That last bit is the part worth stealing. A diligence reader is not impressed by documents that were always right. A pack with one reversal in it reads as true, and a pack with none reads as written last Tuesday, because it usually was. We keep this for every platform we build.

Six to ten pages covers a company running five or six systems. An unread pack decays into fiction within two quarters, so dates and named owners matter more than length.

If you want a second opinion on scope before starting, the Commission's AI Act Service Desk has run an interactive Compliance Checker since October 2025. The Omnibus package also promises simplified guidance and standardised documentation templates for smaller companies, which beats buying a compliance suite written for a machinery manufacturer.

Questions we get asked

Do we need documentation if our only AI use is a chatbot subscription?

Yes, though very little of it. Article 4 literacy applies to deployers regardless of risk tier, so you want an inventory row, a purpose statement and a dated note of what staff were told. Twenty minutes of work, and it is the same page an enterprise buyer will ask for.

Does the delay to high-risk rules mean we can leave this until 2027?

No. The Digital Omnibus moved high-risk deadlines to December 2027 and August 2028. Article 50 transparency has been live since 2 August 2026 and Article 4 has been in force since February 2025, in a lighter form since July 2026. The delayed part is the part most small companies were never in.

What is the penalty if we get it wrong?

Fines under Article 99 run to 15 million euro or 3% of worldwide annual turnover for most operator duties. For SMEs and start-ups each cap applies at whichever of the fixed sum or the percentage is lower, the reverse of the general rule (Article 99).