RK-010HighProviderPreventive
Audit Trail for Conformity Assessment
Providers must maintain a complete audit trail for each conformity assessment, including all documentation reviewed, tests performed, results obtained, and decisions made, to support regulatory scrutiny and re-assessment activities.
Articles:Article 12(2)Article 43(1)
Evidence Examples
- Conformity assessment audit file
- Assessment decision record
- Notified body correspondence archive
Standards
ISO 42001:2023 §9.1Annex VI EU AI Act
Related controls
- RK-001Automatic Event Logging CapabilityArticle 12(1) requires that high-risk AI systems are designed and developed with automatic logging capabilities, enabling the reconstruction of events…
- RK-002Log Integrity and Tamper ProtectionProviders must ensure that logs are protected against tampering, unauthorised deletion, or modification, using cryptographic integrity controls,…
- RK-003Log Retention for Minimum 10 YearsArticle 18(1) requires that providers retain technical documentation and logs for at least 10 years after the high-risk AI system is placed on the market…
- RK-004Log Accessibility for Competent AuthoritiesProviders must ensure that event logs are accessible to competent national authorities and market surveillance authorities upon request, with procedures…
- RK-005Event Traceability and ReconstructionLogs must enable the tracing and reconstruction of decision events to understand the inputs processed, the outputs generated, and the conditions under…
- RK-006Performance and Operational Metrics LoggingProviders must log performance and operational metrics relevant to verifying that the AI system operates within the parameters established in the…
Related EU AI Act terms
- Conformity AssessmentThe process of verifying whether a high-risk AI system complies with the requirements set out in Chapter III Section 2 of the Regulation. Can be conducted through internal control (Annex VI) or with involvement of a notified body (Annex VII).
- Logging CapabilitiesThe automatic recording of events by a high-risk AI system during its operation — required under Article 12 to enable monitoring of its operation, post-hoc investigation of incidents, and to support the post-market monitoring obligations of providers and deployers.
Upgrade when it needs to be
The free questionnaire returns preliminary signals. The Full Assessment turns real system material into a governed decision record - extraction, component separation, evidence, national overlays, and a review-ready dossier.
Start free risk preview