Preparing for an AI supervisory audit: which documentation to have ready

Short answer: In a supervisory audit it is not so much your system that is tested as your file. The supervisor first requests your technical documentation, your risk management, your logs, your declaration of conformity and your governance. Those who have these documents ready and up to date pass; those who must reconstruct them afterwards get stuck. So prepare the file before the audit, not after.

What a supervisor requests first

For high-risk systems the AI Act prescribes exactly which documentation must be available. In practice a supervisor usually asks for:

• Technical documentation (Annex IV): purpose, design, data specifications, tested behaviour and known limitations of the system.
• Risk management system: how you identify, assess and mitigate risks across the lifecycle.
• Data governance: provenance, quality and representativeness of training and test data.
• Log files: automatic recording of events to ensure traceability.
• EU declaration of conformity and CE marking where applicable.
• Human oversight and instructions for use for the deployer.

Documentation is an ongoing process

The mistake organisations make is treating documentation as a one-off project. The AI Act requires documentation to stay current: with every substantial change to the system, the file must follow. An audit can take place years after deployment, so version control and a demonstrable update routine are crucial. A file that does not match the system in production is a red flag.

Split the roles: provider versus deployer

Not all documentation rests with the same party. The provider produces the technical documentation and declaration of conformity; the deployer must be able to show it uses the system according to the instructions for use, arranges human oversight and retains logs where required. In an audit this distinction becomes sharp; set out in contracts who supplies which document. Anchoring this belongs in your governance framework.

Rehearse the audit yourself

The best preparation is an internal mock audit: have someone who did not build the system request the file as if they were the supervisor. Missing documents, outdated versions and untraceable choices then surface before it really counts. What the enforcement process actually involves is covered separately.

What to do

• Draw up a file index with all mandatory documents and the owner of each.
• Ensure version control: documentation follows every system change.
• Check your logging: do you record enough to trace decisions?
• Allocate roles with suppliers: who delivers which document?
• Run a mock audit before the supervisor calls — see also national supervisors.