01
What needs to be documented
An AI system should be documented starting from its definition: an automated system that, from input data, infers outputs such as predictions, content or decisions with varying levels of autonomy (citation-2).
Then you need the roles involved (provider and deployer), the types of data used, and the transparency measures toward people exposed to the system (citation-2, citation-1, citation-0).
02
Why transparency is central
The Regulation requires that artificially generated or manipulated outputs be marked in a machine-readable format, and that deployers of emotion recognition or biometric categorisation systems inform the natural persons exposed to them (citation-0). For deepfakes and texts on matters of public interest, clear disclosure is required, unless there is human editorial review (citation-3).
03
Sequence for documenting a system
Steps
- Describe the system according to the Article 3 definition: function, autonomy, type of output produced (citation-2).
- Classify the data used: training, validation, testing, input, biometric (citation-1).
- Identify the roles: who is the provider, who is the deployer of the system (citation-2).
- Record the transparency measures applied: marking, notice, deepfake disclosure (citation-0, citation-3).
- Plan AI literacy activities for the staff involved (citation-4).
04
A hypothetical case
Hypothesis: a company uses a biometric categorisation system for access to a restricted area. As deployer, it informs the natural persons exposed about how the system works, as required by the Regulation (citation-0). It also documents the biometric data processed (citation-1), its own role as deployer (citation-2), and the literacy activities carried out with the staff who manage the system (citation-4).
05
Controls to verify
- The system definition is consistent with Article 3 (autonomy, input, output) (citation-2).
- Training, validation, testing and input data are distinct and classified (citation-1).
- Provider and deployer roles are assigned without ambiguity (citation-2).
- People exposed to emotion recognition or biometric categorisation are informed (citation-0).
- Transparency information is provided no later than the first interaction (citation-3).
06
How a management software can support documentation
- A software partner can configure fields to record the stated purpose of each AI system used (citation-2).
- It can provide distinct roles for provider and deployer, with traceability of who entered the data (citation-2).
- It can label datasets by type: training, validation, testing, input (citation-1).
- It can record the notices given to exposed people and the date of the first interaction (citation-3).
- It can track literacy activities carried out with the staff involved (citation-4).
07
Frequently asked questions about documentation
Minimum documentation covers system definition, roles, data types and transparency measures applied (citation-2, citation-1, citation-0). Staff literacy is a complementary measure required by the Regulation (citation-4).
08
Next step
Build an inventory of the AI systems used in your company, with purpose, data, roles and transparency measures documented for each, so you have a ready basis for review (citation-2, citation-1, citation-0).
FAQ
Frequently asked questions
Who must inform people exposed to an emotion recognition system?
The deployer of the system informs the natural persons exposed about how it works and processes personal data in accordance with the applicable data protection rules (citation-0).
What types of data should be distinguished when documenting an AI system?
Training, validation, testing, input and, where present, biometric data: each has a different function in the system's lifecycle (citation-1).
When must transparency information be given to the people concerned?
No later than the time of the first interaction or exposure, in a clear, distinguishable way and consistent with applicable accessibility requirements (citation-3).
✓