The EU AI Act came into force in stages between 2024 and 2027. The high-risk-system obligations under Article 16 are the part your AI team should fear. To deploy a high-risk system in the EU, you owe the market — and any notified body that asks — a documentation package described in Annex IV: a model card, training-data lineage, bias test results, an Article 9 risk register, Article 14 human-oversight logs, and Article 13 transparency disclosures.
Most AI teams have fragments of this. The model card is in a Notion page someone updated when they remembered. The training-data fingerprints are in S3 if anyone thought to compute them. The bias tests ran in a notebook nobody can find. The risk register lives in the head of the ML lead who left in March.
When the notified body asks for the package — as it stood at deployment — most teams discover they can't produce it. The fine for non-conformance reaches seven percent of global revenue, or €35 million, whichever is higher.
What Annex IV actually demands
Read carefully, Annex IV asks for five reconstructions:
- The model. Not the current version — the version that was deployed. With its card. With its biases. With its limitations.
- The training data. Provenance, license attestations, representativeness, exclusion logs. Article 10 makes data governance a first-class obligation.
- The risk register. Article 9 requires you to identify, mitigate, and test each risk before deployment. The chain has to prove the ordering.
- Bias and accuracy testing. Reproducible, signed, and tied to the model version that was deployed.
- Human oversight. Article 14 wants logs of the oversight policy as it was operationally in force.
If those five things are stored in five different tools, the reconstruction is a 60-day project. If they're stored in one bitemporal graph, it's one query.
The one-query reconstruction
MATCH (m:Model) AT RECORDED '2026-02-04T00:00:00Z'
WHERE m.system_id = 'AS-1138'
OPTIONAL MATCH (m)-[:TRAINED_ON]->(d:Dataset)
OPTIONAL MATCH (m)-[:HAS_RISK]->(r:Risk)
OPTIONAL MATCH (m)-[:BIAS_TESTED_BY]->(b:BiasTest)
OPTIONAL MATCH (m)-[:UNDER_OVERSIGHT]->(o:Policy)
RETURN m, collect(d), collect(r), collect(b), collect(o)The model graph rolls back to deployment date. Every property of the model. Three signed training datasets. Twelve risks with mitigations and tests. Bias scores within the stated tolerance on every protected attribute. Three active oversight policies. The Annex IV technical documentation is now a JSON object.
The Article 9 ordering proof
The assessor's harder question is whether each risk was actually mitigated before deployment. db.verifyAclChain on the model node rehashes every entry from risk-identification to deployment. The chain order is mathematical: if any risk's mitigation was added after deployment, the chain shows it. If every risk was identified, mitigated, and tested before the model went live, the chain proves the ordering.
This is Article 9 conformity reduced to a proc call.
The Article 10 lineage
db.derivedFrom on the model returns every training dataset, each with a sha256 fingerprint, a license attestation, a representativeness analysis, and an exclusion log for sensitive attributes. Article 10 wants this. The chain provides it without anyone hunting through Notion.
The Article 22 GDPR overlap
While the AI Act conformity assessment is in flight, a user invokes Article 22 of the GDPR — the right to challenge an automated decision. The same primitives produce the answer for a different audience. The model version they got. The inputs that fed it. The rule that fired. Each input cryptographically signed at capture. The user's letter from your lawyer is a one-procedure-call reconstruction, not a six-week research project.
The numbers
A 60-day, €80,000 documentation project becomes a five-minute query. The Article 9 risk register is provably ordered. The Article 10 training-data lineage is provably complete. The Article 14 human-oversight logs are signed and chained. Your fine risk — up to seven percent of global revenue — goes to zero.
And critically, your team keeps shipping product. The Annex IV documentation isn't a parallel effort. It's a side effect of the way you store the model.