Routes & applicability

• High-risk systems follow internal control or require a Notified Body (NB), depending on Annex criteria and sectoral overlays.
• Map the legal basis and justify route selection; record assumptions and linked mitigations.

Technical file contents

• System purpose/limits, architecture, oversight, instructions; RMS summary and risk file index.
• Data cards, model cards, evaluation protocols & results, bias audits, security tests.
• Change control, release notes, rollback policy, SBOM, supplier attestations.

Evidence mapping

• Trace each requirement → control → metric → owner → evidence location.
• Publish a cross-reference matrix so auditors can reach evidence quickly.

Notified bodies & audits

• Prepare scoping pack; pre-assessment to surface gaps; timebox remediations; keep decision minutes.
• During audit: demonstrate processes and tools; show real tickets, logs and approvals.

Sectoral alignment

• Medical devices, machinery, financial services or other regimes may require additional artifacts and tests.
• Keep a regulatory overlay table with obligations, owners and proof points.

Declaration & CE marking

• Issue EU Declaration of Conformity; affix CE marking; ensure instructions accompany the product/service.
• Keep copies and version history; record authorised signatory and date.

Post-placement duties

• PMM, incident reporting, CAPA and change control must remain operational after CE marking.
• Material changes may trigger re-assessment; keep a change impact log.

Supplier management

• Vendor due-diligence; model/API provenance; SLAs for incidents; right-to-audit where proportionate.

Common pitfalls

• Evidence not linked to requirements; missing change records; unproven oversight controls.
• Bias metrics without acceptance limits or CAPA; undocumented updates between assessment and go-live.

Timeline & readiness

• Back-plan from market date; freeze evidence snapshots per milestone; keep a RACI with named approvers.

Cost & resourcing

• Budget for audits, red-team, security testing, legal review, documentation and operations uplift.

Implementation checklist

• Route chosen & justified; technical file complete; cross-reference matrix present; NB engaged (if required).
• Declaration issued; CE affixed; PMM/incident/CAPA live; sectoral overlays tracked.

© Zen AI Governance UK Ltd • Regulatory Knowledge • v1 05 Nov 2025 • This page is general guidance, not legal advice.