Scope & purpose

• Intended purpose, target users, environments, exclusions and dependencies; product variants.
• Regulatory mapping: AI Act title, sector laws, CE/UKCA routes, standards list (e.g., ISO/IEC 42001 family when available).

System architecture & context

• Diagrams of data flows, components, APIs, third-party services, monitoring, key custody and isolation boundaries.
• Operational modes (normal, degraded, paused); rollback and kill-switch architecture.

Data sources & governance

• Source registry with provenance/licences, lawful basis, cohort notes, retention; lineage graphs.
• Privacy engineering: minimisation, redaction, unlearning approach, DSR handling.

Models & training

• Model cards; training/finetune recipes; hyperparameters; guardrails; content filters; jailbreak protection.
• Supplier attestations for foundation models; constraints and intended use statements.

Evaluation & performance

• Test plans and results: accuracy, robustness, bias/parity, safety red-team, and stress/load.
• Acceptance thresholds by cohort; unresolved gaps with risk rationale and roadmap.

Risk management cross-refs

• Link to RMS register items; control implementations; evidence (logs, dashboards, approvals).

Security & privacy controls

• Threat model; segregation, secrets, egress controls; anti-prompt injection; content moderation pipeline.

Human oversight & UI

• Operator roles, permissions, explainability widgets, uncertainty cues, and override mechanisms.

Post-market monitoring plan

• Metrics, alerts, sampling, escalation, and CAPA workflow; regulator notification triggers.

Change control & versioning

• Model/data versioning; release approvals; rollback criteria; waiver handling; periodic reassessment.

Evidence pack structure

• Index page; requirement→control→evidence matrix; snapshots per release; immutable incident bundles.

Technical file checklist

• Scope/architecture documented; data/model cards complete; evaluations attached; RMS & PMM linked; approvals signed.

© Zen AI Governance UK Ltd • Regulatory Knowledge • v1 05 Nov 2025 • This page is general guidance, not legal advice.