Evidence management
EU AI Act evidence and documentation plan
A policy is not enough if nobody can show which control applies, who owns it, when it was reviewed and where the approved evidence is held.
Prepared by EU AI Fit editorial team · Published 24 August 2026 · Source review 31 August 2026 · Page updated 24 September 2026
Translate obligations into evidence
For each applicable requirement, describe what would demonstrate that the control is designed and operating. Evidence may include technical records, policies, test results, logs, supplier documents, training records or interface captures.
Apply evidence quality principles
Good evidence is relevant to the obligation, specific to the system, attributable to an owner, approved, current, complete enough for review and protected against inappropriate alteration or access.
Choose the right storage model
Managed private storage can simplify access and review. Customer-controlled storage can keep source files inside the client's infrastructure while EU AI Fit retains references and workflow metadata. The contract should define capacity, retention, deletion and responsibilities.
Evidence has to answer a question
A folder full of policies is not useful unless the reviewer can identify the requirement, system version and decision each file supports. Distinguish a supplier assertion, an internal operating record and an independent opinion. All may be relevant, but they establish different things. Record limitations instead of treating a filename or upload date as verification.
In this scenario: a control exists only on paper
A team has an oversight policy but cannot show a reviewer stopping or correcting an unsuitable output. The policy supports the intended design, not proof that the control works. The owner schedules a bounded exercise using hypothetical cases, retains the result and assigns any corrective action. If the operating process changes, both the instructions and the exercise need review.
Evidence quality and review worksheet
Use one row per evidence question. The download adds fields for the actual response and controlled record. Decide applicability before asking for provider documentation that a deployer may not hold.
Download editable worksheet (CSV)No email or account required. Includes response, evidence, owner, review and follow-up columns for your team. This is a working aid, not an official form or proof of compliance.
On smaller screens, scroll the table horizontally or download the worksheet.
| Check | Question to answer | Useful record |
|---|---|---|
| Relevance | Which requirement and decision does this support? | System, obligation and evidence question |
| Provenance | Who produced it and what were they able to assess? | Author, source and scope |
| Version | Does it match the deployed system and configuration? | Model/system version and effective date |
| Operation | Does it describe a control or show that it operated? | Procedure plus test, observation or incident record |
| Limitations | What cannot be concluded from this evidence? | Uncertainty, exclusions and missing information |
| Review | Who checked its adequacy, and when? | Reviewer, rationale, status and review date |
| Access | Can an authorised reviewer retrieve it safely? | Controlled location and access test |
| Change | What would make it stale? | Change trigger, owner and follow-up |
Recommended next step
Start with the highest-exposure systems and obligations, identify the evidence already available, then turn every gap into an owned action.
Run the free exposure checkRelated practical guides
Put the guidance into practice