Pre-Deployment Certification

The central document proving compliance with a specific regulation like the EU AI Act. It details the chosen assessment procedure, the system's intended purpose, and a direct mapping of system capabilities to each essential regulatory requirement. This report must be signed by an authorized legal representative and is the primary artifact for market surveillance authorities.

A comprehensive blueprint of the AI system's design and operation, required under Annex IV of the EU AI Act. This package must include:

• A general description of the system's intended purpose and logic.
• Detailed specifications for the algorithmic supply chain, including data provenance and model architecture.
• Instructions for use, including any required human oversight mechanisms.
• A description of the guardrail configuration and operational constraints.

A living document chronicling the iterative risk assessment process. It identifies known and reasonably foreseeable risks, evaluates their severity using a model risk tiering framework, and describes the specific mitigation measures adopted. This file must demonstrate that the residual risk scoring for each hazard is acceptably low and that a kill switch mechanism or other fail-safe is in place for critical failures.

Structured disclosures that make the system's behavior interpretable to downstream deployers. This includes the Model Card detailing performance benchmarks and limitations, and a System Card explaining the operational context. For general-purpose AI, a Foundation Model Transparency Report is required, disclosing training compute, data sources, and dangerous capability benchmark results.

Proof of a robust internal governance structure that ensures consistent compliance across the AI lifecycle. This includes documented procedures for continuous compliance monitoring, data drift detection, and a formal model deprecation policy. Auditors will look for evidence of a responsible scaling policy and a clear rollback procedure to revert to a safe state in case of post-deployment failure.

An immutable, chronological record of all external validations. This log must include the full red-teaming report, results from adversarial robustness benchmarks, and the final signed opinion from the notified body. The audit trail must cryptographically guarantee non-repudiation, providing a verifiable chain of custody for all evidence used to support the pre-deployment certification sign-off.