How should evidence chains be built for high-risk requirements?

What is an evidence chain?

An evidence chain is a set of linked records that shows, for each requirement, what was done, what was found, and what was decided. The chain starts with the intended purpose and classification, moves through risk management, data governance, documentation, logging, deployer information, oversight design and performance testing, and ends with the conformity conclusion and the post-market plan. Each link should state the requirement, the evidence, the location of the evidence, the version, the date, and the reviewer. A chain is not a narrative that asserts compliance in general terms; it is an index that allows a reviewer to verify each assertion by following the pointer to the underlying record. A chain with broken pointers, missing versions, or undated entries cannot be followed and therefore cannot support a conformity conclusion.

How should the chain be structured?

The chain should be structured as a single controlled index, with one entry per requirement and per obligation, rather than as a set of separate folders with no cross-references. The index should use stable identifiers for the system, the version, and each document, and should record the relationship between documents, for example that a test result supports a risk measure, that a risk measure is described in the technical documentation, and that the documentation was assessed in conformity assessment. The index should be version-controlled, so that a change to a document creates a new version of the index entry rather than overwriting the history. A reviewer should be able to reconstruct the state of the chain at any earlier date, including at the date of market placement, from the version history.

For the broader regulatory framework, see High-risk requirements overview.

How do testing and risk evidence link together?

Testing evidence and risk evidence should be linked at the level of the individual risk and the individual threshold. A risk entry should point to the measures taken, the tests that checked those measures, the results, and the residual risk judgement. A test result should point back to the risk it was designed to check and to the threshold it was judged against. That two-way link prevents two common failures: a risk measure that was never tested, and a test that was carried out without a risk it was meant to address. The link should be maintained when either side changes: a new risk should trigger new testing, and a failed test should trigger a risk reassessment. The chain should show those updates as dated entries, not as silent edits to the original entries.

How do documentation, conformity and registration link?

Technical documentation under Article 11 is the file that conformity assessment examines, and registration under Article 49 records the system in the EU database on the basis of the conformity outcome. The evidence chain should therefore link the documentation version assessed, the conformity procedure followed, the declaration of conformity drawn up, the CE marking affixed, and the registration entry made, with dates and identifiers for each step. A registration entry that points to a documentation version that was never assessed, or a declaration that points to a conformity procedure that was never completed, breaks the chain. The chain should also record any notified body involvement, including the body, the certificate, and the scope, where Article 43 requires or the provider has chosen third-party assessment.

How is the chain maintained after market placement?

After market placement, the chain must be maintained through post-market monitoring, incident handling, and change management. New monitoring data, incident reports, and system changes should be added as dated entries, linked to the risks and requirements they affect, with reassessment decisions recorded. Earlier entries should not be overwritten: a change should create a new version of the affected entry and a note explaining what changed and why. The chain should have a named owner, a review cadence, and a retention plan that covers the period set by the Act for the relevant records. A chain that is complete at release but frozen thereafter will not reflect the system as it operates, and a supervisor asking about a later incident will find no record of how the system changed after release.

Continue with Article 11 technical documentation.

What does this guide not decide?

This guide does not decide whether a particular evidence chain is sufficient, whether a conformity conclusion is correct, or whether a registration entry is accurate. It does not approve an index format or assess a documentation set. Those questions depend on the system, the evidence, the conformity procedure, and the consolidated legal text. A provider should have its evidence chain reviewed by an independent reviewer before conformity assessment, test that every pointer resolves to the current version, and confirm the position with a competent authority or legal adviser where the chain is contested.

Frequently asked questions

Continue through this AI Act cluster

• High-risk requirements overview
• Article 11 technical documentation
• Conformity assessment and CE marking
• EU database and registration overview
• Provider responsibilities
• What risk management system does Article 9 require?