The 7 Deadly Sins of AI Documentation (And How to Fix Them Before an Audit)

Last updated: June 2026 · Reading time: 8 minutes

---

Most AI providers treat documentation like a necessary evil- something to be done at the last minute, as quickly as possible, with as little effort as possible. But under the AI ACT, sloppy documentation isn’t just a minor issue- it’s a compliance violation that can cost you €15M+ in fines.

Market surveillance authorities (MSAs) don’t just glance at your docs- they scrutinize them. And if your documentation is missing, vague, or outdated, they’ll assume the worst: that your AI system is non-compliant.

This guide exposes the 7 deadly sins of AI documentation- the most common mistakes that get companies in trouble- and shows you how to fix them fast with DILAIG.

---

Why Documentation Matters Under the AI ACT

The AI ACT doesn’t just require documentation- it demands it in specific formats, with specific content, for specific purposes. Here’s what’s at stake:

Document	AI ACT Requirement	Purpose	Penalty for Non-Compliance
Technical Documentation (Annex IV)	Article 11	Prove compliance to MSAs	Fines up to €15M or 3% turnover
EU Declaration of Conformity (DoC)	Article 47	Legal affirmation of compliance	Fines up to €15M or 3% turnover
Instructions for Use	Article 13	Enable deployer compliance	Fines up to €15M or 3% turnover
Fundamental Rights Impact Assessment (FRIA)	Article 27	Assess fundamental rights risks	Fines up to €15M or 3% turnover
Post-Market Monitoring Plan	Article 72	Ensure ongoing compliance	Fines up to €15M or 3% turnover

Bottom line: If your documentation is incomplete, inaccurate, or out of date, your entire AI system is at risk of being deemed non-compliant.

---

The 7 Deadly Sins of AI Documentation

Sin #1: The "Last-Minute Scramble"

The Problem: Documentation is written after the system is built, deployed, or even in use. By then, it’s often rushed, incomplete, or full of gaps.

Why It’s a Problem:

• You miss critical details (e.g., training data sources, performance metrics).
• You forget to update it when the system changes.
• You don’t align it with AI ACT requirements.

The Real Risk: Annex IV documentation written under time pressure, days before an audit, typically skips entire sections, especially risk assessments. That is precisely the kind of gap Article 11 penalizes, with fines of up to €15M or 3% of global turnover.

How to Fix It: ✅ Start documenting early- ideally, during the design phase. ✅ Structure your work around the AI ACT’s actual requirements, rather than writing ad hoc. ✅ Review and update documentation whenever the system changes materially.

DILAIG’s Role: DILAIG’s free audit (50 questions, 20 minutes) identifies your system’s classification and the obligations that follow. For high-risk systems, DILAIG then generates the technical documentation (Annex IV), the EU Declaration of Conformity, the transparency notice, and the FRIA directly from your answers- avoiding a last-minute scramble to write everything from scratch.

---

Sin #2: The "Generic Cut-and-Paste"

The Problem: Using boilerplate text from old projects or generic templates that don’t reflect your actual system.

Why It’s a Problem:

• One-size-fits-all docs don’t address your system’s specific risks.
• Copy-pasted sections may contradict your actual processes.
• MSAs see through it and assume you’re hiding something.

The Real Risk: Instructions for use that read like they were copied from a different product, without describing the system’s actual characteristics, are easy for MSAs to spot- and useless to deployers, who can’t rely on them to meet their own obligations.

How to Fix It: ✅ Customize every document to your system’s unique characteristics. ✅ Describe the system as actually deployed, not a generic or theoretical version. ✅ Get a second opinion- have a colleague review for accuracy.

DILAIG’s Role: DILAIG’s free audit is built around specific questions about your system (use case, data, architecture), which produces documentation tied to each system rather than recycled boilerplate.

---

Sin #3: The "Too Technical for Humans"

The Problem: Documentation is written by engineers, for engineers- full of jargon, code snippets, and assumptions that deployers (or auditors) won’t understand.

Why It’s a Problem:

• Deployers (e.g., HR teams, hospitals) can’t use overly technical docs to implement human oversight (Article 14).
• MSAs may reject docs they can’t understand.
• Legal teams can’t verify compliance if they don’t grasp the content.

The Real Risk: Instructions for use that are too technical prevent deployers (HR teams, clinical staff, public officials) from exercising the human oversight Article 14 requires- which is itself a violation of Article 13.

How to Fix It: ✅ Write for your audience- if it’s for deployers, explain in plain, concrete terms. ✅ Include a glossary of technical terms. ✅ Have someone outside the technical team review it.

DILAIG’s Role: The transparency notice DILAIG generates from your audit is structured for a non-technical audience, covering the information Article 13 explicitly requires (characteristics, capabilities, limitations, human oversight measures).

---

Sin #4: The "Missing the Obvious"

The Problem: Omitting critical AI ACT-required sections, like:

• Known limitations (e.g., "works poorly with non-Western faces").
• Prohibited uses (e.g., "do not use for hiring").
• Data governance practices (Article 10).
• Human oversight measures (Article 14).

Why It’s a Problem:

• MSAs assume the worst- if you don’t disclose limitations, they’ll assume you’re hiding them.
• Deployers can’t comply if they don’t know the rules or risks.

The Real Risk: Omitting known limitations of a high-risk system (degraded performance on certain subgroups, use cases to avoid) reads to an MSA as concealment- and carries potentially harsher consequences than a simple drafting gap.

How to Fix It: ✅ Use a structured checklist covering every section the Annex IV requires. ✅ Be rigorously honest- disclose all known issues. ✅ Get a compliance review before finalizing.

DILAIG’s Role: The free audit’s 50 questions systematically cover Annex IV points, including data governance (Article 10) and human oversight (Article 14), reducing the risk of missing a mandatory section.

---

Sin #5: The "Set It and Forget It"

The Problem: Documentation is never updated after the initial draft- even when the system changes dramatically.

Why It’s a Problem:

• Article 11 requires docs to be kept up to date.
• Article 43 (conformity assessment) must be re-done after substantial modifications.
• MSAs will notice if your docs describe v1.0 but you’re on v3.5.

The Real Risk: If your technical documentation still describes an earlier version of the system while production has moved on, it no longer reflects reality- exposing you to a non-compliance finding, and potentially requiring you to redo the conformity assessment after a substantial modification (Article 43).

How to Fix It: ✅ Tie documentation to your version control system (e.g., Git). ✅ Schedule regular reviews of all docs, especially after any significant change. ✅ Assign an owner responsible for keeping documentation current.

DILAIG’s Role: A system already classified on DILAIG can have its audit reopened and answers updated as the system evolves, regenerating documentation aligned with the current version rather than a stale one.

---

Sin #6: The "Disorganized Mess"

The Problem: Documentation is scattered across:

• Word docs
• Google Drives
• Email threads
• Slack messages
• Someone’s local hard drive

Why It’s a Problem:

• Auditors can’t find what they need- leading to delays or fines.
• Teams waste time hunting for the latest version.
• No single source of truth = inconsistencies and errors.

The Real Risk: When key documentation (FRIA, technical documentation, DoC) is scattered across multiple tools and inboxes, an audit takes far longer than it should, and the risk of version inconsistency increases.

How to Fix It: ✅ Centralize documentation in a single system per AI system. ✅ Use clear naming conventions (e.g., AI_ACT_Annex_IV_v2_2026-06-10.doc). ✅ Implement access controls so only authorized users can edit.

DILAIG’s Role: Each DILAIG audit centralizes the answers and documents generated for a given system. For organizations managing documentation across multiple AI systems or multiple clients, connecting an AI agent via MCP lets you pre-fill an audit draft from existing internal documents, reducing how scattered the source material is before the audit even starts. The agent never sees the score and cannot submit the audit or generate documents itself- it only prepares a draft that a human must review and validate.

---

Sin #7: The "No Proof of Compliance"

The Problem: Documentation claims compliance but has no evidence to back it up. For example:

• Saying you tested for bias- but no test results are included.
• Stating you have a risk management system- but no process descriptions or audit logs.
• Asserting you monitor post-market- but no incident reports exist.

Why It’s a Problem:

• Article 11 requires evidence of compliance, not just statements.
• MSAs will ask for proof- and if you can’t provide it, you’re non-compliant.

The Real Risk: Claiming full compliance in the DoC without being able to produce the underlying evidence (test results, logs, reports) reads to an MSA as a false statement- sanctionable under Article 99.

How to Fix It: ✅ Back up every claim with data, logs, or reports. ✅ Keep evidence alongside the documents it supports. ✅ Include screenshots, test results, and audit trails where relevant.

DILAIG’s Role: Documentation generated by DILAIG is built from the concrete answers given during the audit- which pushes you to document what was actually done, rather than making generic, unverifiable claims.

---

How DILAIG Helps You Fix These 7 Sins

DILAIG doesn’t just give you a list of best practices- the free 50-question audit identifies your system’s classification and the documentation obligations that follow, then generates the corresponding documents (Annex IV technical documentation, DoC, transparency notice, FRIA) directly from your answers for high-risk systems.

Sin	What the DILAIG audit provides
Last-Minute Scramble	Structures the obligations upfront, rather than under deadline pressure
Generic Cut-and-Paste	Documentation generated from answers specific to your system
Too Technical	Transparency notice written for deployers, in line with Article 13
Missing the Obvious	Systematic coverage of Annex IV checkpoints
Set It and Forget It	Audit can be reopened as the system evolves
Disorganized Mess	Answers and generated documents centralized per AI system
No Proof of Compliance	Documentation anchored in real answers, not generic claims

This structured approach reduces the risk of documentation gaps compared with manual, improvised drafting, without replacing a lawyer’s judgment on complex cases.

---

Illustrative Scenario: Fixing Gap-Ridden Documentation Before an Audit

Consider a hypothetical example to illustrate the approach. A mid-sized medical imaging AI provider, while preparing for an audit, realizes its Annex IV documentation is incomplete (several sections missing), out of date relative to the current system version, and split across several internal tools with no single source of truth.

A structured way to fix this would be to:

1. Start from the free DILAIG audit to pinpoint exactly which sections are missing relative to Annex IV.
2. Generate the technical documentation from the audit answers, rather than drafting each section by hand.
3. Centralize the generated documents alongside their supporting evidence.
4. Update the audit whenever the system changes materially, to keep the documentation aligned with reality.

This approach doesn’t guarantee any particular audit outcome- it reduces the risk of the structural gaps described in this guide, without replacing legal advice on the specifics of your system.

---

Your Documentation Checklist: Never Sin Again

Use this pre-audit checklist to ensure your docs are AI ACT-ready:

General Requirements

• All documents are version-controlled and timestamped.
• Every document has a clear owner and review date.
• Documents are stored securely (encrypted, access-controlled).

Technical Documentation (Annex IV)

• System architecture diagram included.
• Training data sources and preprocessing steps documented.
• Performance metrics (accuracy, robustness, cybersecurity) listed.
• Known limitations and failure modes disclosed.
• Data governance practices (Article 10) described.

EU Declaration of Conformity (DoC)

• Signed by authorized person (Article 47).
• References all applicable AI ACT articles.
• Includes system name, version, and intended purpose.
• Linked to technical documentation.

Instructions for Use (Article 13)

• Written for deployers (not engineers).
• Characteristics, capabilities, and limitations clearly stated.
• Human oversight measures explained.
• Logging and monitoring requirements specified.

Fundamental Rights Impact Assessment (FRIA)

• Scope of assessment defined.
• Fundamental rights risks identified and assessed.
• Mitigation measures described.
• Consultation with affected groups documented (where applicable).

Post-Market Monitoring Plan (Article 72)

• Monitoring procedures outlined.
• Incident reporting process defined.
• Metrics and thresholds for intervention specified.

DILAIG’s Role: The free audit follows this same section-by-section checklist.

---

How DILAIG Helps

DILAIG runs on a free 50-question audit (20 minutes, no credit card required) that classifies your AI system and identifies the applicable documentation obligations. For high-risk systems, DILAIG then generates the four mandatory documents (Annex IV technical documentation, EU Declaration of Conformity, transparency notice, FRIA) from your answers.

For organizations managing documentation across several AI systems at once- SaaS vendors with multiple products, consultants handling multiple clients- connecting an AI agent via MCP lets you pre-fill an audit draft from existing internal documents (technical specs, data governance policies, oversight procedures). The agent never sees the score and cannot submit the audit or generate documents on your behalf- a human must always review and validate the draft before proceeding.

DILAIG doesn’t replace a lawyer- but it structures the documentation work to reduce the risk of the 7 sins described in this guide.

---

DILAIG helps you turn documentation from a compliance headache into a structured process. Our tool doesn’t replace legal advice.

→ Find out your classification and documentation obligations- free audit- 20 minutes, no credit card required.

See DILAIG’s AI agent / MCP connection · View pricing

---

Not sure if this applies to you? Check in 2 minutes, no account needed.

Am I a GPAI provider? →   ·   Is my AI prohibited under Article 5? →