Risk · R-095 · Governance & Accountability
Inadequate technical documentation
Design, data, testing and limitations are not documented well enough for a validator, auditor or regulator to understand the system.
- Severity
- Medium
- Audience
- Heads-of · Practitioner
- Frameworks
- Principle 8 · Annex IV · Article 11 · Principle 3
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
Documentation is the record of what a system is for, how it was built, what data it uses, how it was tested, what it cannot do and how it must be overseen. It is inadequate when it is missing, when it describes an earlier version, or when it records what was done without the reasons. For bought systems the gap is usually that the supplier provides marketing material in place of technical detail.
How it happens
- Documentation is left to the end of the project and then cut.
- Knowledge stays in notebooks and in individuals.
- Changes are made and the documents are not updated.
- Suppliers decline to disclose how their system works.
Why it matters
Validation and audit depend on it. When the authors leave, the organisation loses the ability to maintain or explain the system. For high-risk systems the EU AI Act requires technical documentation with prescribed content, kept up to date.
Warning signs
- Validators have to interview developers to understand the model.
- Documents describe a version no longer in production.
- Known limitations are recorded nowhere.
- Supplier documentation gives no test results.
Mitigating controls
Primary controls
- Model and system documentation Directive
- Sets the documentation standard and makes it a condition of approval. Each AI system's purpose, design, data, test results and limitations are documented to a set standard that allows a validator, auditor or regulator to understand it without its authors.
Supporting controls
- Dataset documentation Directive
- Supplies the data documentation. Each dataset used for AI has a maintained record of its source, collection method, contents, rights, lawful basis, known limitations and permitted uses.
- Independent model validation Detective
- Validation cannot complete without adequate documentation, which exposes the gap. A function independent of the developers tests each model's conceptual soundness, data, performance and limitations before approval and periodically afterwards, to a depth set by the model's tier.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Code of Practice for the Cyber Security of AI | Principle 8 | Document your data, models and prompts Documentation of data, models and prompts. |
| EU AI Act | Annex IV | Technical documentation content The required content. |
| EU AI Act | Article 11 | Technical documentation The duty this risk is a failure of. |
| SS1/23: Model Risk Management Principles for Banks | Principle 3 | Model development, implementation and use Model documentation standards. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
- SS1/23: Model Risk Management Principles for Banks Bank of England PRA · official text
Related terms
How to cite
Axiom Verity (2026). Inadequate technical documentation. Reference Library, R-095. https://axiom-verity.com/risks/inadequate-technical-documentation. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.