The Spec Nobody Wrote

The EU AI Act requires three categories of documentation for high-risk AI systems before August 2, 2026: technical documentation (Article 11, Annex IV), automatic logging (Article 12), and transparency information (Article 13). GDPR Article 30 adds a fourth: records of processing activities. The regulation says what must be documented. It does not say how to verify that the documentation is complete.

The missing validation layer

CEN/CENELEC JTC 21 was tasked with developing harmonised standards for the AI Act. Working groups exist for each article: WG 3 for record-keeping, WG 4 for transparency, WG 6 for accuracy and robustness. The original target was Q4 2025. As of March 2026, no harmonised standard has been published. This creates a gap. Providers of high-risk AI systems need to prepare documentation now. Consultants charge $30K to $500K for compliance preparation. But neither the providers nor the consultants have a machine-readable definition of "complete." Annex IV lists 9 sections. Article 12 describes logging requirements at a high level. Article 13 mandates transparency information for deployers. None of these specify what a validator should check, what thresholds indicate completeness, or how to verify internal consistency between documents. The gap isn't theoretical. I tested ai-trace-auditor against five real open-source AI frameworks (LiteLLM, n8n, Dify, Haystack, CrewAI). Every generated documentation package had structural gaps that no existing tool detected: GDPR roles assigned to software instead of organizations, Article 13 and Article 50 obligations conflated, retention periods hardcoded without distinguishing provider from deployer requirements. These aren't obscure edge cases. They're the kind of errors that a conformity assessment would catch. The problem is that nobody defined what the assessment checks for, so nobody could automate the checking.

38 checks, 6 categories

I wrote the AI Compliance Documentation Spec: a machine-checkable specification for validating whether AI system documentation meets EU AI Act requirements. Every check has a stable ID, an article reference, a severity level, defined inputs, and explicit pass/warn/fail criteria. The categories: Category 1: Technical Documentation Completeness (Article 11 / Annex IV) — 11 checks. Are all 9 Annex IV sections present? Is the system description populated from actual code analysis, not just placeholders? Are AI components, data requirements, testing procedures, cybersecurity measures, performance metrics, and risk management all documented? Is a scope classification present that references the specific Annex III category? Category 2: Record-Keeping Completeness (Article 12) — 10 checks. Do traces contain timestamps, operation IDs, error logging, model version tracking, trace linkage for multi-step operations, resource consumption, request parameters, content recording (opt-in), and tool call logging? Is the retention period compliant? Category 3: Transparency Documentation (Article 13) — 6 checks. Is the provider identified? Are capabilities and limitations described? Is accuracy disclosed with numeric metrics? Are human oversight measures documented? Is output interpretation guidance provided? Can deployers interpret the logs? Category 4: Data Flow and Processing Records (GDPR Article 30) — 5 checks. Do ROPA entries exist for every detected external service? Are GDPR roles assigned to organizations (not software)? Is there a data flow diagram? Are third-country transfers identified with legal basis? Are retention periods specified per processing activity? Category 5: Internal Consistency — 3 checks. Do AI components detected in code appear in the documentation? Do fields present in traces match what's described in logging documentation? Does every external service in the flow analysis have a ROPA entry? Category 6: Documentation Quality — 3 checks. What's the placeholder ratio? Are there unverifiable claims? Are legal references correct?

What the scoring looks like

The overall score weights mandatory checks at 70%, recommended at 25%, informational at 5%. Per-article scores let teams prioritize: fix the lowest-scoring article first. A score above 90 means the documentation package is likely sufficient for conformity assessment. Below 50 means the documentation is fundamentally incomplete. Most auto-generated packages score 50-70 on first run because sections 5 through 9 (risk management, lifecycle changes, standards, declaration of conformity, post-market monitoring) require human input that no code scanner can produce. This is by design. The spec doesn't pretend automation can replace compliance officers. It tells you exactly which parts are done and which parts need a human.

Agent-friendly compliance

One additional thing the spec enabled: an agent-friendly documentation checker. Generated compliance documents need to be consumable not just by humans reviewing PDFs, but by AI coding agents that fetch documentation during development. I added a --agent-friendly flag to the tool that evaluates the generated Markdown against 10 checks adapted from the Agent-Friendly Documentation Spec: document size (under 50K chars for reliable agent consumption), content start position, section header structure, code fence validity, table structure, link format, placeholder density, information density, line length, and llms.txt extractability. The generated Annex IV documentation scores 95% agent-friendly. The spec itself scores 100%.

Why I wrote it

The honest reason: I surveyed 130+ tools across five categories of AI compliance and found that nobody translates between observability (trace collection), GRC (policy management), and AI providers (the APIs). The translation layer is manual. I automated part of it with ai-trace-auditor, but automation without a specification is just opinion with a CLI. The spec makes the opinion checkable. Every claim maps to a specific article and paragraph. Every threshold can be overridden for organizational policy. Every check ID is stable across versions. If CEN/CENELEC publishes harmonised standards tomorrow, the spec can be updated to reference them; the check architecture doesn't change. The enforcement deadline is August 2, 2026. Penalties for non-compliance with Articles 11, 12, and 13 are up to 15 million euros or 3% of global annual turnover. The market is $492 million and growing. The spec is CC-BY-4.0. The tool is Apache 2.0. The standard nobody wrote is now written. Whether it becomes the standard anybody uses depends on what happens between now and August.

The AI Compliance Documentation Spec is available on GitHub. The reference implementation is ai-trace-auditor.