Evidence Requirements for EU AI Act Investigations

On September 1, 2026, the European AI Office transitioned from policy-making to active enforcement, issuing its first formal requests for information to over 30 providers of General Purpose AI (GPAI) models. According to legal analysis of these initial probes (Simmons & Simmons, 2026), the requests focus on model security, adversarial testing results, and the granular details of post-market monitoring. For data owners and buyers, this signals that compliance is no longer a check-the-box exercise; it is a document-heavy evidentiary process.

The Technical Documentation Burden (Annex IV)

Under Article 11 of the EU AI Act, providers of high-risk AI systems and GPAI models must maintain comprehensive technical documentation. In an investigation, the EU AI Office will demand the artifacts listed in Annex IV. This is not a summary, but a deep dive into the system’s architecture. You must be prepared to provide:

• Design Specifications: Detailed descriptions of the methods and steps performed for the development of the AI system, including the logic of the algorithms and the design choices made.
• System Architecture: Documentation of how the system interacts with other software and the hardware it is intended to run on.
• Computational Resources: Disclosed figures on the energy consumption and compute power used for initial training and fine-tuning.

For data buyers, ensuring your vendor has these artifacts is critical. You should prioritize to acquire rare compliant training data for the EU AI Act that already includes the necessary metadata to populate these technical files.

Data Governance and Provenance Evidence

Article 10 of the Act mandates strict data governance. If investigated, a data owner or buyer must prove the integrity of the training, validation, and testing datasets. The EU AI Office requires evidence of "data provenance," which includes the origin of the data, the methods of collection, and the legal basis for its use. According to the official text of the AI Act (Regulation (EU) 2024/1689), documentation must cover:

• Dataset Characteristics: Information about the density, quantity, and quality of the data.
• Bias Mitigation: Evidence of the measures taken to identify and address potential biases, especially those affecting the health and safety of persons or fundamental rights.
• Rights Clearance: A summary of the policies regarding copyright and the specific datasets used to train the model.

Data owners looking to monetize their assets must now treat "provenance logs" as a core part of the product. A dataset without a clear audit trail of its lifecycle is increasingly viewed as a liability rather than an asset.

Operational Logs and Adversarial Testing

One of the most stringent requirements for systemic-risk GPAI models is the provision of adversarial testing results. The EU AI Office’s recent requests specifically targeted "red-teaming" reports. Investigators will look for evidence that the model was tested against malicious prompts, jailbreaking attempts, and data poisoning. Article 12 requires that high-risk AI systems automatically generate logs over their entire lifecycle. These logs must provide a chronological record of the system's operation, enabling the traceability of outputs to specific inputs and processing steps.

Financial Risk and Enforcement Scales

The stakes for failing to provide this evidence are unprecedented. The EU AI Act establishes a tiered fine structure. Non-compliance with data governance requirements (Article 10) can lead to administrative fines of up to €15 million or 3% of the total worldwide annual turnover, whichever is higher. For providing misleading or false information to regulators during an investigation, the fine can reach €7.5 million or 1% of turnover (Article 99, Regulation (EU) 2024/1689). This makes the "cost of evidence" a vital line item in any AI project budget.

What this means for you

For data owners, your monetization strategy now hinges on documentation. You are no longer just selling raw information; you are selling a "compliant data package" that includes provenance certificates and bias audit reports. High-quality, pre-vetted assets can be listed in our dataset catalogue to attract buyers who are specifically looking to mitigate EU AI Act audit risks. For data buyers, the Sept 1 enforcement actions serve as a warning: due diligence must extend beyond model performance to the evidentiary trail of the data that built it. If you cannot produce the logs, you cannot deploy the model.