-

IRIS would require: Technical Documentation (EU AI Act) Risk Management File Data Protection Impact Assessment (DPIA – GDPR) Conformity Assessment Post-market monitoring plan

A high-risk AI system like IRIS must, at minimum, have EU AI Act technical documentation (Annex IV) and an EU Declaration of Conformity, with a GDPR DPIA additionally required if it processes personal data, forming the core legal basis for market release and accountability.

Risky assessment and risky management is essential along with documentation of data

Commercial release would require formal documents such as risk assessments and data protection reviews. These show that safety, privacy, and compliance risks were evaluated before deployment. They are essential for responsible approval.

Technical Documentation Risk Management Records System Logs

Records of processing activities ( RoPA

Legally required under GDPR because IRIS processes sensitive biometric data (facial tracking). This document proves you have minimized privacy risks

Clear explanations of how data is collected, used and shared

For commercial deployment, IRIS would realistically require: Technical Documentation (EU AI Act Article 11). Quality Management System documentation (Article 17). Conformity Assessment and EU Declaration of Conformity. Post-Market Monitoring Plan and logging mechanisms. Risk Management documentation. Data Protection Impact Assessment (DPIA) under GDPR, due to biometric and behavioural data processing. User instructions and transparency notices. These documents collectively demonstrate compliance with both AI-specific and data protection law.

Risk assessment and DPIA

Drivers license

Quality manual and policy

1. Technical Documentation (Annex IV) 2. Risk Management Documentation 3. Quality Management System Evidence 4. EU Declaration of Conformity 5. Operational Logs/Record Keeping 6. Registration in the AI Act high risk database 7. DPIA under GDPR (if personal data processing qualifies)

GDPR, Risk Assessment Documents SOC2 Type 2 End-user agreement Privacy Policy Terms and conditions

Article 11 & Annex IV, Article 47, DPIA - GDPR Article 35, Article 9, Article 27, QMS Article 17, Article 13, Post-Market Monitoring Plan

I don't think they provided any required document.