Three working documents, filled in with the data of the public demo account of a dental clinic. All the data is fictitious, and each document says so on its first page.
They follow on from the complete case of the clinic: there, the path from the inventory to a reviewable decision; here, how three of its pieces look once they're written down.
The vendor questionnaire, completed
Download the questionnaire. The questions the clinic puts to the vendor of its diagnostic imaging support system: what it is, what data it processes and where, what documentation it provides — including the Article 13 instructions for use — and what human oversight measures it indicates. And what remains open, which gets written down too.
The decision log, with a negative decision
Download the log. Three decisions with their context, the options ruled out and the rationale. One is negative: not extending the appointments chatbot to a first symptom triage, because emergency healthcare patient triage systems are in Annex III, point 5(d), and the clinic does not currently have the oversight that would require.
No rule asks for a log with this name. It's what makes it possible to explain later why a system does not do something it could.
The evidence file
Download the evidence file. Six pieces of evidence for the same system: the FRIA — carried out as good practice, because Article 27 does not bind a private clinic —, the DPIA, the records of Article 4 AI literacy measures, the logs that Article 26(6) asks deployers of high-risk systems to keep, the Article 28 GDPR processing agreement, and the vendor's instructions for use.
Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach Annex I, Section B products.
Each PDF in the file carries its integrity fingerprint: a SHA-256 digest that changes if a single byte changes. It shows that the document has not changed since it was generated; it says nothing about who reviewed it.
What they are not
They're not templates to copy as they stand: they're examples of how a file looks when it's filled in carefully. And they don't replace the classification of each system, which is the deployer's.
This article is for informational purposes only and does not constitute legal advice.