Which systems have a dossier?

Systems currently classified P5 (Alethexis’s internal taxonomy, not the AI Act’s nomenclature). If a system leaves that level, it no longer has a dossier; what you documented stays in its sections.

If an element shows as “missing”, is it an outstanding obligation?

Not necessarily. The dossier counts the four elements for every high-risk system, even though not all of them bind every organisation: the FRIA, for example, is only mandatory in the cases of Article 27(1). If it exists, it belongs here; if it does not apply to you, “missing” only means it is not there.

Who can view and export the dossier?

Any of the organisation’s five roles — Owner, AI Officer, DPO, Contributor and Auditor — can open it and export its PDF, because all of them can read evidence.

Does the dossier replace the provider’s documentation?

No. The system provider’s obligations remain the provider’s. The dossier keeps the documentation the provider has given you as evidence, so you have it to hand next to your own assessments.

All features

Assess risk and impact

High-risk dossier

What your organisation has documented about a high-risk AI system, brought together in one place and exportable to PDF with a hash.

14-day free trial See the demo

What it is for

When someone asks about a high-risk AI system — a client, an auditor, senior management — the answer is usually scattered across assessments, evidence and approvals. The Alethexis high-risk dossier brings them together, system by system.

For each high-risk system: current FRIA and DPIA, evidence, controls and approvals, exportable to PDF with a hash. There is one dossier for each system classified P5 (Alethexis’s internal taxonomy, not the AI Act’s nomenclature), within the M3 High-Risk Ready module, opened from Evidence.

It is an internal organisational criterion, an Alethexis internal methodological control: it brings together what you have already documented on the platform; it does not assess the system or replace its provider’s obligations.

How it works

Four elements and their coverage

The dossier checks four elements: a FRIA with a recorded approval that is still current, a DPIA on the same terms, system operation logs and provider documentation. Each shows as present or missing, and the header shows how many of the four are in place.

The system’s evidence

It gathers the evidence linked to the system and to its current FRIA and DPIA, grouped by category, with upload date, the control it is linked to and its retention period.

Controls and approvals

It lists the high-risk controls assigned to the system with their status — pending, in progress, implemented, not applicable or waived — and the approvals recorded on its FRIA and DPIA.

Export and check

Any team member can generate the dossier PDF in one click. The platform records its SHA-256 integrity hash, keeps each export as a new file and logs the download in the audit log.

What you get

Dossier PDF with a hash
Organisation, system, export date and author; coverage of the four elements; the version and approval date of the current FRIA and DPIA; evidence by category; the high-risk controls with their status and the recorded approvals. The file’s SHA-256 hash is recorded in Alethexis. The PDF is generated in Spanish.

Basis

The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.

IMInternal methodological control

IMInternal methodological controlM3-HRA-033

Organised retention of documentation received from the provider

Keep the set of documents received from the provider (Article 13 instructions, model card, DPA, CE marking, GPAI contracts under Article 53) in a traceable digital folder per system. The deployer is not bound by the ten-year period in Article 18, which falls to the provider, but retains them for the life of the use and for a reasonable period after withdrawal.

Legal basis

No direct basis in law.

Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.

Available in

M3High-Risk Ready

Modules build on each other: M2 includes everything in M1, and M3 includes M1 and M2.

FAQ

Which systems have a dossier?: Systems currently classified P5 (Alethexis’s internal taxonomy, not the AI Act’s nomenclature). If a system leaves that level, it no longer has a dossier; what you documented stays in its sections.
If an element shows as “missing”, is it an outstanding obligation?: Not necessarily. The dossier counts the four elements for every high-risk system, even though not all of them bind every organisation: the FRIA, for example, is only mandatory in the cases of Article 27(1). If it exists, it belongs here; if it does not apply to you, “missing” only means it is not there.
Who can view and export the dossier?: Any of the organisation’s five roles — Owner, AI Officer, DPO, Contributor and Auditor — can open it and export its PDF, because all of them can read evidence.
Does the dossier replace the provider’s documentation?: No. The system provider’s obligations remain the provider’s. The dossier keeps the documentation the provider has given you as evidence, so you have it to hand next to your own assessments.

Try it with your own systems