Management systems, control evidence and what certification bodies ask to see before they sign.
38 controls in nine areas against four functions and 72 subcategories. One is certifiable, one is not, and procurement asks for the certificate.
Annex IV runs to nine points and point two alone has seven sub-points. The evidence either exists as an artefact or the control exists only in the policy.
Article 27 binds public bodies, private providers of public services, and two Annex III uses. A DPIA can be reused, but it does not replace the assessment.
Most AI vendor questionnaires test whether a supplier has a policy. These test whether it can hand you the artefacts your own obligations will require.