Conformity assessment
A conformity assessment (Article 43) is the process by which a provider demonstrates a high-risk AI system meets the Act's requirements before it is placed on the market — either via internal control (Annex VI) or a notified body (Annex VII).
There are two routes. Internal control under Annex VI is a self-assessment in which the provider verifies its quality management system, examines the technical documentation and checks the design and development against the requirements. Third-party assessment under Annex VII involves a notified body assessing the quality management system and the technical documentation. Most Annex III systems take the internal-control route; the third-party route is required for certain biometric systems where the provider has not applied harmonised standards or common specifications, and for high-risk AI in products under the Annex I legislation the assessment follows that legislation's own procedure. A substantial modification triggers a new assessment.
- Art. 43
- Annex VI
- Annex VII
Conformity assessment: why it matters
The route determines the timeline. Internal control is under the provider's own control and can be scheduled; a notified-body assessment depends on an external body's capacity, which is currently the scarcest resource in the whole regime. Either way the assessment is a gate: no assessment, no declaration of conformity, no CE marking, no lawful market placement — so it belongs in the release plan rather than in a legal review at the end of one.
Conformity assessment in practice
A provider of an Annex III education-scoring system applies the relevant harmonised standards, runs the Annex VI internal-control procedure against its quality management system and Annex IV file, draws up the declaration of conformity, affixes the CE marking and registers in the EU database. A provider of a biometric identification system that has not applied harmonised standards cannot do any of that alone — it must book a notified body first, and the availability of that body sets its launch date.
Conformity assessment: the mistake people make
Believing a notified body is always required. For most Annex III systems, self-assessment under Annex VI is the correct and sufficient route; conversely, assuming self-assessment is always available leads biometric providers to discover a mandatory third-party step weeks before a launch.
Conformity assessment: common questions
- Do we need a notified body for our high-risk AI system?
- Usually not. Most Annex III systems use internal control under Annex VI. A notified body is required for certain biometric systems where harmonised standards or common specifications have not been applied, and where Annex I product legislation prescribes third-party assessment.
- What happens after the conformity assessment?
- The provider draws up the EU declaration of conformity, affixes the CE marking, and registers the system in the EU database before placing it on the market or putting it into service.
- Does a modification require a new conformity assessment?
- A substantial modification does. Changes that were pre-determined and assessed in the original technical documentation — including planned continued learning within a documented envelope — do not.
Conformity assessment: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.