Before a high-risk AI system is placed on the market or put into service, the provider must carry out the conformity assessment procedure in Article 43 that applies to that system, draw up an EU declaration of conformity under Article 47, affix the CE marking under Article 48, and register the system where Article 49 requires it. The route depends on the classification, on whether harmonised standards or common specifications have been applied, and on whether the system falls under Annex I product legislation or Annex III.
What is conformity assessment for?
Conformity assessment is the procedure by which a provider demonstrates that a high-risk AI system meets the requirements in Section 2 of Chapter III, Articles 9 to 15, together with the other applicable requirements the Act specifies for that system. It is not a general quality award and it does not certify that every output will be correct. It is a structured check, based on the quality management system and the technical documentation, that the system as designed, tested and documented meets the legal standard for its intended purpose. The assessment must be completed before the system is placed on the market or put into service, and the declaration and CE marking that follow it are legal statements that the assessment has been carried out and the requirements are met. A system placed on the market without the required assessment has skipped the step the Act makes a precondition for market access.
How does the route depend on classification?
The route depends first on whether the system is an Annex I product-embedded system or an Annex III stand-alone system, and, for Annex III, on which point of Annex III applies. Annex III point 1 systems, concerning biometrics, follow a differentiated route that can require a notified body where harmonised standards or common specifications have not been applied in full. Annex III points 2 to 8 systems follow internal control without a notified body. Annex I Section A systems follow the conformity procedure of the relevant product legislation, with the AI Act requirements assessed as part of it. A provider must therefore record the classification route before choosing a procedure, because choosing the wrong route, even with thorough work, does not satisfy Article 43 for that system.
For the broader regulatory framework, see Conformity assessment and CE marking overview.
What are the steps after assessment?
After a successful conformity assessment, the provider draws up an EU declaration of conformity under Article 47, containing the information in Annex V and stating, under the provider's sole responsibility, that the system complies with the Act and any other relevant Union law. The provider then affixes the CE marking under Article 48, in accordance with the rules for that marking, including digital CE marking where the system is provided digitally. The provider registers the system in the EU database under Article 49 where required, before placing it on the market. The order matters: the declaration and marking follow the assessment, they do not precede it, and registration follows the conformity outcome. Each step should be dated and linked to the assessment file, so that the sequence can be verified.
Where do standards and specifications fit?
Harmonised standards under Article 40 and common specifications under Article 41 affect both the presumption of conformity and the choice of assessment route. Where a harmonised standard cited in the Official Journal has been applied, conformity with the standard gives a presumption of conformity with the corresponding requirements. Where no standard exists, or where a standard has not been applied in full, the provider may need to follow the notified-body route for Annex III point 1 systems, and must in any case demonstrate compliance directly from the legal text. Common specifications adopted by the Commission can play a similar role where harmonised standards are not available. Providers should check the current citation status of any standard they rely on, record the version applied, and not assume that a standard that is still in development already gives a presumption.
When is a new assessment needed?
A new conformity assessment is needed where a substantial modification is made to a high-risk system, or where a change affects compliance with the requirements or the intended purpose in a material way. A substantial modification is assessed by reference to its effect on compliance and purpose, and the provider should record the change, the assessment, and the decision on whether a new assessment is required. Pre-determined changes that were set out in the technical documentation and assessed as part of the original conformity work, such as certain post-placement learning within defined bounds, are treated differently, as Article 43 provides. Teams should not treat every patch as a new assessment, nor treat a material redesign as a minor update; the assessment should be reasoned, recorded, and reviewed where the position is borderline.
Continue with Conformity assessment routes under Article 43.
What does this lead guide not decide?
This guide does not decide which conformity route applies to a particular system, whether an assessment has been passed, whether a declaration or CE marking is valid, or whether a modification is substantial. It does not assess a standard, a specification, or a notified body. Those questions depend on the system's classification, the standards and specifications applied, the assessment file, and the consolidated legal text. A provider should confirm its route and its file with a competent authority, a notified body where involved, or a legal adviser, and should keep the assessment, declaration, marking and registration records linked and current.
Frequently asked questions
Must conformity assessment be completed before market placement?
Yes. The provider must carry out the applicable conformity assessment procedure before the high-risk system is placed on the market or put into service, and must then draw up the declaration, affix CE marking, and register the system where required, in that sequence.
Does every high-risk system need a notified body?
No. Most Annex III systems in points 2 to 8 follow internal control without a notified body. Notified-body involvement is required in the circumstances Article 43 sets out, including for Annex III point 1 systems where harmonised standards or common specifications have not been applied in full, and for Annex I systems under the relevant product legislation.
What triggers a new conformity assessment?
A substantial modification, or a change that affects compliance or the intended purpose in a material way, can trigger a new assessment. The provider should record the change, assess its effect, and record the decision, seeking qualified review where the position is borderline.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗