Article 43 sets three main routes. For Annex III point 1 biometric systems where harmonised standards or common specifications have been applied, the provider may choose internal control under Annex VI or notified-body assessment under Annex VII, but must follow Annex VII where standards or specifications do not exist, have not been applied, have been applied only in part, or have been published with a restriction on the relevant part. For Annex III points 2 to 8, the provider follows internal control under Annex VI. For Annex I systems, the provider follows the conformity procedure of the relevant product legislation, with the AI Act requirements assessed as part of it.
How does the Annex III point 1 route work?
Annex III point 1 covers, in so far as use is permitted under relevant Union or national law, remote biometric identification systems, biometric categorisation by sensitive or protected attributes or characteristics, and emotion recognition systems. Where the provider has applied harmonised standards under Article 40 or, where applicable, common specifications under Article 41 in demonstrating compliance with Section 2, the provider must opt for internal control under Annex VI or for assessment of the quality management system and technical documentation with a notified body under Annex VII. Where the conditions in Article 43(1) for mandatory Annex VII assessment are met, the provider must follow Annex VII and may choose any notified body, except where the system is intended to be put into service by law enforcement, immigration or asylum authorities, or Union institutions, bodies, offices or agencies, where the relevant market surveillance authority acts as the notified body. The provider should record the route chosen and the basis for the choice.
When is the Annex VII route mandatory for point 1?
The Annex VII route is mandatory for point 1 systems where harmonised standards do not exist and common specifications are not available, where the provider has not applied or has applied only part of a harmonised standard, where common specifications exist but have not been applied, or where a harmonised standard has been published with a restriction and only on the part restricted. Each of those conditions should be checked and recorded for the system, with the standard or specification, its citation status, and the extent of application stated. A provider that has applied a standard in part cannot treat the route as a free choice; the unapplied part is what drives the mandatory route. The record should show the assessment for each condition separately, so that a reviewer can see which condition, if any, triggered Annex VII.
For the broader regulatory framework, see Conformity assessment and CE marking overview.
How does the Annex III points 2 to 8 route work?
For high-risk systems in Annex III points 2 to 8, covering areas such as critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and administration of justice and democratic processes, providers follow the conformity assessment procedure based on internal control under Annex VI, which does not provide for the involvement of a notified body. Internal control does not mean a lighter check: the provider must verify that the quality management system complies with Article 17, examine the technical documentation, and verify that design, development and post-market monitoring are consistent with the documentation. The provider carries full responsibility for the assessment, and the file must be capable of withstanding scrutiny by a market surveillance authority without a notified body's certificate to rely on. The internal assessment should be carried out by people with the competence and independence to challenge the file.
How does the Annex I route work?
For high-risk systems covered by Article 6(1), where the AI system is a safety component of a product or is itself a product under the Union harmonisation legislation in Annex I Section A and third-party conformity assessment is required under that legislation, the provider follows the conformity assessment procedure of that legislation. The Section 2 requirements and the quality management assessment under Article 17 are incorporated into that procedure, and the notified body already notified under the relevant legislation may assess compliance where it meets the conditions in Article 43. The provider should identify the relevant product legislation, the procedure it prescribes, and the notified body where one is involved, and should record how the AI Act requirements were assessed within that procedure. A provider should not run two disconnected assessments, one for the product legislation and one for the AI Act, without a single file that shows how both were met.
What about Annex I Section B and other cases?
The Act makes distinct provision for products under Annex I Section B and for other cases where the product legislation provides a different conformity route, and Regulation (EU) 2026/1744 amended aspects of the scope provisions. Providers should check the consolidated Article 43 and Article 6 wording for the product in question, including any limitation of Articles 9 to 15 and 17 to 25 that the Commission may set by delegated act for Article 6(1) systems. The route record should state the section relied on, the legislation applied, and the current consolidated wording checked. Where the route is unclear because the product sits at the boundary between sections, the provider should seek qualified review before choosing a procedure, because the wrong route can invalidate the declaration and marking that follow.
Continue with Internal control under Annex VI.
What does this guide not decide?
This guide does not decide which Article 43 route applies to a particular system, whether a standard has been applied in full, whether a notified body is required, or whether an assessment has been passed. It does not interpret Annex I or Annex III for a specific product or use case. Those questions depend on the classification, the standards and specifications applied, the product legislation, and the consolidated legal text. A provider should confirm its route with a competent authority, a notified body where involved, or a legal adviser, and should record the route decision with its basis before starting the assessment.
Frequently asked questions
Can a point 1 provider always choose internal control?
No. The choice between Annex VI and Annex VII exists only where harmonised standards or common specifications have been applied as Article 43 provides. Where the mandatory Annex VII conditions are met, the notified-body route must be followed, and the provider should record which condition applies.
Do points 2 to 8 systems ever need a notified body under Article 43?
Under Article 43(2), providers of Annex III points 2 to 8 systems follow internal control under Annex VI, which does not provide for notified-body involvement. That position should be checked against the consolidated text for the system, and other legislation may still require third-party assessment for the product as a whole.
What if a system is both Annex I and Annex III?
Record both routes, identify which procedure governs, and check the consolidated Articles 6 and 43 for how the routes interact for that system. Do not assume one route covers the other without a recorded basis, and seek qualified review where the interaction is unclear.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗