Under Annex VI, the provider itself carries out conformity assessment by verifying that its quality management system complies with Article 17, examining the technical documentation to assess compliance with the Section 2 requirements, and verifying that the design and development process and post-market monitoring are consistent with the technical documentation. The provider then draws up the EU declaration of conformity and affixes the CE marking, carrying full responsibility for the assessment.
What must be verified about the quality management system?
Annex VI requires verification that the quality management system complies with Article 17. That verification should check that the system covers the lifecycle processes the Act requires, including design and development control, data management, risk management, testing, documentation control, change control, and post-market monitoring, in a form proportionate to the provider and the system. The check should be evidence-based: procedures should be examined, records should be sampled, and gaps should be recorded with corrective actions. A quality manual that describes a system that is not operated in practice will not pass verification. The verification should be carried out by people who were not solely responsible for operating the system they are checking, so that the assessment has a degree of independence within the provider.
How is technical documentation examined?
Examination of the technical documentation under Annex VI should test whether the file demonstrates compliance with the Section 2 requirements for the system as designed and tested. The examiner should follow the evidence chain from intended purpose and classification through risk management, data governance, logging, deployer information, oversight design and performance testing, checking that each claim is supported by a document, a result, or a decision. Gaps, inconsistencies, and outdated versions should be recorded and resolved before the assessment is concluded. The examination should also check that the documentation matches the system version to be placed on the market, including any model, data or software version that affects compliance. A documentation file that describes a different version from the one to be supplied cannot support the assessment.
For the broader regulatory framework, see Conformity assessment and CE marking overview.
What consistency checks are required?
Annex VI requires verification that the design and development process and the post-market monitoring system are consistent with the technical documentation. That means checking that the process actually followed matches the process described, that the monitoring plan described is the plan that will be operated, and that the records produced by the process match the file. The check should sample development records, test records, change records and monitoring records, and should trace a sample of entries from the process through to the documentation. Inconsistencies should be treated as findings, with a decision on whether they affect the conformity conclusion. A process that is described correctly but operated differently, or operated correctly but described incorrectly, both break the consistency the annex requires.
Who should carry out internal control?
Internal control should be carried out by people with the competence to assess the system, the documentation and the quality system, and with enough independence from the development team to challenge the file. The provider should name the assessors, record their competence, and record any conflict of interest and how it was managed. The assessment should be planned, with a scope, a timetable, and a record of the checks carried out and the findings made. The conclusion should be recorded as a dated decision, with the evidence relied on and any conditions or corrective actions. An assessment carried out by the same person who built the system, without independent challenge, will be difficult to defend if a market surveillance authority later examines the file.
What follows a successful internal control assessment?
After a successful assessment, the provider draws up the EU declaration of conformity, affixes the CE marking, and registers the system where Article 49 requires it, in the sequence the Act provides. The assessment record, the documentation version assessed, and the declaration should be kept together, with retention for the period the Act sets. If the assessment identifies findings that must be corrected before placement, the corrections should be made and, where they affect compliance, re-examined before the declaration is drawn up. The provider should not draw up a declaration while a material finding remains open, and should not treat a planned correction as if it had already been made. The declaration is issued under the provider's sole responsibility, and the assessment record is the evidence that supports it.
Continue with Conformity assessment routes under Article 43.
What does this guide not decide?
This guide does not decide whether a particular internal control assessment has been passed, whether a quality management system complies with Article 17, or whether a documentation file demonstrates compliance. It does not assess an assessor's competence or a finding's severity. Those questions depend on the system, the file, the process records, and the consolidated legal text. A provider should have its internal control assessment reviewed independently where the risk picture is significant, keep the assessment record with the declaration, and confirm the position with a competent authority or legal adviser where contested.
Frequently asked questions
Is internal control less rigorous than notified-body assessment?
No. Internal control requires the same substantive check of the quality system, documentation and process consistency, carried out by the provider with full responsibility for the conclusion. The absence of a notified body does not reduce the evidence required, and the file must withstand market surveillance scrutiny.
Can the development team assess its own system?
The assessment should have independence from development, with assessors who can challenge the file. The provider should name assessors, record competence and manage conflicts, and should not rely solely on the team that built the system to assess its own work without independent challenge.
What must be kept after internal control?
Keep the assessment record, the documentation version assessed, the declaration of conformity, and related records for the period the Act sets, in a retrievable form. The record should show the checks carried out, the findings, the decisions, and the sequence leading to declaration, marking and registration.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗