Before placing a high-risk AI system on the market or putting it into service, a provider must complete classification, ensure compliance with the Chapter III Section 2 requirements, draw up technical documentation, operate a quality management system, carry out the conformity assessment procedure in Article 43, draw up the EU declaration of conformity in Article 47, affix CE marking in Article 48, and register the system in Article 49, where those provisions apply. The conformity route depends on the system: Annex I Section A products follow the product procedure, Annex III systems follow internal control or, where harmonised standards or common specifications are not fully applied or a notified body is required, the procedure involving a notified body. The route must be chosen before release, and the evidence must be ready before the declaration is signed.
What must be settled before the conformity route is chosen?
Classification, intended purpose, and the Annex I or Annex III route must be settled first, because they determine the conformity procedure. A product team that chooses a route before classification risks following the wrong procedure and producing the wrong evidence. The pre-market checklist should therefore start with the classification record, the intended purpose statement, the safety component analysis where relevant, and the Article 6(3) filter analysis where relied on. Only then should the team identify the conformity procedure, the standards or common specifications to be applied, and whether a notified body is involved. A route chosen on the basis of a draft classification should be marked as provisional and revisited when the classification is finalised.
What are the Article 43 conformity routes?
Article 43 provides for conformity assessment based on internal control, set out in Annex VI, and conformity assessment based on assessment of the quality management system and assessment of the technical documentation, with the involvement of a notified body, set out in Annex VII. For Annex III systems, the provider follows the internal control procedure where it has applied harmonised standards or common specifications in full, and follows the notified body procedure where it has not applied them, or has applied them only in part, or where the harmonised standards do not cover the relevant requirements. For Annex I Section A products, the procedure is the product procedure under Article 43(3). The provider must identify the route, the standards applied, and any gaps, and must record the reasoning, because the route determines who assesses conformity and what evidence is required.
For the broader regulatory framework, see provider responsibilities.
What must be ready before the declaration is signed?
Before the EU declaration of conformity is drawn up, the technical documentation must be complete, the testing and validation results must be available, the risk management and data governance evidence must be in place, the quality management system must be operating, and the post-market monitoring plan must be defined. The declaration states that the system complies with the Act, and it must be based on the conformity assessment, not on an intention to complete the work after release. The provider should run a pre-release review that checks each requirement against its evidence, with a named reviewer and a sign-off, and should hold the release where evidence is missing. A declaration signed on incomplete evidence creates a record that is difficult to correct later.
How do CE marking and registration follow?
CE marking under Article 48 must be affixed visibly, legibly and indelibly to the system, its packaging, or the accompanying documentation, as the article provides, and must be accompanied by the identification number of the notified body where one was involved. Registration under Article 49 requires the provider, or the authorised representative where mandated, to register the high-risk system in the EU database before placing it on the market or putting it into service, with the information Annex VIII requires, including the provider, the system, the intended purpose, and the conformity information. For Annex III systems where the Article 6(3) filter is relied on, registration under Article 49(2) also applies. Marking and registration should be checked as part of the release, not added after the system is supplied.
What pre-market checks should be documented?
A pre-market check record should list each requirement, the evidence, the reviewer, and the result, with open items clearly marked and owned. The record should cover classification, requirements in Articles 8 to 15, technical documentation, quality management, conformity route, declaration, marking, registration, instructions for use, logging, and post-market monitoring. The record should be retained as part of the conformity file, and should be available to a notified body and to an authority on request. A release decision that is not documented, or that is documented only as a meeting note, is weaker than a check record that shows each item was tested and who tested it.
Continue with Article 16 provider duties.
What is not decided by this guide?
This guide explains the pre-market sequence and the conformity routes in outline. It does not choose a route for a specific system, does not decide whether harmonised standards have been applied in full, and does not determine whether a notified body is required. Those questions need the classification, the standards and specifications applied, and the conformity procedure for the specific system, read against Articles 43 to 49 in the consolidated text and confirmed with a notified body where one is involved and with a competent authority or legal adviser where the route is uncertain.
Frequently asked questions
Can a provider choose internal control for any Annex III system?
No. Internal control under Annex VI is available where harmonised standards or common specifications covering the relevant requirements have been applied in full. Where they have not been applied, or only in part, or do not cover the requirements, the notified body procedure in Annex VII applies.
Must registration happen before supply?
Yes, in the circumstances Article 49 sets. The provider, or the authorised representative where mandated, must register the high-risk system in the EU database before placing it on the market or putting it into service, with the Annex VIII information.
Does CE marking prove AI Act compliance?
CE marking indicates that the conformity assessment has been carried out and the declaration drawn up, in the circumstances the Act sets. It is the outcome of the conformity work, not a substitute for it, and the underlying evidence must support it.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗