How a mock assessment grades findings: the findings register and the Annex VI dry run
This post describes how PR-43-MOCK v1.0 grades what it finds in an Annex VI dry run. Annex VI of Regulation (EU) 2024/1689 gives the provider three verifications, and the protocol turns each into a binary check with a finding type, a severity and an article or annex reference. The findings register is the output. The obligations the register covers apply from the Annex III application date Deferred. A provider uses the register to order remediation before the Art. 43 conformity assessment.
The method
Annex VI point 1 defines internal control as the procedure based on points 2, 3 and 4. Under point 2 the provider verifies that the established quality management system meets the requirements of Art. 17. Under point 3 the provider examines the information in the technical documentation to assess whether the system meets the Chapter III Section 2 requirements. Under point 4 the provider verifies that the design and development process and the Art. 72 post-market monitoring are consistent with the technical documentation. Under Art. 43(2), a system in Annex III points 2 to 8 follows this route with no notified body. Step 10 of the protocol maps each annex point to the steps that check it; the route guide gives the crosswalk to Annex VII for the systems that Art. 43(1) and 43(3) send to a notified body or a sectoral procedure.
Each annex point has a binary criterion drawn from its text: the item is present or absent, the documented process matches the actual process or does not. Art. 43, Annex VI and Annex VII set no numeric threshold. The sampled re-tests of step 18 are the exception. Their pass criterion comes from the protocol named on the obligation page of the sampled record, and step 35 records the provider's declared threshold, its source and whether the result meets it. Art. 9(8) requires testing against prior defined metrics and probabilistic thresholds appropriate to the intended purpose, so a sampled test with no declared threshold is recorded as a blocking finding against Art. 9(8), because the result cannot be judged.
Grading takes two steps. Step 32 classifies each gap by type: missing evidence, inconsistent evidence, or a failed sampled test. Step 33 assigns a severity from the scale agreed with the provider in step 7, together with the article or annex point the finding concerns. The protocol defines three severities.
| Severity | Definition in the protocol |
|---|---|
blocking | An Annex VI or Annex VII point has no evidence, or a sampled test does not meet the provider's declared threshold |
major | Evidence exists and is inconsistent between two documents, or between a document and the system |
minor | Evidence exists and is complete; a form, version or traceability element is missing |
The scale is the protocol's own definition and has no source in the Act or in a standard, which is why step 7 agrees it before any evidence is read and why the register carries the definitions in its own scale section. The type and the annex point are linked. An inconsistency between two documents is a point 3 finding, because point 3 examines the technical documentation. An inconsistency between a document and the system as built or monitored is a point 4 finding, because point 4 is the consistency check. Missing evidence attaches to the point whose object is absent.
Step 34 marks each evidence-pack index entry present, partial or absent and links each gap to its finding. Step 36 writes the dry-run conclusion as conclusions and a reasoned assessment, the form Annex VII point 4.6 gives to a notified body's decision, without a certificate or a decision. A pre-conformity mock assessment is a dry run and not a conformity assessment under Art. 43; it produces no certificate, no EU declaration of conformity and no CE marking, and AIAssuranceLabs is not a notified body.
What the test produces
The findings register has one row per finding: id, finding, severity, article or annex reference, evidence, owner function, action, re-test criterion and status. The deliverable also carries the severity scale with definitions, a summary per article and per Annex VI or VII point, the remediation plan ordered by severity, and the re-test criteria that a follow-up run verifies, in XLSX, CSV and PDF summary formats. The rows below are synthetic; the values show the fields, not a result from any system.
id,finding,severity,reference,evidence,owner_function,action,re_test_criterion,status
F-01,"No examination, test and validation frequency is stated in the testing procedure",blocking,"Annex VI point 2; Art. 17(1)(d)",qms/procedures/testing.md,QMS owner,"State the frequency in the procedure and file one run record per stated interval","Procedure names a frequency and the sampled run records match it",open
F-02,"Declared accuracy metric name differs from the metric in the test report",major,"Annex VI point 3; Annex IV section 2(g); Art. 13(3)(b)(ii)","ifu/current.pdf accuracy section; tests/accuracy-report.pdf",test lead,"Align the metric name in the instructions for use with the test report","Same metric name and value in both documents for the same version",open
F-03,"Post-market monitoring plan names a data source the deployed system does not collect",major,"Annex VI point 4; Art. 72(1); Annex IV section 9","pmm/plan-v2.md; logging/schema.json",product owner,"Add the field to the log schema or remove the source from the plan","Every source named in the plan has a matching log field",open
F-04,"Signatory name and function field is empty in the declaration draft",minor,"Annex V, signatory element",declaration/draft.docx,management,"Complete the field","Field holds a name and a function",closed
Each reference names the annex point first and the article second, so the per-point summary in the register counts what stands against each of the three Annex VI verifications. F-01 sits under point 2: the Art. 17(1)(d) procedure exists without the frequency that paragraph asks for, a gap the Art. 17 obligation page lists among its common findings. F-02 sits under point 3: two documents disagree on a declared metric, and the Art. 11 record names the declared-metric-to-test-report consistency table as the artifact that closes it. F-03 sits under point 4: the Art. 72 plan and the deployed system diverge. F-04 is a form defect in the Annex V declaration draft, which the protocol checks for presence under Art. 47 without issuing or signing it.
The re-test criterion is the closing condition, and its form follows the finding type. For a failed sampled test the row names the declared threshold and the step range of the protocol that tests the sampled record, so the follow-up run repeats those steps only. For missing evidence the row names the artifact whose presence closes the row. For inconsistent evidence the row names the two locations that a follow-up run reads together. The mock assessment service delivers the register with the dry-run review report, the evidence-pack index with gaps marked, and the remediation plan ordered by severity and by the annex point each finding blocks.
What to do now
- Select the route under Art. 43 and record the reason: an Annex III points 2 to 8 system follows Annex VI under Art. 43(2); the route guide gives the decision sequence for the other cases.
- Agree the severity scale and the register layout before any evidence is read, as step 7 of PR-43-MOCK v1.0 does, and keep the definitions inside the register.
- Declare a threshold with its source for every test the technical documentation reports, since Art. 9(8) asks for prior defined metrics and a sampled test without one is graded blocking.
- Close blocking findings first, grouped by the Annex VI point each one blocks, then major, then minor; the remediation plan carries that order.
- Re-run the protocol steps named in the re-test criterion and record the result before a row's status changes to closed.
Related pages
The obligation pages, the protocol and the service below carry the elements, steps and deliverables this post refers to.
- Protocols
- Services
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.