Internal control vs third-party conformity assessment: Annex VI and Annex VII

What the obligation asks for

Art. 16(f) of Regulation (EU) 2024/1689 requires the provider of a high-risk AI system to have the system undergo the conformity assessment procedure of Art. 43 before placing it on the market or putting it into service. Art. 43 assigns one of two procedures. Annex VI is internal control: the provider verifies that its established quality management system meets Art. 17 (point 2), examines the technical documentation to assess conformity with Chapter III Section 2 (point 3), and verifies that the design and development process and the post-market monitoring under Art. 72 are consistent with that documentation (point 4). Annex VII is assessment by a notified body: the notified body assesses the quality management system against Art. 17 with a reasoned decision (points 3.1 to 3.4), examines the technical documentation with access to the data sets and, where other means are exhausted, to the trained model (points 4.1 to 4.7), issues a Union technical documentation assessment certificate after a positive decision (point 4.6), and keeps the approved quality management system under surveillance through periodic audits (points 5.1 to 5.3). Under Art. 43(2), a system in Annex III points 2 to 8 follows Annex VI with no notified body. Under Art. 43(1), a system in Annex III point 1 may choose between the two only where the provider applied harmonised standards, of which none is cited in the Official Journal, under Art. 40 or common specifications under Art. 41; where no harmonised standard exists and no common specification is available, or the provider applied one only in part, Annex VII applies. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity under Art. 40(1) exists and the Annex VII condition in Art. 43(1) is met for every Annex III point 1 system; the standards page tracks the count. Under Art. 43(3), a system covered by an Annex I Section A act follows the sectoral procedure, with the Section 2 requirements assessed inside it. The Annex III duty applies from the Annex III application date 2027-12-02Deferred and the Annex I duty from the Annex I date 2028-08-02Deferred; Regulation (EU) 2026/1744 moved those dates and left the obligations unchanged in content, as the regulation entry for each date records.

The guide covers the elements of the two obligation records that the route determines. From the Art. 17 record: the strategy for regulatory compliance names the conformity assessment procedure the provider follows and the procedure for the management of modifications (Art. 17(1)(a), documentation), and each released version has a modification record that states whether the change is a substantial modification and which conformity assessment step follows (Art. 17(1)(a), testable by record sampling). From the Art. 11 record: each entry in the standards and specifications list maps to the requirement it addresses, and each Section 2 requirement without an applied harmonised standard maps to a described solution (Annex IV section 7, testable), and the copy of the EU declaration of conformity names the same system, version and provider as the general description (Annex IV section 8, testable). The quality management system check on either route uses the Art. 17(1) list as its checklist; prEN 18286Published, published and not cited in the Official Journal, supplies the clause structure, and ISO/IEC 42001:2023Published, published and not cited in the Official Journal, supplies the management-system structure at the next hierarchy level. Both are evidence sources; neither is a harmonised standard and none is cited in the Official Journal, so neither opens the Annex VI option of Art. 43(1).

Inputs

The inputs are the subset of the PR-43-MOCK v1.0 input table that the route-selection steps and the crosswalk use. The full table is on the protocol page.

• The classification memo naming the Art. 6 basis and the Annex III point or the Annex I Section A entry, from PR-CLS v1.0 where one exists.
• The standards-applied statement: each harmonised standard, common specification, draft standard or other specification the provider applied, and whether in full or in part.
• The quality management system documentation under Art. 17(1), with a version identifier per document.
• The technical documentation under Art. 11 and Annex IV, with a version identifier per document.
• The draft EU declaration of conformity in the Annex V structure, where drawn up.
• The CE marking plan: where and how the marking is affixed, physically or through the interface.
• The registration record or draft with the Annex VIII Section A data.
• The change and release records since the last assessment or since first release, with a change classification per entry.
• For a system related to an Annex I Section A product: the sectoral conformity assessment procedure the manufacturer follows and the notified body's notification scope under that act.
• A shell with python and the PyYAML parser installed.

Procedure

The procedure is a decision sequence. Each step names the article or annex point it derives from and the protocol step it corresponds to, and the record it produces. The mapping table and the code blocks follow the steps they belong to. Every system name, point, path and value in the examples is synthetic.

1. Record the classification basis from the classification memo: the Annex III point, or the Annex I Section A entry.

   Record classification reference: Art. 6 basis, Annex III point or Annex I Section A entry, with the PR-CLS output where one exists

   [Regulation (EU) 2024/1689, Art. 6(1) and 6(2); PR-43-MOCK step 2]

2. Record each standard and common specification the provider applied, in full or in part, and the Official Journal citation count.

   Record standards-applied statement: each document applied, in full or in part, its stage, and the Official Journal citation count, which is zero as of the anchor date

   [Regulation (EU) 2024/1689, Art. 40(1) and Art. 41; PR-43-MOCK step 3]

3. For an Annex I Section A system, select the sectoral procedure and mark the Annex VII points inside it.

   Record sectoral procedure reference with Annex VII points 4.3, 4.4, 4.5 and the fifth paragraph of 4.6 marked

   [Regulation (EU) 2024/1689, Art. 43(3); PR-43-MOCK steps 4 and 5]

4. For an Annex III point 1 system, select Annex VII. Record the Art. 43(1) choice only where a common specification was applied in full; no harmonised standard is cited.

   Record route selection record for an Annex III point 1 system: Annex VII, or the provider's choice with its condition

   [Regulation (EU) 2024/1689, Art. 43(1) first and second subparagraphs; PR-43-MOCK steps 3, 4 and 6]

5. For an Annex III points 2 to 8 system, select Annex VI.

   Record route selection record for an Annex III points 2 to 8 system: Annex VI

   [Regulation (EU) 2024/1689, Art. 43(2); PR-43-MOCK step 4]

6. Where Art. 43(1) allows a choice, record the provider's reason for Annex VI or Annex VII. Otherwise record that no choice exists.

   Record route rationale, or the statement that no choice exists

   [Regulation (EU) 2024/1689, Art. 43(1)(a) and (b); PR-43-MOCK step 6]

7. Map each point of the selected annex to its counterpart in the other annex. Name the examining party on each side.

   Record coverage map: each Annex VI point matched to its Annex VII counterpart, with the examining party on each side

   [Regulation (EU) 2024/1689, Annex VI points 1 to 4 and Annex VII points 1 to 5; PR-43-MOCK step 10]

8. Check that the strategy for regulatory compliance names the selected route. Check that the quality management system documentation covers each aspect of Art. 17(1).

   Record QMS coverage table with the conformity assessment procedure named in the strategy for regulatory compliance

   [Regulation (EU) 2024/1689, Art. 17(1)(a); Annex VI point 2; Annex VII point 3.2; PR-43-MOCK step 11]

9. Check that the technical documentation is complete against Annex IV and that its section 7 list matches the standards-applied statement.

   Record Annex IV completeness index with the section 7 standards list checked against the standards-applied statement

   [Regulation (EU) 2024/1689, Annex IV section 7; Annex VI point 3; Annex VII point 4.2; PR-43-MOCK step 15]

10. Record the acts that follow the route: the EU declaration of conformity, the CE marking plan and the registration record.

    Record declaration presence checklist, CE marking plan check with the notified body number field on the Annex VII route, and registration readiness checklist

    [Regulation (EU) 2024/1689, Art. 47 with Annex V, Art. 48(2) to 48(4), Art. 49(1) and 49(5) with Annex VIII Section A; PR-43-MOCK steps 24 to 27]

11. Classify each change since the last assessment and, for a substantial modification, run the sequence from step 1 again.

    Record modification register with each change classified as pre-determined, other or substantial, and the route that applies again

    [Regulation (EU) 2024/1689, Art. 43(4) and Art. 3(23); Annex IV section 2(f); PR-43-MOCK steps 30 and 31]

Example for step 7. The table maps each object of the assessment to the annex point that covers it on each route and names the examining party. Every cell carries its own reference; the "Annex VI" column is what the provider does, and the "Annex VII" column is what the notified body does with the provider's application.

Example for steps 3 to 7. The file below encodes the route rules of Art. 43(1) to 43(3) and the crosswalk of the table as data, so that the route selection record and the coverage map are produced from one source. The rule order matters: the Annex I Section A rule is evaluated first, because Art. 43(3) sends a system that is both covered by an Annex I Section A act and listed in Annex III to the sectoral procedure. The ojeu_cited_harmonised_standards value is copied from the standards page at the time the record is written; the system name and the classification are synthetic.

# Synthetic example: art-43-crosswalk.yaml for demo-screening 1.3.0
system: demo-screening
version: "1.3.0"
classification:
  basis: art-6-2                     # art-6-1 (Annex I Section A) | art-6-2 (Annex III)
  annex_iii_point: 4                 # 1 to 8, or null for an Annex I Section A system
  annex_i_section_a_act: null        # for example "Regulation (EU) 2017/745"
standards_applied:
  ojeu_cited_harmonised_standards: 0 # copied from /standards/ at the time of writing
  harmonised_applied_in_full: false  # cannot be true while the count above is 0
  common_specification_applied: false
route_rules:                         # evaluated in order; the first match wins
  - id: annex-i-section-a
    when: classification.basis == "art-6-1"
    route: sectoral-procedure
    cite: "Art. 43(3)"
    annex_vii_points_inside: ["4.3", "4.4", "4.5", "4.6 fifth paragraph"]
  - id: annex-iii-point-1-choice
    when: classification.annex_iii_point == 1 and (standards_applied.harmonised_applied_in_full or standards_applied.common_specification_applied)
    route: provider-choice
    options: [annex-vi, annex-vii]
    cite: "Art. 43(1) first subparagraph, points (a) and (b)"
  - id: annex-iii-point-1-default
    when: classification.annex_iii_point == 1
    route: annex-vii
    cite: "Art. 43(1) second subparagraph, points (a) to (d)"
  - id: annex-iii-points-2-to-8
    when: classification.annex_iii_point in [2, 3, 4, 5, 6, 7, 8]
    route: annex-vi
    cite: "Art. 43(2)"
crosswalk:
  - object: quality management system under Art. 17
    annex_vi: ["2"]
    annex_vii: ["3.1", "3.2", "3.3", "3.4"]
  - object: technical documentation under Art. 11 and Annex IV
    annex_vi: ["3"]
    annex_vii: ["4.1", "4.2", "4.3", "4.4", "4.5", "4.6", "4.7"]
  - object: consistency of the process and the post-market monitoring with the documentation
    annex_vi: ["4"]
    annex_vii: ["5.1", "5.2", "5.3"]
acts_after_route:
  annex-vi: ["Art. 47 declaration with Annex V content", "Art. 48(1) to 48(3) CE marking without a notified body number", "Art. 49(1) registration, or Art. 49(5) national registration for an Annex III point 2 system"]
  annex-vii: ["Annex VII point 4.6 certificate", "Art. 47 declaration with Annex V content naming the notified body", "Art. 48(4) CE marking followed by the notified body identification number", "Art. 49(1) registration"]
  sectoral-procedure: ["the acts of the Annex I Section A act", "Art. 47(3) single declaration where that act also requires one", "Art. 49(1) registration"]

Example for steps 4 to 6 and 10. The script loads the file, applies the Art. 43 rules in the order of route_rules, refuses a record that claims a harmonised standard applied in full while none is cited in the Official Journal, and prints the route, the article that assigns it and the acts that follow. It exits with code 1 when no rule matches, which is the case for a system with no high-risk classification, so that the route selection record is never written for a system that PR-CLS v1.0 has not classified. It needs the PyYAML parser.

# Synthetic example: select the Art. 43 route from art-43-crosswalk.yaml.
import sys
import yaml

with open("art-43-crosswalk.yaml", encoding="utf-8") as f:
    rec = yaml.safe_load(f)

cls = rec["classification"]
std = rec["standards_applied"]

if std["harmonised_applied_in_full"] and std["ojeu_cited_harmonised_standards"] == 0:
    print("FAIL harmonised_applied_in_full is true while no harmonised standard is cited in the Official Journal")
    sys.exit(1)

def select_route():
    if cls["basis"] == "art-6-1":
        return "sectoral-procedure", "Art. 43(3)"
    point = cls.get("annex_iii_point")
    if point == 1:
        if std["harmonised_applied_in_full"] or std["common_specification_applied"]:
            return "provider-choice", "Art. 43(1) first subparagraph, points (a) and (b)"
        return "annex-vii", "Art. 43(1) second subparagraph, points (a) to (d)"
    if point in range(2, 9):
        return "annex-vi", "Art. 43(2)"
    return None, None

route, cite = select_route()
if route is None:
    print("FAIL no Art. 43 rule matches; the classification memo names no Annex III point or Annex I Section A act")
    sys.exit(1)

print("system   %s %s" % (rec["system"], rec["version"]))
print("route    %s" % route)
print("cite     %s" % cite)
if route == "provider-choice":
    print("options  annex-vi, annex-vii; record the rationale (PR-43-MOCK step 6)")
for act in rec["acts_after_route"].get(route, []):
    print("follows  %s" % act)

On the synthetic record above the script prints route annex-vi, cite Art. 43(2) and the three acts of the Annex VI list, because the classification is Annex III point 4. Changing annex_iii_point to 1 prints route annex-vii and cite Art. 43(1) second subparagraph, points (a) to (d), and setting harmonised_applied_in_full to true without changing the Official Journal count makes the script fail. Every output is a result of this example, never a requirement of the Act.

A pitfall that vendor documentation omits

Conformity tooling labels Annex VI "self-assessment" and Annex VII "third-party assessment", and the label leads to the first confusion: reading Annex VI as a lighter set of requirements. The objects are the same on both sides of the crosswalk. Annex VI point 2 and Annex VII point 3.2 both examine the quality management system against Art. 17(1)(a) to (m); Annex VI point 3 and Annex VII point 4.2 both examine the technical documentation against each requirement of Chapter III Section 2; Art. 47(4) states that by drawing up the EU declaration of conformity the provider assumes responsibility for conformity with the Section 2 requirements, on either route. What differs is who examines the evidence and what can be demanded: under Annex VII point 4.3 the notified body has full access to the data sets, under point 4.4 it can run its own tests, and under point 5.3 it audits the approved quality management system periodically; under Annex VI the provider gives the same documentation to a competent authority on reasoned request under Art. 21(1). The Art. 17 record names the finding this produces: the strategy for regulatory compliance under Art. 17(1)(a) names "self-assessment" without an annex, and the modification management procedure has no rule for deciding whether a change is a substantial modification, so the Art. 43(4) re-assessment in the strategy is never triggered.

The second confusion concerns Annex III point 1. Checklists present Annex VI as available to a biometric system "where harmonised standards are applied". The first subparagraph of Art. 43(1) opens the choice only where the provider has applied harmonised standards within the meaning of Art. 40, and Art. 40(1) covers harmonised standards whose references are published in the Official Journal, of which none is cited as of the anchor date. Point (a) of the second subparagraph therefore applies and the route for every Annex III point 1 system is Annex VII. A standard applied in full without an Official Journal citation, for example prEN 18286Published, published and not cited in the Official Journal, is evidence in the technical documentation under Annex IV section 7 and does not open the Annex VI option. The third confusion concerns the Annex I Section A manufacturer, whose tooling asks for an "AI Act notified body". Art. 43(3) applies the sectoral conformity assessment procedure, assesses the Section 2 requirements inside it, and applies only Annex VII points 4.3, 4.4, 4.5 and the fifth paragraph of point 4.6 rather than the whole annex; the notified body under the sectoral act may assess the Section 2 requirements where its conformity with Art. 31(4), (5), (10) and (11) was assessed during its notification, and where the sectoral act offers a route without a third party on condition that all harmonised standards were applied, the manufacturer may use it only if harmonised standards or common specifications covering all Section 2 requirements were also applied, and none is cited in the Official Journal as of the anchor date. Regulation (EU) 2026/1744 amended Art. 43(3), including the rule that a system both covered by an Annex I Section A act and listed in Annex III follows the sectoral procedure; the reader checks the consolidated text on EUR-Lex for the wording in force. On the CE marking, Art. 48(4) attaches the notified body's identification number to the marking only where Annex VII was followed; a marking plan for an Annex VI system that reserves a number field, or for an Annex VII system that omits it, is a finding against Art. 48.

Art. 43, Annex VI and Annex VII set no numeric threshold. Each point has a binary criterion drawn from its text: the item is present or absent, the documented process matches the actual process or does not, the declaration holds each Annex V element or does not. For the sampled tests that PR-43-MOCK v1.0 re-runs on either route, the pass criterion comes from the protocol on the obligation page and follows the hierarchy on the standards page: no harmonised standard is cited in the Official Journal as of the anchor date; the JTC 21 drafts with their stage, then the ISO/IEC documents, then the Commission guidelines, then NIST AI RMF or a sector framework, then the provider's justified state of the art, recorded as Art. 9(8) requires for prior defined metrics and probabilistic thresholds.

What the result shows and what it does not

The route selection record, the crosswalk and the acts list show which procedure Art. 43 assigns to the classified system, which annex point covers each object of the assessment on that route, and which of the declaration, the marking plan and the registration record exist with the required content. They do not show that the quality management system meets Art. 17 or that the technical documentation demonstrates conformity with Section 2; those are the results of the annex points themselves, which PR-43-MOCK v1.0 runs as a dry run and which, on the Annex VII route, only a notified body can decide. The dry-run conclusion is not a certificate, not a Union technical documentation assessment certificate under Annex VII point 4.6, and not a decision that binds a notified body or a market surveillance authority. The result carries no presumption of conformity, because Art. 40(1) grants that presumption only for a harmonised standard cited in the Official Journal and none is cited as of the anchor date. The route rules can change: Art. 43(5) and 43(6) let the Commission amend Annexes VI and VII and move Annex III points 2 to 8 systems to the Annex VII procedure by delegated act, so the record states the regulation verification date it was written against. The result is evidence for the provider's own file; the decision on the route and on conformity remains with the provider, their notified body where one is required, and their counsel. The pre-conformity mock assessment service runs the selected route within the limits stated on what we cannot do and delivers the route selection record, the findings register and the evidence-pack index; every protocol on the site is on the methodology index.

Related pages

The obligations, the protocol, the related guide on assembling the Annex IV documentation that both annexes examine, and the hubs for the two roles this guide serves are listed below; the scenario on which systems need a conformity assessment gives the sequence for a provider who has not yet selected a route.

Obligations

• Art. 17
• Art. 11

Protocols

• PR-43-MOCK v1.0

Related guides

• Annex IV of the AI Act: assembling the technical documentation

ICP hubs

• Annex III providers
• Annex I manufacturers

Questions

+−What is the difference between internal and third-party conformity assessment?

Internal control under Annex VI is performed by the provider: the provider verifies that its quality management system meets Art. 17, examines its technical documentation against Chapter III Section 2, and checks that the design process matches the documentation. Third-party assessment under Annex VII puts the quality management system and the technical documentation before a notified body, which assesses both with access to the data sets, issues a certificate under point 4.6 and audits the approved system under point 5. Art. 43 assigns the route by Annex III point.

+−What is Annex VI of the AI Act?

Annex VI of Regulation (EU) 2024/1689 is the conformity assessment procedure based on internal control, with no notified body. Point 2 requires the provider to verify that its established quality management system meets Art. 17. Point 3 requires the provider to examine the technical documentation against Chapter III Section 2. Point 4 requires the provider to verify that the design and development process and the Art. 72 post-market monitoring are consistent with that documentation. Art. 43(2) assigns Annex VI to every Annex III points 2 to 8 system.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com