Which AI systems require a conformity assessment, and when a notified body is involved

Where this starts

The provider's product matches an Annex III use case, for example recruitment screening under point 4, credit scoring under point 5(b), education admission under point 3 or emergency-service triage under point 5(d), and the question from engineering is whether a notified body has to be involved or whether the provider can assess itself. Art. 3(20) of Regulation (EU) 2024/1689 defines conformity assessment as the process of demonstrating whether the requirements of Chapter III Section 2 have been fulfilled for a high-risk AI system, and Art. 16(f) requires the provider to have the system undergo the Art. 43 procedure before placing it on the market or putting it into service. Under Art. 43(2), a system in Annex III points 2 to 8 follows the internal control procedure of Annex VI: the provider verifies that its quality management system meets Art. 17 (Annex VI point 2), examines the technical documentation under Art. 11 and Annex IV against each Section 2 requirement (Annex VI point 3), and verifies that the design and development process and the post-market monitoring under Art. 72 match that documentation (Annex VI point 4). No notified body takes part. The provider then draws up the EU declaration of conformity under Art. 47, affixes the CE marking under Art. 48 and registers the system under Art. 49. Under Art. 21(1), the provider gives the internal file behind those three acts to a competent authority on reasoned request.

Under Art. 43(1), a system in Annex III point 1, that is remote biometric identification, biometric categorisation or emotion recognition, may choose between Annex VI and Annex VII only where the provider has applied in full a harmonised standard, of which none is cited in the Official Journal as of the anchor date, or a common specification under Art. 41. Where no harmonised standard exists, or the provider applied one only in part, and no common specification is available, Annex VII applies. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity under Art. 40(1) is available and an Annex III point 1 system follows Annex VII: a notified body assesses the quality management system against Art. 17 (Annex VII section 3) and the technical documentation against Section 2 (Annex VII section 4), with access to the training, validation and testing data sets (point 4.3) and, where other means are exhausted, to the trained model (point 4.5). Where such a system is put into service by a law enforcement, immigration or asylum authority or by a Union body, the market surveillance authority acts as the notified body. Under Art. 43(3), a system that is a product or safety component under Annex I Section A, for example a medical device or a machine, follows the conformity assessment procedure of its sectoral legislation; the Section 2 requirements are assessed inside that procedure, Annex VII points 4.3 to 4.5 apply, and the sectoral notified body may cover the AI requirements when it meets the Art. 31 conditions named in Art. 43(3). The Annex I obligations apply from a separate date 2028-08-02Deferred.

For an organisation with many AI use cases, the route depends on the role per system. A deployer has no Art. 43 duty; the assessment belongs to the provider, and the deployer's evidence is the provider's EU declaration of conformity under Art. 47, the CE marking under Art. 48 and the registration under Art. 49. Art. 25(1) turns a deployer or distributor into a provider when it places its name or trademark on a high-risk system, makes a substantial modification to one, or changes the intended purpose of a system so that it becomes high-risk; the Art. 43 route then applies to that organisation. A system whose Annex III match is removed by one of the four Art. 6(3) conditions has no Art. 43 route; the provider documents that assessment under Art. 6(4), and PR-CLS v1.0 records the condition, the profiling check and the documentation on the PR-CLS page, which also carries both readings of the registration point that follows. Regulation (EU) 2026/1744 moved the Annex III and Annex I application dates and, in the words of the regulation record, "Obligations are unchanged in content"; the route rules in Art. 43 and the Annex VI and Annex VII points read the same after the Omnibus.

The sequence

The work runs from the classification to the route, then through the two documents the route assesses, to the dry run and the three acts that follow a positive result.

1. Classify the system as Annex I Section A or Annex III high-risk, and test each Art. 6(3) condition.

   Record High-risk classification record naming the Annex III point or the Annex I Section A entry, with the Art. 6(3) condition record where one is claimed

   [PR-CLS steps 12 to 16]

2. Select the route: Annex VI, Annex VII, or the Annex I sectoral procedure with Annex VII points 4.3 to 4.5.

   Record Route selection record (Art. 43(1) to 43(3))

   [Art. 43(1) to 43(3)]

3. Record which harmonised standards or common specifications the provider applied, in full or in part.

   Record Standards-applied statement; it records that no harmonised standard is cited in the Official Journal

   [Art. 43(1) and Art. 40(1)]

4. Check the written quality management system against each aspect of Art. 17(1), and mark each present or absent.

   Record QMS gap analysis report (PR-17-QMS output)

   [Art. 17(1)(a) to (m); Annex VI point 2; Annex VII point 3.2]

5. Check the technical documentation against Annex IV sections 1 to 9, and compare declared values with test reports.

   Record Annex IV gap and consistency report (PR-11-DOC output)

   [Art. 11(1) and Annex IV; Annex VI point 3; Annex VII point 4.2]

6. Run the selected route as a dry run, re-run sampled tests, and record each gap with its annex point.

   Record Findings register and evidence-pack index (PR-43-MOCK output)

   [PR-43-MOCK steps 11 to 31]

7. Draft the EU declaration of conformity with each Annex V element, and state where the CE marking is affixed.

   Record EU declaration of conformity presence checklist (Art. 47 and Annex V); CE marking plan check

   [Art. 47 with Annex V; Art. 48]

8. Prepare the EU database registration with the Annex VIII Section A data before placing on the market.

   Record Registration readiness checklist (Art. 49 and Annex VIII Section A)

   [Art. 49(1) and Annex VIII Section A]

9. Classify each later change as pre-determined, other or substantial, and record the route a substantial one reopens.

   Record Modification register (Art. 43(4))

   [Art. 43(4); PR-43-MOCK steps 30 and 31]

The provider signs the declaration, affixes the marking and submits the registration. The steps above check presence and content only; the dry run in step 6 issues no certificate and takes no notified body role.

Evidence this situation ends with

Each artifact type is specified with a synthetic sample on the deliverables page: the route selection record and the dry-run review follow the assessment memo specification, the findings register follows the findings register specification, and the evidence-pack index follows the evidence pack specification. The two provider-produced artifacts are the inputs of the route; the PR-43-MOCK page lists the formats it reads them in.

If nothing is done

A high-risk AI system placed on the market without the Art. 43 procedure breaches the provider obligation in Art. 16(f). Under Art. 83(1), a missing EU declaration of conformity, a missing CE marking or a missing registration is formal non-compliance, and the market surveillance authority requires the provider to end it within a period it may set; under Art. 83(2), where it persists, the authority restricts or prohibits the system on the market or has it withdrawn or recalled. Under Art. 79(2), a system that presents a risk and is found not to meet the requirements of the Regulation draws corrective action, withdrawal or recall within a period the authority sets. Art. 99(4) sets administrative fines for non-compliance with the provider obligations in Art. 16, and Art. 43(4) adds that a substantial modification after an assessment starts a new one, so a retrained model released without a modification record puts an unassessed version on the market. The action on the provider's side is the sequence above: select the route under Art. 43(1) to 43(3), close each finding in the register, draft the declaration and prepare the registration before placing on the market, and classify each later change under Art. 43(4) before release.

Services, guides and tools for this situation

The pre-conformity mock assessment runs the selected route as a dry run under PR-43-MOCK v1.0, with a findings register, an evidence-pack index and a remediation plan; the dry run issues no certificate, signs no declaration and takes no notified body role, as stated on what we cannot do. The classifier records the Art. 6 route and the Annex III point client-side, and the Annex III provider hub lists the obligation set with its dates.

Obligations

• Art. 17
• Art. 11

Services

• Pre-conformity mock assessment

Guides

• Internal control vs third-party conformity assessment: Annex VI and Annex VII

Tools

• Risk and role classifier

ICP hubs

• Annex III providers
• Enterprises

Questions

+−What is conformity assessment?

Art. 3(20) of Regulation (EU) 2024/1689 defines conformity assessment as the process of demonstrating whether the requirements set out in Chapter III Section 2 for a high-risk AI system have been fulfilled. The term is the one Union product legislation uses, where a manufacturer or a notified body checks a product against essential requirements before CE marking. Under the AI Act, Art. 43 names the procedure, Annex VI and Annex VII set the steps, and Art. 47 and Art. 48 set the declaration and the marking that follow.

+−What is an AI conformity assessment under the EU AI Act?

An AI conformity assessment under Regulation (EU) 2024/1689 is the Art. 43 procedure a provider of a high-risk AI system completes before placing the system on the market, as Art. 16(f) requires. Its object is the quality management system under Art. 17 and the technical documentation under Art. 11 and Annex IV, checked against each requirement of Chapter III Section 2. It ends with the EU declaration of conformity under Art. 47, the CE marking under Art. 48 and the registration under Art. 49.

+−What is the conformity assessment procedure under the AI Act?

Art. 43 sets three routes. Under Art. 43(2), an Annex III points 2 to 8 system follows internal control under Annex VI: the provider verifies its quality management system, examines its technical documentation and checks that the design process matches it, with no notified body. Under Art. 43(1), an Annex III point 1 biometric system follows Annex VII with a notified body while no harmonised standard is cited in the Official Journal. Under Art. 43(3), an Annex I Section A product follows its sectoral procedure.

+−What does self-assessment under the AI Act involve?

Self-assessment is the internal control procedure of Annex VI, which Art. 43(2) assigns to every Annex III points 2 to 8 system. The provider verifies that its quality management system meets Art. 17 (point 2), examines the technical documentation under Art. 11 and Annex IV against each Chapter III Section 2 requirement (point 3), and verifies that the design process and the post-market monitoring match that documentation (point 4). The provider then draws up the EU declaration of conformity under Art. 47 on its own responsibility.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com