What is conformity assessment under the EU AI Act?

The procedure by which a provider demonstrates that a high-risk AI system meets the Chapter III requirements before it goes on the market. Article 43 sets two routes: assessment based on internal control under Annex VI, which the provider carries out itself, and assessment involving a notified body under Annex VII.

When must conformity assessment be complete?

Before the system is placed on the market or put into service, and by the applicable application date: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-safety systems, both as deferred by Regulation (EU) 2026/1744.

What is the difference between Annex VI and Annex VII?

Annex VI is the internal control procedure: the provider verifies its own quality management system, examines its technical documentation, and checks that its design, development and post-market monitoring are consistent with that documentation. Annex VII adds a notified body, which assesses the quality management system and the technical documentation and then conducts ongoing surveillance of the approved system.

What happens after conformity assessment?

Three steps. The provider draws up the EU declaration of conformity under Article 47 and keeps it for 10 years. It affixes CE marking under Article 48, with the notified body's identification number alongside where one was involved. And it registers the system in the EU database under Article 49 before placing it on the market.

Does applying a harmonised standard guarantee compliance?

It creates a presumption of conformity with the requirements the standard covers, under Article 40. That presumption is the practical benefit: it is what allows a biometric system to take the internal control route rather than requiring a notified body, and it shifts the evidential burden in your favour.

Does a system need reassessment after changes?

Yes, where the change is substantial. A substantial modification requires a fresh conformity assessment. Changes the provider pre-determined and documented in the original technical documentation, including for systems that continue to learn, do not by themselves count as substantial modifications.

EU AI Act Conformity Assessment: Which Route Applies to You

Key takeaways

Two routes under Article 43: internal control (Annex VI) and notified body (Annex VII). The Regulation decides which applies: the provider does not choose.
Most Annex III systems self-assess. The notified body route is for Annex III point 1 biometrics without harmonised standards, and for Annex I products through their existing sectoral route.
Harmonised standards are the lever. Applying one creates a presumption of conformity under Article 40, and for biometrics it is what keeps you out of the notified body route.
Assessment is not the end: declaration of conformity, CE marking and EU database registration all follow before you can place the system on the market.
The deadline is 2 December 2027 for Annex III and 2 August 2028 for Annex I, and every provider in the market is working to the same date.

CorrectionsThis page replaces /key-issue/2, which was written against the 2021 Commission proposal. Where that page and the adopted Regulation disagree:

Said

For stand-alone high-risk AI systems, only an industry self-assessment will be required.

Actually

Not quite. Annex III point 1 biometric systems can require a notified body under Annex VII where the provider has not applied harmonised standards, or where none exist. Internal control is the norm for the other Annex III areas, not for all of them.

Article 43(2) · Annex VI

Assessment based on internal control

The provider, on its own, with no notified body involved.

Applies to

Most Annex III high-risk systems: employment, education, essential services including credit and insurance, law enforcement, migration, and justice.

What it involves

Verify the quality management system conforms to Article 17
Examine the technical documentation against the Chapter III requirements
Verify the design and development process, and the post-market monitoring plan, are consistent with that documentation

Article 43(1) · Annex VII

Assessment involving a notified body

A third-party notified body designated by a Member State.

Applies to

Annex III point 1 biometric systems where the provider has not applied harmonised standards or common specifications, or where those do not exist. Also the route Annex I products already use under their own sectoral legislation.

What it involves

Assessment of the quality management system by the notified body
Assessment of the technical documentation by the notified body
Ongoing surveillance of the approved quality management system

Which route applies is set by the Regulation, not chosen by the provider. Internal control is the norm for most Annex III areas; biometrics is the exception.

2Conformity assessment routes

10 yrsDeclaration retention, Article 47

1Annex III area needing a notified body

2027Annex III deadline, 2 December

What conformity assessment is

Conformity assessment is how a provider demonstrates, before shipping, that a high-risk AI system meets the Chapter III requirements. It is a procedure, not a document, and it consumes the outputs of everything else the Regulation requires.

The sequencing matters more than the mechanics. Assessment verifies that a quality management system exists under Article 17, that technical documentation exists under Article 11 and Annex IV, and that the design, development and post-market monitoring plan are consistent with that documentation. None of that can be produced during the assessment. The assessment is the point at which you find out whether you did the work.

Which route applies

Article 43 assigns the route. Annex III high-risk systems generally take internal control under Annex VI; Annex III point 1 biometric systems can require a notified body under Annex VII; and Annex I products follow the conformity route their own sectoral legislation already sets.

Route by system type
System	Route	Third party involved?
Annex III points 2–8: employment, education, essential services, law enforcement, migration, justice, critical infrastructure	Internal control, Annex VI	No
Annex III point 1: biometrics, where harmonised standards were applied	Internal control, Annex VI	No
Annex III point 1: biometrics, where harmonised standards were not applied or do not exist	Notified body, Annex VII	Yes
Annex I products	The sectoral conformity route for that product	Where the sectoral legislation requires it

Why harmonised standards decide the route

Under Article 40, a high-risk system that conforms to a harmonised standard published in the Official Journal is presumed to conform with the Chapter III requirements that standard covers. For biometric systems, that presumption is what keeps the assessment inside internal control.

This is the mechanism the Omnibus deferral was built around. The stated reason for pushing Annex III to December 2027 was that the harmonised standards were not finished and notified bodies had not been designated in sufficient numbers. Both halves of that problem run through Article 40: no standards means no presumption, which means more systems in the notified body route, which means more demand on a body of assessors that does not yet exist at scale.

Where standards are absent, Article 41 lets the Commission adopt common specifications instead, which carry the same presumption. Either way the practical instruction for a provider is the same: track what is published for your system type, because it determines both the route and the evidential burden.

Declaration, marking, registration

Passing assessment does not permit you to ship. Three further steps sit between assessment and market.

What follows a successful conformity assessment
Provision	Step	What it requires
Article 47	EU declaration of conformity	The provider draws up a written, machine-readable declaration for each system, keeps it for 10 years, and makes it available to national authorities on request.
Article 48	CE marking	Affixed visibly, legibly and indelibly, or digitally where the system is supplied digitally. Where a notified body was involved, its identification number goes alongside.
Article 49	Registration in the EU database	Before placing on the market or putting into service. Providers who conclude an Annex III system is not high-risk under Article 6(3) must register it too.

The registration duty in Article 49 catches people out in one specific way. A provider who concludes under Article 6(3) that its Annex III system is not high-risk still has to register it. Concluding you are out of scope of the high-risk regime does not take you out of the database.

The notified body bottleneck

Notified body capacity is finite, designation is incomplete, and every provider needing the Annex VII route is working to the same date. For organisations in that route, the binding constraint is likely to be the assessor’s calendar rather than their own readiness.

A notified body is designated by a Member State notifying authority, and the scope of its designation is specific: a body designated for one category of system cannot assess another. Regulation (EU) 2026/1744 added Annex XIV, introducing nomenclature codes for designation scope, which should make it easier to identify which body can actually assess your system. That is an administrative improvement to a capacity problem, not a solution to it.

What to do before the queue forms

The work that determines whether assessment goes smoothly is all upstream of it, and most of it cannot be compressed.

Preparation, ordered by how badly it fails if left late
Do now	Because
Establish data provenance recording for anything still in training	Article 10 evidence cannot be reconstructed after collection, this is the one genuinely irreversible item
Determine your route, per system	It decides whether you need a notified body at all, and therefore whether you are in a queue
Track harmonised standards for your system type	Publication changes both your route and your evidential burden
Stand up the Article 17 quality management system	It is an organisational capability that takes months, and both routes verify it
Book a notified body if you are in the Annex VII route	Capacity is finite and demand is synchronised on one date
Assemble Annex IV documentation as you go	It is compiled from development artefacts, not written retrospectively

Frequently asked questions

What is conformity assessment under the EU AI Act?: The procedure by which a provider demonstrates that a high-risk AI system meets the Chapter III requirements before it goes on the market. Article 43 sets two routes: assessment based on internal control under Annex VI, which the provider carries out itself, and assessment involving a notified body under Annex VII.
Do all high-risk AI systems need a notified body?: No, and this is widely misstated. Most Annex III high-risk systems use internal control under Annex VI, with no third party involved. A notified body is required for Annex III point 1 biometric systems where the provider has not applied harmonised standards or common specifications, or where none exist, and for Annex I products, through the sectoral conformity route those products already follow.
When must conformity assessment be complete?: Before the system is placed on the market or put into service, and by the applicable application date: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-safety systems, both as deferred by Regulation (EU) 2026/1744.
What is the difference between Annex VI and Annex VII?: Annex VI is the internal control procedure: the provider verifies its own quality management system, examines its technical documentation, and checks that its design, development and post-market monitoring are consistent with that documentation. Annex VII adds a notified body, which assesses the quality management system and the technical documentation and then conducts ongoing surveillance of the approved system.
What happens after conformity assessment?: Three steps. The provider draws up the EU declaration of conformity under Article 47 and keeps it for 10 years. It affixes CE marking under Article 48, with the notified body's identification number alongside where one was involved. And it registers the system in the EU database under Article 49 before placing it on the market.
Does applying a harmonised standard guarantee compliance?: It creates a presumption of conformity with the requirements the standard covers, under Article 40. That presumption is the practical benefit: it is what allows a biometric system to take the internal control route rather than requiring a notified body, and it shifts the evidential burden in your favour.
Does a system need reassessment after changes?: Yes, where the change is substantial. A substantial modification requires a fresh conformity assessment. Changes the provider pre-determined and documented in the original technical documentation, including for systems that continue to learn, do not by themselves count as substantial modifications.

Sources and verification

Every date and provision cited here was checked against the consolidated text on 11 August 2026. The EU AI Act is being amended as it is implemented; where this page and EUR-Lex disagree, EUR-Lex governs.

This page is an independent information resource. It is not legal advice, and it does not create a lawyer–client relationship. Take advice on your own facts before making a compliance decision.

Next: establish whether Chapter III applies at all with the high-risk classification guide, check the dates in every compliance deadline, or read Article 43 in full.