Conformity Assessment (Article 43)

Article 43 establishes the conformity assessment procedures that providers must complete before placing high-risk AI systems on the Union market or putting them into service. This gatekeeping mechanism ensures AI systems demonstrably meet all applicable requirements.

The Conformity Assessment Framework

Purpose and Legal Basis

The AI Act specifies different conformity assessment routes depending on the type of high-risk AI system:

• Article 43(1) — For high-risk AI systems related to biometrics (Annex III, point 1): if the provider has applied harmonised standards under Article 40 or common specifications under Article 41, the provider may choose either the internal control procedure (Annex VI) or the conformity assessment procedure involving a notified body (Annex VII). If harmonised standards or common specifications have not been applied, the provider must use the notified body procedure (Annex VII).
• Article 43(2) — For high-risk AI systems referred to in Annex III, points 2 to 8: providers shall follow the internal control procedure (Annex VI) only, with no notified body involvement required.
• Article 43(3) — For high-risk AI systems covered by Annex I Union harmonisation legislation (sectoral legislation such as medical devices, machinery, etc.): the conformity assessment procedure under that sectoral legislation applies, and the AI Act requirements are assessed as part of that procedure.

Internal Control Procedure (Annex VI)

When Internal Control Applies

Most high-risk AI systems in Annex III can use internal control procedures. This is a self-assessment by the provider—no third-party involvement required.

Annex VI: Three Substantive Steps

Annex VI sets out three substantive steps for the internal control procedure:

Following these three substantive verification steps, the provider then draws up the EU declaration of conformity (Article 47), affixes the CE marking (Article 48), and registers in the EU database (Article 49).

Technical Documentation Examination

The provider must verify their technical documentation (per Annex IV) demonstrates:

Quality Management System Review

Before issuing a declaration, verify the QMS (Article 17) addresses:

• Regulatory compliance strategy
• Design and development procedures
• Quality control techniques
• Examination, test, and validation procedures
• Technical specifications and standards
• Data management systems
• Risk management implementation
• Post-market monitoring system
• Incident reporting procedures
• Resource management

Third-Party Assessment (Annex VII)

When Notified Body Assessment Is Required

Article 43(1) governs third-party assessment for biometric systems (Annex III, point 1). Where harmonised standards or common specifications have NOT been applied, the notified body procedure (Annex VII) is required. Where they have been applied, the provider may choose between internal control (Annex VI) and notified body (Annex VII). This applies to:

• Remote biometric identification systems
• Biometric categorisation systems
• Emotion recognition systems

Note: Article 43(2) covers Annex III systems in points 2–8 (all other high-risk AI systems outside biometrics), for which internal control (Annex VI) is the only procedure — no notified body involvement is required.

The Notified Body Process

Notified Body Requirements

Notified bodies must be:

Third-Party Assessment Outcomes

EU Declaration of Conformity (Article 47)

Required Content (Annex V)

The declaration must contain:

Declaration Template Structure

EU DECLARATION OF CONFORMITY
(Regulation (EU) 2024/1689)

1. AI System: [Name, type, version, unique identifier]

2. Provider: [Legal name, registered address, contact]

3. This declaration of conformity is issued under the sole
   responsibility of the provider.

4. Object of declaration: [Description of AI system and
   intended purpose]

5. The AI system described above is in conformity with
   Regulation (EU) 2024/1689.

6. References to relevant harmonised standards used:
   [List standards or "None applied"]

7. Where applicable, the notified body:
   [Name, number] performed [assessment type] and
   issued certificate [number]

8. Signed for and on behalf of: [Provider name]

   [Place, Date]
   [Name, Function]
   [Signature]

CE Marking Requirements

Affixing the CE Marking

Article 48 requirements:

CE Marking for Digital AI Systems

For AI systems without physical components:

• Include in user interface
• Display in documentation
• Show in digital labelling/metadata
• Reference in instructions for use

💡 Practical Note: Many AI systems are purely software. The CE marking appears in the product documentation, interface, and packaging (if any physical media exists).

Substantial Modifications (Article 43(4))

Definition of Substantial Modification

A modification is "substantial" if it affects compliance with:

• Any Chapter III, Section 2 requirement
• The intended purpose as originally assessed
• The risk classification of the system

Modification Assessment Framework

Post-Modification Process

If substantial modification occurs:

1. Assess Impact — Determine which requirements affected
2. Update Documentation — Revise technical documentation
3. Re-verify Compliance — Conduct new conformity assessment
4. Update Declaration — Issue new EU declaration
5. Update Registration — Notify EU database of changes
6. Inform Deployers — Communicate changes to users

Integration with Sectoral Legislation

Annex I, Section A Systems

For AI systems covered by EU legislation listed in Annex I, Section A:

• Follow that legislation's conformity assessment procedure
• Additionally verify AI Act Chapter III, Section 2 requirements
• Single assessment may cover both frameworks

Annex I, Section B Systems (Products)

For AI embedded in products (e.g., machinery, medical devices):

• AI assessment integrates with product conformity assessment
• Notified body for product may assess AI requirements
• Single declaration covers both product and AI compliance

Compliance Checklist: Conformity Assessment

Pre-Assessment:

• Determine applicable conformity route
• Complete all Chapter III, Section 2 requirements
• Prepare complete Annex IV technical documentation
• Verify QMS is operational and documented
• Identify applicable harmonised standards

Internal Control (Annex VI):

• Conduct systematic documentation review
• Verify compliance with each Article 8-15 requirement
• Document internal assessment process
• Prepare EU declaration of conformity
• Affix CE marking appropriately

Third-Party Assessment (Annex VII):

• Select appropriate notified body
• Submit application and documentation
• Support on-site audit activities
• Address any findings or conditions
• Obtain and retain conformity certificate

Post-Assessment:

• Register in EU database
• Implement post-market monitoring
• Monitor for substantial modifications
• Maintain records for 10 years minimum