AI Act Conformity Assessment: Internal Control, Notified Bodies and CE Marking (Article 43)

AI Act conformity assessment is the procedure by which a provider demonstrates, before placing a high-risk AI system on the market, that it meets the requirements of Chapter III, Section 2 (Articles 3(20) and 16(f)). Four routes exist under the EU AI Act: internal control by the provider, third-party assessment by a notified body, the sector product procedure, and the Article 75(1e) route for systems under the AI Office. The Article 16(f) duty to have a system assessed applies from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c)).

The AI Act is Regulation (EU) 2024/1689, in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026, which replaced Article 43(3) and moved the duty dates. Who the EU AI Act applies to also decides who acts here: the provider carries the assessment, and importers, distributors and authorised representatives check it.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What Is a Conformity Assessment under the AI Act?

A conformity assessment is the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled (Article 3(20)). The definition ties the procedure to one high-risk AI system and to one benchmark, the seven requirements of Articles 9 to 15. Article 43 decides which procedure a provider follows.

The procedures sit in Article 43, Annex VI (the provider's own check) and Annex VII (the check by a notified body) of the AI Act full text. Each assessment ends in an EU declaration of conformity (Article 47) and a CE marking (Article 48).

Conformity Assessment Is Not a Certification of People or Companies

The AI Act certifies no person and no company: its only certificates are those a notified body issues for a specific high-risk AI system (Article 44, Annex VII).

EU AI Act training is not recognised as certification by any provision of the act.

What the act asks of staff is AI literacy. Since 27 July 2026, Article 4(1) provides that "Providers and deployers of AI systems shall take measures to support the development of AI literacy", and the guide to AI literacy under Article 4 explains what that duty covers. The duty guarantees no specific level of literacy and creates no certificate.

The Conformity Assessment Section of This Guide: Four Pages and What Each Answers

Four topics carry the detail of the procedure: the provider's own check, the third-party bodies, the CE marking and the EU declaration of conformity.

The harmonised standards for the AI Act and the draft conformity assessment framework standard prEN 18285 support these procedures but do not replace them.

Which Procedure Applies? The Article 43 Decision Logic in Five Steps

Five checks decide the procedure: whether Article 43 applies at all, then the biometric, use-case, product and EU-level branches. The steps give an orientation, not a legal assessment.

Step 1: Check Whether the System Falls under Article 43

Article 43 applies only to high-risk AI systems, so a system that is neither an Annex I safety component requiring third-party assessment nor an Annex III use case undergoes no conformity assessment under the AI Act. Article 6(1), points (a) and (b), are cumulative, while Annex III lists 25 use cases in eight areas. Classification of high-risk AI systems comes first, including the Article 6(3) exception. For products under Annex I Section B, only Article 6(1), Article 60a and Articles 102 to 112 apply (Article 2(2) as replaced), so the sector law alone governs the check.

Step 2: Biometrics under Point 1: a Choice Only with Full Coverage

Annex III point 1 biometric systems may use the provider's own procedure (Annex VI) only where harmonised standards or common specifications covering all Section 2 requirements were applied; otherwise Annex VII applies (Article 43(1)). The Annex VII procedure is mandatory in four cases:

• No coverage (point (a)): no harmonised standards and no common specifications exist.
• Partial application (point (b)): the standard was not applied or only in part.
• Unused specifications (point (c)): common specifications exist but were not applied.
• Restricted standard (point (d)): a standard published with a restriction, for that part.

The provider may choose any notified body; for law-enforcement, immigration or asylum authorities and EU institutions, the market surveillance authority referred to in Article 74(8) or (9) acts as the notified body (Article 43(1), third subparagraph). Our reading: with no Section 2 harmonised standard cited and no common specifications adopted as of 24 October 2026, point 1 providers fall under Annex VII, while no AI Act notified body is listed yet.

Step 3: Use Cases in Points 2 to 8: the Provider's Own Assessment

Systems under Annex III points 2 to 8, such as employment, education and essential-services systems, follow the procedure based on internal control in Annex VI, without a notified body (Article 43(2)). No certificate is issued. Illustration (our reading): a CV-screening system for recruitment can fall under Annex III, point 4(a), and its provider then checks its own quality management system and technical documentation.

Step 4: Products under Sector Legislation: the Sector Procedure

AI systems covered by Annex I Section A legislation, such as AI in lifts, radio equipment, toys or medical devices, go through the sector conformity assessment procedure, which now includes the AI Act requirements and the Article 17 quality management system (Article 43(3), as replaced by Regulation (EU) 2026/1744). Annex VII points 3, 4.3, 4.4, 4.5, the fifth paragraph of point 4.6 and point 5 apply within it; before 27 July 2026, Article 43(3) referred only to points 4.3 to 4.6.

Where the sector law offers an opt-out from third-party assessment based on harmonised standards, the manufacturer may use it only if it also applied harmonised standards or common specifications covering all Section 2 requirements; it is not required to choose third-party assessment only because the product includes a high-risk AI safety component, if the sector law does not require it (Article 43(3), third subparagraph). A system that falls under both Annex I Section A and Annex III follows the sector procedure (Article 43(3), fourth subparagraph).

Sector notified bodies must apply for designation under the AI Act by 28 January 2028 (Article 43(3), second subparagraph).

Step 5: Systems under Exclusive EU-Level Supervision

For high-risk AI systems under the exclusive competence of the AI Office that are subject to third-party assessment under Article 43, the AI Office is responsible for the conformity assessments, and the Commission entrusts them to notified bodies acting on its behalf (Article 75(1e)). Article 75(1) covers (a) systems based on a general-purpose AI model where model and system come from the same provider or undertaking, except (i) systems related to Annex I products, (ii) Annex III point 2 systems, (iii) systems provided by law enforcement authorities, border management authorities and financial institutions insofar as they fall under Article 74(6), and (iv) Annex III point 8 systems as regards the administration of justice, and (b) systems that constitute or are integrated into a very large online platform or very large online search engine. Systems built on the provider's own general-purpose AI models take this route only where Article 43 requires a third-party assessment. The provider pays the costs of the entrusted services directly to the notified body (Article 75(1e), second subparagraph).

The Four Assessment Procedures Compared

Four procedures follow from Article 43 and Article 75(1e), and they differ in who assesses, what is examined and what document results.

Article 43 of Regulation (EU) 2024/1689, paragraph 3 as replaced, and Article 75(1e) as inserted, by Regulation (EU) 2026/1744.

An appeal procedure against notified-body decisions must be available (Article 44(3)). The routes can change: Article 43(5) and (6) empower the Commission to amend Annexes VI and VII and to extend Annex VII to Annex III points 2 to 8 by delegated act, for five years from 1 August 2024, tacitly extended (Article 97(2)).

What the Assessment Examines: Requirements, Quality System and Documentation

Every conformity assessment examines three objects: the seven requirements of Articles 9 to 15, the quality management system of Article 17 and the technical documentation of Article 11. The requirements for high-risk AI systems set out each of the seven, from risk management to human oversight. Annex VI organises the check in four points:

• Procedure (point 1): based on points 2, 3 and 4.
• Quality management system (point 2): verified against Article 17.
• Technical documentation (point 3): examined against Section 2.
• Consistency (point 4): design, development and Article 72 monitoring match the documentation.

Article 17 lists at least 13 aspects, points (a) to (m), applied proportionately by an SME, including a start-up, or an SMC (Article 17(2)). EN 18286:2026, cited by Implementing Decision (EU) 2026/2274, gives a presumption of conformity for the Article 17 requirements it covers. Under Annex VII, the notified body gets access to data sets, including by API or remote access (point 4.3), and on reasoned request to trained models and parameters (point 4.5).

Operator Duties Linked to the Conformity Assessment

The provider carries the conformity assessment duty (Article 16(f)), and importers, distributors and authorised representatives check that it was carried out before the system reaches the Union market.

The provider role can move, and the assessment duty moves with it. The provider vs deployer roles follow Article 25(1), under which a distributor, importer, deployer or third party becomes the provider when it puts its name or trademark on a high-risk system, makes a substantial modification so that the system remains high-risk, or changes the intended purpose so that the system becomes high-risk. That new provider then needs its own conformity assessment.

Downstream operators also act on doubts: an importer that has sufficient reason to consider a system non-conforming or falsified does not place it on the market (Article 23(2)), and a distributor that considers, on the basis of the information in its possession, that a system does not conform to Section 2 does not make it available (Article 24(2)).

When a Changed System Needs a New Assessment (Article 43(4))

A high-risk AI system undergoes a new conformity assessment whenever it is substantially modified, whether it is further distributed or keeps being used by the current deployer (Article 43(4)). Changes to a system that continues to learn are excluded where the provider pre-determined them at the initial assessment and documented them under Annex IV, point 2(f).

Article 3(23) defines a substantial modification as a change not foreseen or planned in the initial conformity assessment that affects compliance with Section 2 or modifies the intended purpose for which the system was assessed. Article 96(1)(c) requires the Commission to develop guidelines on the practical application of the provisions related to substantial modification.

Exceptional Authorisations without a Completed Assessment (Article 46)

Article 46 allows a market surveillance authority to authorise the placing on the market or putting into service of a specific high-risk AI system before its conformity assessment is completed, by way of exception (Article 46(1)).

Law-enforcement and civil-protection authorities may, in a duly justified situation of urgency, put a system into service without prior authorisation and request it during or after use (Article 46(2)). An objection period of 15 calendar days applies to authorisations (Article 46(4)), and a deployer using a system authorised under Article 46(1) can be exempted from notifying its fundamental rights impact assessment (Article 27(3)).

When Conformity Assessment Becomes Mandatory: Dates after the 2026 Amendment

Providers must have Annex III high-risk AI systems assessed before placing them on the market from 2 December 2027, and Annex I systems from 2 August 2028 (Article 16(f) with Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744). The EU AI Act timeline lists every other application date of the act.

Before 27 July 2026, the provider duties applied from 2 August 2026 for Annex III systems and from 2 August 2027 for Annex I systems.

Article 113, third paragraph, point (c) postpones only Chapter III Sections 1 to 3, except Article 6(5); Section 4 is not deferred.

The duty dates were moved by an adopted regulation, not by a proposal. The Digital Omnibus on AI is that regulation, and the pending proposal COM(2025) 837 does not amend the AI Act.

Third-Party Assessment Capacity as of 24 October 2026

No notified body is listed under the AI Act in the Commission's NANDO database as of 24 October 2026 (legislation 168380), so no notified body can yet issue an Annex VII certificate under the AI Act. Notifications are based on the codes of Annex XIV (Article 30(2) as amended), such as AIP 0102 to AIP 0112 for Annex I Section A products and AIB 0201 to AIB 0203 for biometrics.

Bodies seeking designation under both the AI Act and Annex I Section A legislation submit a single application and undergo a unified assessment where the sector law provides for one (Article 28(8) and (9)). Conformity assessment bodies of third countries may act as notified bodies only under an agreement concluded by the Union (Article 39).

EN 18286:2026 on quality management is the only harmonised standard cited under the AI Act as of 24 October 2026, and no harmonised standard covering Chapter III Section 2 is cited in the Official Journal. The Publications Office record shows no common specifications adopted under Article 41 as of 23 October 2026. Beside the harmonised standards for the AI Act, the draft prEN 18285 on a conformity assessment framework is in preparation and gives no presumption of conformity.

Fines for Skipping or Misrepresenting the Assessment

Placing a high-risk AI system on the market without the required conformity assessment breaches Article 16(f) and carries fines of up to EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher (Article 99(4)). Member States lay down the penalties (Article 99(1)), and the EUR 15 million tier is the maximum their rules must provide for. The tier also covers notified-body duties (Article 99(4), point (f)).

Market surveillance authorities require the end of seven formal breaches under Article 83(1), points (a) to (g), such as a missing CE marking, a missing or incorrect EU declaration or unavailable technical documentation.

Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities carries up to EUR 7 500 000 or 1 % of total worldwide annual turnover, whichever is higher (Article 99(5)). The guide to EU AI Act penalties covers the full fines regime. SMEs, start-ups and, since 27 July 2026, small mid-caps face the lower amount (Article 99(6) and (6a)).

How to Prepare for the Conformity Assessment: A Provider Plan

Five steps prepare a provider for its conformity assessment: classify, choose the route, build the quality system and documentation, run the assessment, and complete declaration, marking and registration:

1. Classify each AI system against Annex I, Annex III and Article 6(3).
2. Choose the route under Article 43 or Article 75(1e).
3. Build the Article 17 quality system and the Article 11 documentation.
4. Run the Annex VI check or prepare the notified-body file.
5. Complete the declaration (Article 47), CE marking (Article 48) and, for Annex III, registration (Article 49).

A step-by-step programme for providers and deployers appears in the guide to EU AI Act compliance.

The documentation and the EU declaration are kept for 10 years after placing on the market or putting into service (Articles 18(1) and 47(1)).

Each provider duty in this plan rests on Articles 16 to 18 and 43 to 49. The EU AI Act checklist sorts the obligations by role and risk class, with each deadline.

Conformity Assessment: Related Questions

Article 43(3), Article 42(3), Article 40, Article 22 and Article 83 answer the related questions on healthcare products, Cyber Resilience Act products, ISO/IEC 42001, non-EU providers and supervision.

How Does the Assessment Work for AI in Healthcare Products?

High-risk AI in medical devices goes through the MDR or IVDR conformity assessment procedure, which also covers the AI Act requirements (Article 43(3)).

The non-binding guidance MDCG 2025-6 / AIB 2025-1 of 19 June 2025 explains the interplay, and the guide to the AI Act in healthcare covers it. It still gives 2 August 2027 for Annex I, now 2 August 2028, and the Commission health page lists no revision as of 24 October 2026.

Do Cyber Resilience Act Products Need a Separate Cybersecurity Check?

No separate check is needed where a high-risk AI system meets Article 12(1) of the Cyber Resilience Act: Article 42(3) deems it to meet the Article 15 cybersecurity requirements.

The other parts of accuracy, robustness and cybersecurity and the rest of Section 2 are still assessed.

Does ISO/IEC 42001 Certification Replace the Conformity Assessment?

An ISO/IEC 42001 certificate replaces no AI Act conformity assessment: the only harmonised standard cited under the act on 24 October 2026 is EN 18286:2026.

The comparison of ISO/IEC 42001 with the act shows that an uncited standard gives no presumption of conformity. EN 18286:2026 is designed to sit on ISO/IEC 42001 or ISO 9001.

Do Non-EU Providers Follow the Same Procedure?

Non-EU providers follow the same Article 43 procedure, and their authorised representative verifies that it was carried out (Article 22(3), point (a)).

The guide to the EU AI Act for non-EU companies explains how the act reaches them. Article 22 requires them to appoint an authorised representative in the Union by written mandate.

Who Checks Conformity after a System Is on the Market?

Market surveillance authorities check conformity after placing on the market and act on formal non-compliance under Article 83(1).

The national competent authorities of the 27 Member States carry out that supervision. The AI Office supervises the systems listed in Article 75(1).

Frequently Asked Questions about AI Act Conformity Assessment

Does every AI system need a conformity assessment?

No. Only high-risk AI systems need one (Articles 6 and 43); systems with only Article 50 transparency duties need none.

Does every system under Article 43 need a third-party assessment?

No. Annex III points 2 to 8 use internal control under Annex VI; point 1 can need a notified body; Annex I Section A products follow the sector third-party procedure (Articles 6(1)(b) and 43(3)).

Is there an official EU AI Act certification for professionals?

No. The act issues certificates only for high-risk AI systems, through notified bodies (Article 44).

When must a provider complete the conformity assessment?

Before placing the system on the market, once the Article 16(f) duty applies: from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c)).

Can a deployer carry out the conformity assessment?

No. The provider is responsible (Article 16(f)). A deployer that triggers Article 25(1) becomes the provider and then carries the duty.

Does a certificate from a third-party assessment expire?

Yes. A notified-body certificate is valid for at most five years for Annex I systems and four years for Annex III systems (Article 44(2)).