Which Conformity-Assessment Route Applies to Your High-Risk AI? (Article 43)

Before a high-risk AI system can be placed on the EU market, its provider must complete a conformity assessment — the EU's term for proving, before launch, that a system meets the high-risk requirements. Article 43 of Regulation (EU) 2024/1689 sets out which route you take, and for most providers the answer is reassuring: you self-assess. But not for everyone, and getting the route wrong wastes months. This page is a decision walkthrough — three questions that pin down your route.

For the difference between choosing the route (this page) and running the checklist of evidence, see the conformity-assessment checklist template, which itemises what each route demands. This page answers the prior question: which route at all.

---

The one-paragraph answer

Most stand-alone high-risk AI (Annex III points 2–8) uses Annex VI internal control — the provider self-assesses, no third party. Biometrics (Annex III point 1) can require Annex VII notified-body assessment. AI that is a safety component of a product already regulated under EU law (Annex I) runs through that product's sectoral conformity procedure under Article 43(3). Three routes; three triggers.

---

Step 1 — Is your system high-risk because of Annex I or Annex III?

The first fork is why the system is high-risk.

• Annex I route (product-embedded). If the AI is a safety component of, or is itself, a product covered by the EU harmonisation legislation listed in Annex I — medical devices (MDR/IVDR), machinery, lifts, vehicles, toys, and so on — then under Article 43(3) the AI conformity assessment is folded into the existing sectoral conformity procedure for that product. You do not run a separate AI-only assessment; the AI Act requirements are checked within the third-party or self-assessment regime your product already uses. These systems carry the later 2 August 2028 deadline.
• Annex III route (stand-alone). If the system is high-risk because it falls under one of the eight Annex III use-case areas — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice — go to Step 2. These carry the 2 December 2027 deadline (Digital Omnibus deferral, now adopted — see caveat).

---

Step 2 — Is it Annex III point 1 (biometrics)?

Among the Annex III points, point 1 (biometrics) is the exception.

• Yes, point 1 (biometrics). The provider must use the Annex VII procedure — notified-body assessment — where harmonised standards have not been applied, or applied only in part. A notified body is an independent, EU-accredited conformity-assessment body that reviews your technical documentation (Art 11 / Annex IV) and quality management system (Art 17). If full harmonised standards exist and you apply them, an internal route may open — but plan for the notified body. This is the only Annex III point that routinely pulls in a third party.
• No (points 2–8). Go to Step 3.

---

Step 3 — The default: Annex VI internal control

For Annex III points 2–8 — everything that is not biometrics — the provider runs the Annex VI internal-control procedure. This is self-assessment: the provider verifies the system against the high-risk requirements (Articles 9–15), draws up the technical documentation (Article 11 / Annex IV), checks that the quality management system (Article 17) is in place, signs the Article 47 EU Declaration of Conformity (content per Annex V), and affixes the CE marking under Article 48. No external body signs off.

This is the route most SMB providers take. It is demanding — the technical file is real work — but it does not require booking a notified body, and you control the timeline.

---

What conformity assessment is not

Three traps worth naming:

• ISO/IEC 42001 and the NIST AI RMF are not the conformity assessment. They are management-system and risk frameworks that support your evidence — they do not equal the Article 43 procedure or constitute legal compliance on their own.
• The FRIA (Article 27) is not the conformity assessment. The FRIA is the deployer's fundamental-rights assessment; conformity assessment is the provider's pre-market proof. Different actor, different Article.
• A re-assessment is triggered by substantial modification. Under Article 3(23), a substantial modification to a high-risk system after it is on the market sends it back through conformity assessment. Routine updates within the declared intended purpose generally do not.

---

The deadline caveat

The deferral of the stand-alone high-risk regime to 2 December 2027 is now adopted — the European Parliament passed it on 16 June 2026 and the Council adopted it on 29 June 2026. Only Official Journal publication remains, expected before 2 August 2026 — a formality that does not change the dates. Stand-alone high-risk Annex III obligations apply from 2 December 2027, and Annex I product-embedded systems from 2 August 2028.

---

Worked example: a SaaS provider works out its route

Lernpfad GmbH — a fictional 55-person German edtech company (~€9M turnover) — ships an AI tool that scores student exam answers, used by universities to grade.

• Step 1. The tool is not embedded in an Annex I product; it is stand-alone software. It falls under Annex III point 3 (education and vocational training — AI used to evaluate learning outcomes). So: Annex III route, 2 December 2027 deadline.
• Step 2. It is not biometrics (point 1). So no notified body on the biometrics ground.
• Step 3. Default: Annex VI internal control. Lernpfad self-assesses against Articles 9–15, builds the Article 11 / Annex IV technical file, puts the Article 17 quality management system in place, signs the Article 47 Declaration of Conformity, and CE-marks under Article 48 — no external body required.

The verdict: Lernpfad self-assesses. As an SME its penalty exposure is capped at the lower figure under Article 99(6), and it benefits from proportionate SME conformity fees under Article 62. A biometric exam-proctoring vendor in the same building would face the notified-body route instead — same deadline, very different runway.

---

How Confir helps

Confir's classification step works out why a system is high-risk — Annex I product-embedded versus Annex III, and within Annex III whether it is point 1 biometrics — and then names the conformity route: Annex VI internal control, Annex VII notified body, or the Article 43(3) sectoral procedure. It then assembles the route's evidence: the Article 11 / Annex IV technical pack and the Article 47 / Annex V Declaration of Conformity. The engine is deterministic and rule-based — the same intake yields the same route, with the deciding Article cited.

Related guides

• Conformity assessment explained
• Article 43 — conformity assessment
• Conformity-assessment steps
• Conformity-assessment checklist template
• Notified body — what it is
• Annex IV technical documentation template