EU AI Act Article 48: CE Marking for High-Risk AI Systems
EU AI Act Article 48 governs CE marking for high-risk AI: affix it visibly, legibly and indelibly, or machine-readable for digital systems, after Article 47.
The CE marking on a high-risk AI system is not a quality badge, not a certificate, and not the assessment itself. It is the outward declaration that the provider has completed the conformity assessment under Article 43 and drawn up the EU Declaration of Conformity under Article 47. Article 48 of Regulation (EU) 2024/1689 governs that mark — how it is affixed, where, and with what accompanying information — and it binds providers of high-risk AI systems only.
What Article 48 Requires: CE Marking for High-Risk AI
Article 48 governs the CE marking specifically — the visible mark that signals a high-risk AI system has passed its conformity assessment and may be placed on the EU market or put into service. It does not create the underlying obligations; it announces they are met. Under Article 48(2), the mark is subject to the general principles in Article 30 of Regulation (EC) No 765/2008 — the horizontal rules that govern CE marking across all EU product law.
Scope matters, because most providers do not owe a CE marking at all. Most general business AI — support bots, productivity tools, content generation, back-office automation — is not high-risk and carries no CE marking duty; the realistic duties there are Article 4 AI literacy and Article 50 transparency. Confirm your classification under Article 6 first.
The sequence runs Article 43 (conformity assessment) -> Article 47 (EU Declaration of Conformity) -> Article 48 (CE marking) -> Article 49 (registration). The mark sits third: it cannot lawfully precede the declaration, and registration follows it.
How and Where to Affix the CE Marking
Physical systems: visible, legible, indelible — Article 48(3)
For high-risk AI systems that have a physical form, Article 48(3) requires the CE marking to be affixed visibly, legibly and indelibly. A mark that rubs off, hides under a label, or is too small to read does not satisfy the rule.
Digital and software-only systems: machine-readable — Article 48(4)
For high-risk AI systems provided digitally, Article 48(4) permits a digital CE marking — but only if it can be easily accessed via the interface from which the system is accessed, or via an easily accessible machine-readable code or other electronic means. This is the practical path for SaaS and API-delivered AI, on one condition: genuine accessibility, reachable from where the system is used, not buried in a footer.
When physical marking is not possible: packaging and documentation
Where affixing the mark to the system itself is not possible or not warranted given its nature, it goes on the packaging or the accompanying documentation — the order of preference running system, then packaging, then documentation. In every case the mark must be affixed before the system is placed on the market, and only behind a completed Article 47 declaration: affixing it without one is a violation, and so is failing to affix it after a valid one. The mark and the declaration travel together.
The Notified Body Identification Number
Under Article 48(5), where a notified body was involved in the conformity assessment, its identification number must follow the CE marking. The provider — or its authorised representative — affixes that number, which may also appear in promotional material stating the system meets CE marking requirements.
A notified body is involved only on the Annex VII route — chiefly Annex III point 1 biometric systems where harmonised standards have not been fully applied, and certain Annex I product-embedded systems (see Article 43 for the routing detail). Most stand-alone Annex III systems self-assess under Annex VI internal control — for example employment under Annex III point 4 or critical infrastructure under Annex III point 2 — so no notified body is involved and no number appears. A number beside a CE mark therefore signals an Annex VII assessment behind it. For the designation process and the NANDO listing, see notified body.
CE Marking Signals Conformity Across All Applicable Union Law
The CE marking is a single horizontal mark: a product carrying it declares conformity with every Union act that requires CE marking and applies to it — not only the EU AI Act. Under Article 48(1), read with Article 47(4), where a high-risk AI system is subject to other Union law that also mandates CE marking, one mark covers all applicable acts, and the declaration must reference each.
The product route carries a caveat. Under Article 2(2), for Annex I Section B products — motor vehicles, aviation, rail, marine — only Article 6(1), Articles 102 to 109 and Article 112 apply directly, so the full AI Act stack does not govern that product-embedded AI. For Annex I Section A products — machinery, medical devices under the MDR (Regulation (EU) 2017/745) and IVDR (Regulation (EU) 2017/746), toys, lifts, radio equipment — Article 43(3) routes the conformity assessment through the sectoral acts, and the CE marking those acts already require also covers the AI requirements — no second AI-specific mark.
Do not confuse this with Article 50 transparency marking. Article 50 requires machine-readable marking of synthetic or AI-generated content, with those duties applying from 2 December 2026 — a content label, not the CE mark. A chatbot may owe Article 50 marking while owing no CE marking at all; the two are not interchangeable.
How Article 48 Differs From Articles 43 and 47
Providers conflate these three because the Act requires all of them and they reference each other. They are distinct steps with distinct outputs, set out in the table below. The common error is treating the mark as proof on its own: it is only lawful when a genuine Article 43 assessment and Article 47 declaration sit behind it.
| Article | What it is | Output | Who acts | Sequence position |
|---|---|---|---|---|
| Article 43 | The conformity assessment procedure (Annex VI or Annex VII) | Internal verification or notified body certificate | Provider; notified body on Annex VII | First |
| Article 47 | The EU Declaration of Conformity (Annex V) | A signed, machine-readable statement assuming legal responsibility | Provider (or authorised representative) | Second |
| Article 48 | The CE marking | The visible or machine-readable mark, plus the notified body number where applicable | Provider (or authorised representative) | Third |
| Article 49 | Registration in the EU database | An entry before market placement | Provider | Fourth |
Misuse of the CE Marking and Penalties
Affixing the CE marking without a completed conformity assessment and a valid declaration of conformity is a false declaration, not a paperwork slip. Improper, misleading, or unauthorised marking is also addressed by the horizontal regime in Regulation (EC) No 765/2008, which member-state market surveillance authorities enforce alongside the AI Act. Under Article 99, non-compliance with high-risk provider obligations — which include Articles 47 to 49 — sits in the second penalty tier: up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the two.
A word on timing. The statute reads 2 August 2026 for stand-alone Annex III high-risk systems. The Digital Omnibus reached political agreement on 6-7 May 2026 (COREPER confirmed the text around 13 May 2026) and is now adopted — the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on publication in the Official Journal, expected before 2 August 2026 — deferring this to 2 December 2027. Stand-alone Annex III obligations now apply from 2 December 2027, and Annex I product-embedded systems, statutorily due 2 August 2027, are deferred to 2 August 2028.
Worked Example: A Mid-Sized Provider Affixing the CE Marking
Scenario: NordRecruit, a 60-person HR-tech provider in Stockholm, ships a candidate-ranking SaaS product to EU employers.
Classification: The product falls under Annex III point 4(a) (recruitment) — high-risk, stand-alone. The full AI Act stack applies directly, and because it does not meet an Article 6(3) filtering exemption, NordRecruit uses the Annex VI internal-control route, with no notified body.
Sequence in action. NordRecruit completes the Article 43 internal assessment, draws up the Article 47 Annex V declaration, then affixes the CE marking. Because the product is software-only, it takes the Article 48(4) digital route: a machine-readable CE marking reachable from the product UI and admin console, plus the mark on the documentation.
No notified body number appears, because this is the Annex VI route. Had NordRecruit instead shipped a biometric identity-verification module under Annex VII, the notified body's identification number would follow the mark under Article 48(5). Finally, NordRecruit registers the system in the EU database under Article 49 before go-live.
How Confir helps
Confir's rule-based assessment workflow maps the completed intake to each downstream artefact. It determines whether the assessment runs through Annex VI or Annex VII, generates the Annex V declaration, flags whether a notified body identification number must follow the CE marking under Article 48(5), and surfaces the Article 48(4) digital-marking requirement for software-delivered systems. Outputs export as part of the Conformity Package alongside the Annex IV technical documentation, so the mark, the declaration, and the registration record stay consistent and audit-retrievable. The engine is deterministic and rule-based — no model inference, no hallucination.
Related guides
- EU Declaration of Conformity (Article 47)
- conformity assessment under Article 43
- registration in the EU database (Article 49)
- what CE marking means
- notified body
Frequently asked questions
What does Article 48 of the EU AI Act require?
Article 48 requires providers of high-risk AI systems to affix the CE marking to indicate the system conforms with Regulation (EU) 2024/1689. The mark is affixed after the conformity assessment (Article 43) and the EU Declaration of Conformity (Article 47), and before market placement. For physical systems it must be visible, legible and indelible; for digital systems a machine-readable CE marking may be used. Where a notified body was involved, its number follows the mark.
How is the CE marking affixed to a software-only AI system?
Article 48(4) allows a digital CE marking for digitally provided high-risk AI, but only if it can be easily accessed via the interface from which the system is accessed, or via an easily accessible machine-readable code or other electronic means. In practice this means surfacing the mark in the product interface or admin console — genuinely accessible, not buried in a footer.
When does a notified body identification number appear next to the CE marking?
Under Article 48(5), the number follows the CE marking only where a notified body was involved in the conformity assessment — the Annex VII route, chiefly Annex III point 1 biometric systems without fully applied harmonised standards, and certain Annex I product-embedded systems. Most stand-alone Annex III systems self-assess under Annex VI with no notified body, so no number appears.
How is Article 48 different from Articles 43 and 47?
They are three sequential steps. Article 43 is the conformity assessment — the procedure that verifies the system meets the requirements. Article 47 is the EU Declaration of Conformity — the signed document in which the provider assumes legal responsibility. Article 48 is the CE marking that signals the first two are complete, and is only lawful when a genuine assessment and declaration sit behind it.
Does the CE marking on an AI system cover other EU laws too?
Yes. The CE marking is a single horizontal mark. Under Article 48(1) and Article 47(4), where a high-risk AI system is subject to other Union legislation that also requires CE marking, one mark declares conformity with all applicable acts, and the declaration must reference each. For Annex I Section A products such as medical devices, the conformity assessment runs through the sectoral legislation under Article 43(3), and the CE marking required there also covers the AI Act.
Is the Article 50 synthetic-content mark the same as the CE marking?
No. They are different obligations. The CE marking under Article 48 signals that a high-risk AI system has passed conformity assessment. The Article 50 marking is a transparency label requiring providers of generative AI to mark outputs as artificially generated in a machine-readable form, with those duties applying from 2 December 2026. A chatbot may owe Article 50 transparency without being high-risk, so no CE marking is involved.
What is the penalty for affixing the CE marking improperly?
Affixing the CE marking without a completed assessment and valid declaration is a false declaration and a breach of high-risk provider obligations. Under Article 99(4) this sits in the second penalty tier — up to €15 million or 3% of total worldwide annual turnover, whichever is higher. Article 99(6) caps SMEs and start-ups at the lower of the two. Regulation (EC) No 765/2008 also bars misleading or unauthorised marking.
Last reviewed June 2026. Cites Regulation (EU) 2024/1689 (EU AI Act) and Regulation (EC) No 765/2008.
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →