EU AI Act Conformity Assessment: The Steps to Run It

You run a high-risk AI system, you have confirmed it is yours to certify, and the Annex VII notified-body route does not apply to you. Then your conformity assessment is six steps, run in order, by you — the provider — under the Annex VI internal-control procedure of Article 43. No external auditor signs anything. You stand up the quality management system, build the technical file, verify it against the high-risk requirements, check that the file matches what you built, draw up the declaration, then mark and register the system. This page walks those six steps for a stand-alone Annex III system.

---

Before You Start: Confirm the System Is High-Risk and the Route Is Yours

Conformity assessment is only required for high-risk systems. Confirm classification first, because the whole procedure below is wasted effort on a system that is not caught.

High-risk arises one of two ways (Article 6)

A system is high-risk either because it is a safety component of, or is itself, an Annex I regulated product (Article 6(1) — the product route), or because it is a stand-alone system in one of the Annex III use-cases (Article 6(2)). Most general business AI is neither: support bots, productivity tooling, content generation, drug-discovery models, and back-office automation are not high-risk. There the realistic duties are Article 4 AI literacy, Article 50 transparency where output reaches third parties, and ordinary data governance — not a conformity assessment. Do not run this procedure on a system that does not need it.

This page runs the stand-alone Annex III default route

Article 43(1) sets the default for stand-alone Annex III systems: the Annex VI internal-control route, run by the provider with no notified body. That is the route executed below. Two exceptions to flag up front.

First, certain Annex III point 1 biometric systems must use the Annex VII notified-body route under Article 43(1) unless the provider applied harmonised standards in full (or those standards do not exist or cover the requirements only in part). If you are on the biometric path, this checklist is not yours — see the closing section.

Second, for the Annex I product route, Article 43(3) routes the assessment through the relevant sectoral act rather than running it as a stand-alone AI Act procedure. And the Article 2(2) carve-out means Annex I Section B products (motor vehicles, aviation, rail, marine) take only Article 6(1), Articles 102-109 and Article 112 directly. This page assumes a stand-alone Annex III system, which takes the full Chapter III stack directly.

Confirm your role first

Provider obligations follow the provider. But a deployer, distributor, or importer becomes the provider under Article 25 — and inherits every step below — if it puts its name or trademark on a high-risk system, makes a substantial modification, or changes the intended purpose so the system becomes high-risk. Settle who the provider is before anyone assembles a file.

---

Step 1 — Stand Up the Quality Management System (Article 17)

The quality management system is the foundation the assessment checks against, so it comes first, not last. Article 17 requires a documented system covering the regulatory compliance strategy, design and development controls, data management, the Article 9 risk management system, post-market monitoring, incident reporting under Article 73, and recordkeeping.

Deliverable: written QMS policies and procedures, each with a named owner. Article 17(2) lets the system be proportionate to the size of the organisation, so a 180-person company does not need the apparatus of a multinational.

The sequencing pays off later. The QMS produces and maintains most of the Annex IV evidence, so building it first makes the technical file a by-product, not a scramble. The same duty applies to importers and others who become providers under Article 25.

---

Step 2 — Build the Annex IV Technical Documentation (Article 11)

Article 11 requires the technical documentation to be drawn up before the system is placed on the market and kept up to date. Annex IV lists the content across nine areas: system description and intended purpose, design specifications, the development process, data and data governance, training and testing, performance metrics, the risk management system, and the post-market plan.

Deliverable: a single technical file assembled against the Annex IV nine-area structure.

This step is assembly, not assessment. The file gathers the evidence; Step 3 is where you check whether it demonstrates compliance. Keep version control: Article 11 requires the file to stay current, so it is a living document tied to the QMS.

---

Step 3 — Verify the File Against the Chapter III Section 2 Requirements (Articles 9-15)

This is the substantive heart of Annex VI internal control. You check that the system actually meets each high-risk requirement in Chapter III Section 2:

• Article 9 — risk management system
• Article 10 — data and data governance
• Article 11 — technical documentation
• Article 12 — record-keeping and logging
• Article 13 — transparency and information to deployers
• Article 14 — human oversight
• Article 15 — accuracy, robustness and cybersecurity

Annex VI internal control means the provider itself verifies that the QMS conforms to Article 17 and that the technical documentation demonstrates compliance with these seven requirements. There is no external assessor on this route — the verification is yours to do and yours to stand behind.

Where the system applies harmonised standards or common specifications, document conformity with them; that documentation is the evidence the Section 2 requirements are met. Deliverable: a documented requirement-by-requirement verification mapping each Article 9-15 obligation to evidence in the technical file, with every gap logged and closed before you proceed.

---

Step 4 — Check Design-Development and Post-Market Consistency

Annex VI requires the provider to verify that the design and development of the system, and its post-market monitoring under Article 72, are consistent with the technical documentation. The file must describe the real system, not an idealised one.

Confirm two things. The post-market monitoring plan under Article 72 exists and is referenced in the technical documentation. And the serious-incident reporting path under Article 73 is wired into the QMS, so reporting is a live process and not a paragraph nobody owns.

Deliverable: a signed internal consistency check confirming that what was built, what is documented, and what will be monitored all match. This closes the loop before the declaration is drawn up. Signing a declaration over an inconsistent file is the most common avoidable error on this route.

---

Step 5 — Draw Up the EU Declaration of Conformity (Article 47)

Once verification and the consistency check pass, the provider draws up a written EU declaration of conformity under Article 47, containing the information set out in Annex V, and keeps it for ten years after the system is placed on the market or put into service.

The declaration is the provider's own legal statement that the system meets the Chapter III Section 2 requirements. It names the provider, identifies the system, and references the requirements and standards applied. Deliverable: a dated, signed Article 47 declaration with Annex V content.

Read Article 47(4) before you sign: by drawing up the declaration, the provider assumes responsibility for compliance. This is not a filing formality — it is the document a market-surveillance authority will hold you to.

---

Step 6 — Affix the CE Marking (Article 48) and Register in the EU Database (Articles 49 and 71)

Affix the CE marking under Article 48 to show the high-risk system conforms. For digital-only systems the marking may be affixed digitally where it is easily accessible.

Register the system in the EU database before placing it on the market or putting it into service. Article 49 sets the provider registration obligation, and Article 71 governs the database for high-risk systems listed in Annex III. Deliverable: CE marking affixed and a completed EU-database registration entry, with the registration data kept current.

Order matters. CE marking and registration come only after the declaration is signed; they are the public-facing endpoints of an otherwise internal assessment. Marking a system before the declaration exists inverts the procedure.

---

When the Annex VII Notified-Body Route Applies Instead

The Annex VI self-assessment route is the default for stand-alone Annex III systems, but not every high-risk system gets it.

Article 43(1) requires the Annex VII notified-body route for certain Annex III point 1 biometric systems where the provider has not applied harmonised standards in full — or where such standards do not exist or cover the requirements only in part. Annex VII adds external assessment of the QMS and the technical documentation by a notified body: a different, longer process this checklist does not cover.

Separately, Article 43(4) resets the assessment. A high-risk system that is substantially modified must undergo a fresh conformity assessment, regardless of which route was used originally. Be clear which route is yours before you start — running Annex VI when Annex VII is mandatory leaves the system non-conforming despite a complete internal pack.

---

Worked Example: A 180-Person HR-Software Company

Meridian People Systems is a 180-person company providing a stand-alone AI system that screens job applicants and ranks candidates for recruiters. That use-case is high-risk under Annex III point 4(a) (employment and workers' management), so it is a stand-alone Annex III system taking the full Chapter III stack directly — not an Annex I product. It confirms high-risk classification, confirms it is not on the Annex III point 1 biometric path so no notified body is required, and runs the Annex VI route.

Meridian walks the six steps with named owners and timing:

• Step 1 (Article 17): the compliance lead stands up the QMS, scaled to Meridian's size under Article 17(2).
• Step 2 (Article 11, Annex IV): engineering assembles the technical file as the QMS generates evidence.
• Step 3 (Articles 9-15): compliance and engineering log a requirement-by-requirement verification; two gaps surface (incomplete logging detail under Article 12, a thin human-oversight description under Article 14) and both are closed.
• Step 4 (Annex VI, Article 72): the quality owner signs the consistency check after confirming the post-market plan matches the shipped system.
• Step 5 (Article 47, Annex V): the accountable manager draws up and signs the declaration.
• Step 6 (Articles 48, 49, 71): the regulatory owner affixes the CE marking and completes the EU-database registration.

Because Meridian is an SME, Article 99(6) caps any administrative fine at the lower of the two relevant figures, and Article 17(2) let it scale the QMS rather than over-build. The realistic outcome is not a certificate on a wall: it is an internal pack a market-surveillance authority can request and review, produced as a by-product of the QMS rather than a one-off project.

---

The Six Steps at a Glance: Article, Deliverable, and Owner

Deadlines. The statute reads 2 August 2026 for stand-alone high-risk Annex III systems (Article 6(2)). The Digital Omnibus reached political agreement on 6-7 May 2026 (COREPER confirmed the text around 13 May 2026) and is now adopted — the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on publication in the Official Journal, expected before 2 August 2026 — deferring this to 2 December 2027. Plan against that date.

Penalties. Breaches of the high-risk obligations carry administrative fines up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). Supplying incorrect or misleading information to authorities carries up to €7,500,000 or 1% (Article 99(5)). Under Article 99(6), SMEs and start-ups are capped at the lower of the percentage or the fixed amount — but a missing or invalid declaration still leaves the system non-conforming. This table doubles as the printable checklist the procedure is built around.

---

How Confir Helps

Running the Annex VI route means producing the Article 17 QMS records, the Annex IV technical file, the Article 9-15 verification mapping, the consistency check, and the Article 47 declaration — and keeping them consistent. Confir's synthesis engine is deterministic and rule-based — no model inference, no hallucination — so it classifies the system (Article 6, Annex III logic), derives the provider role under Article 25, and generates the print-ready Annex IV pack and the Annex V declaration from your intake answers. Same inputs, same output, every time; the rule that fired is human-readable in the audit log, which is exactly what a market-surveillance request asks you to show.

---

Frequently asked questions

What are the steps of EU AI Act conformity assessment for a self-assessed high-risk system?

On the Annex VI internal-control route under Article 43, the provider runs six steps in order: stand up the quality management system (Article 17), build the Annex IV technical documentation (Article 11), verify the system against the Chapter III Section 2 requirements (Articles 9-15), check that design, development and post-market monitoring are consistent with the file, draw up the Article 47 declaration of conformity, then affix the CE marking (Article 48) and register in the EU database (Articles 49 and 71). No notified body is involved on this route.

Do I need a notified body for the conformity assessment?

Usually no. Annex VI internal control — provider self-assessment — is the default for stand-alone Annex III high-risk systems under Article 43(1). The Annex VII notified-body route is required only for certain Annex III point 1 biometric systems where the provider has not applied harmonised standards in full, or where such standards do not exist or cover the requirements only in part. Confirm which point of Annex III your system falls under before assuming the self-assessment route is open to you.

In what order should the conformity assessment steps happen?

Build the quality management system first (Article 17), because it produces and maintains most of the evidence. Assemble the Annex IV technical file next (Article 11), then verify the system against Articles 9-15, then confirm the file matches what was actually built and monitored. Only after those checks pass do you draw up the Article 47 declaration, affix the CE marking (Article 48) and register in the EU database (Articles 49/71). Signing the declaration over an unverified file is the most common avoidable error.

What documents does a complete conformity assessment produce?

A documented quality management system (Article 17), the Annex IV technical documentation (Article 11), a requirement-by-requirement verification mapping against Articles 9-15, a signed internal consistency record, the EU declaration of conformity (Article 47, content per Annex V, kept ten years), evidence the CE marking was affixed (Article 48), and an EU-database registration entry (Articles 49/71). Together these form the pack a market-surveillance authority can request.

What is the deadline to complete conformity assessment for a stand-alone high-risk system?

The statute reads 2 August 2026 for stand-alone high-risk Annex III systems under Article 6(2). The Digital Omnibus reached political agreement on 6-7 May 2026 (COREPER confirmed the text around 13 May 2026) and is now adopted — the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on Official Journal publication, expected before 2 August 2026 — deferring this to 2 December 2027. Plan against that date.

What happens if I substantially modify the system after the assessment is done?

A substantial modification resets the obligation. Under Article 43(4), a high-risk AI system that is substantially modified must undergo a fresh conformity assessment, regardless of which route was used originally. The same trigger can also change roles: under Article 25, a deployer or distributor that makes a substantial modification, rebrands the system, or changes its intended purpose can itself become the provider responsible for running the assessment.

What are the penalties for getting conformity assessment wrong?

Breaching the high-risk obligations — including failing to complete a valid conformity assessment — carries administrative fines up to €15,000,000 or 3% of total worldwide annual turnover under Article 99(4). Supplying incorrect or misleading information to authorities carries up to €7,500,000 or 1% under Article 99(5). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the applicable amounts, but a missing or invalid declaration still leaves the system non-conforming and exposed to market-surveillance action.

---

Related guides

• the two routes under Article 43
• what conformity assessment is
• the Annex IV requirements checklist
• Annex IV technical documentation template
• the Article 47 declaration of conformity
• drawing up the EU declaration of conformity