Common Specifications — EU AI Act Article 41 Explained
Common specifications under EU AI Act Article 41: Commission implementing acts giving a presumption of conformity where Article 40 standards fall short.
A common specification is a technical document adopted by the European Commission, through an implementing act, that sets out concrete requirements a high-risk AI system can meet to be presumed compliant with parts of the EU AI Act. It is the Commission's fallback for when the normal route — harmonised standards under Article 40 — is missing, delayed, or inadequate. Get a system right against a common specification and you earn the same presumption of conformity you would from a harmonised standard.
For a provider, the practical meaning is simple: common specifications are a second path to demonstrating that a high-risk system meets the requirements of Chapter III, Section 2, without having to argue every requirement from first principles. This page defines the term, sets it against Article 40 harmonised standards, and shows how both feed the Article 43 conformity assessment.
What Article 41 actually says
Article 41 of Regulation (EU) 2024/1689 empowers the Commission to adopt common specifications by implementing act in defined circumstances — broadly, where:
- harmonised standards under Article 40 do not exist, or
- the Commission has requested the relevant European standardisation bodies to draft a standard and the request has not been accepted or the standard is not delivered in time, or
- the existing harmonised standards are insufficient to address the requirements (including fundamental-rights concerns).
A common specification covers the requirements of Chapter III, Section 2 (the high-risk requirements, Articles 9–15) or, where relevant, the obligations on GPAI model providers. Once adopted, a high-risk system that conforms to a common specification is presumed to conform to the requirements that specification covers — exactly the legal effect of a harmonised standard.
Crucially, common specifications are a backstop, not the preferred instrument. Article 41 makes clear that the Commission acts here because the standardisation route has not produced what is needed. A provider may also choose not to follow a common specification — but if it does, it must adopt technical solutions that meet the requirements at least to an equivalent level, and justify that choice. The presumption is a convenience, not the only lawful path.
Common specifications vs harmonised standards (Article 40)
These two instruments do the same job — confer a presumption of conformity — but they are produced very differently. The distinction matters because it tells a provider which document to reach for and why.
| Harmonised standard (Article 40) | Common specification (Article 41) | |
|---|---|---|
| Who writes it | European standardisation bodies (CEN, CENELEC, ETSI) on a Commission request | The European Commission directly |
| Legal instrument | Reference published in the Official Journal | Commission implementing act |
| When it is used | The default and preferred route | Fallback where harmonised standards are absent, delayed, or insufficient |
| Legal effect | Presumption of conformity with the covered requirements | The same presumption of conformity |
| Mandatory? | No — voluntary, but the easiest route | No — but a provider departing from it must show equivalence |
The relationship between the two is sequential. Harmonised standards are the intended workhorse; common specifications exist because, for a regulation as new as the AI Act, the standards may not arrive in time or may not cover everything. Where a harmonised standard later appears and covers the same ground, it can supersede the common specification. As of October 2026 that gap is real: CEN-CENELEC JTC 21 is still finalising the AI Act standards and none has yet been cited in the Official Journal, so no presumption of conformity is available through Article 40 yet.
How both feed the Article 43 conformity assessment
A presumption of conformity is not the conformity assessment itself — it is an input to it. Article 43 sets out the conformity-assessment procedures a provider must complete before placing a high-risk system on the market: for most Annex III categories (points 2–8) the Annex VI internal-control route, and for biometrics (Annex III, point 1) where harmonised standards are not applied, the Annex VII notified-body route.
Conforming to a harmonised standard or a common specification makes that assessment easier and more defensible: for the requirements the standard or specification covers, the provider can rely on the presumption rather than constructing a bespoke compliance argument. It does not remove the duty to actually run the Article 43 procedure, draw up the Article 47 Declaration of Conformity, and register the system under Article 49. Standards and specifications are scaffolding for the assessment, not a substitute for it — the same caution that applies to ISO/IEC 42001 and the NIST AI RMF, which support but do not equal the Article 43 conformity assessment.
Worked example: Pflegebrücke GmbH, a 70-person health-AI provider
Pflegebrücke GmbH, a Munich firm of ~70 employees and ~€11M turnover, builds a high-risk AI system used in an Annex III area. As its conformity assessment approaches, the team confronts the standards question.
Suppose that by then, for some of the Chapter III, Section 2 requirements — risk management under Article 9, data governance under Article 10 — harmonised standards under Article 40 have been cited in the Official Journal, so Pflegebrücke designs against them and claims the presumption of conformity for those requirements. For another requirement, no harmonised standard exists yet, but the Commission has adopted a common specification under Article 41 covering it. Pflegebrücke builds to the common specification and claims the presumption there too.
The combined effect: across most of its high-risk requirements, Pflegebrücke can rely on a published presumption of conformity, which simplifies its Article 43 assessment and the technical documentation it must assemble under Article 11 / Annex IV. It still completes the conformity-assessment procedure, draws up the Article 47 Declaration of Conformity, and registers under Article 49 — by 2 December 2027 for the stand-alone Annex III route under the adopted Digital Omnibus deferral. The standards did not exempt Pflegebrücke from anything; they made the proof tractable.
The team's takeaway: harmonised standards and common specifications are the difference between a conformity assessment you can defend against a published benchmark and one you have to argue entirely from the regulation's text. On exposure, a high-risk requirements breach sits at €15,000,000 or 3% of worldwide annual turnover under Article 99(4), with the Article 99(6) SME cap taking the lower of the two figures.
How Confir helps
Confir maps each high-risk requirement of Chapter III, Section 2 to the obligations your system must meet and tracks whether you are relying on an Article 40 harmonised standard, an Article 41 common specification, or a bespoke argument for each — so the Article 43 conformity assessment, the Article 11 / Annex IV documentation, and the Article 47 Declaration of Conformity all rest on a clear, documented basis. The engine is deterministic and rule-based: the same intake produces the same requirement map, with the rule that fired shown in plain English.
Frequently Asked Questions
What is a common specification under the EU AI Act?
A common specification is a technical document adopted by the European Commission through an implementing act under Article 41, setting out concrete requirements a high-risk AI system can meet to be presumed compliant with parts of the Act. It is the fallback for when harmonised standards under Article 40 are absent, delayed, or insufficient, and it grants the same presumption of conformity as a harmonised standard.
How do common specifications differ from harmonised standards?
Both confer a presumption of conformity, but they are produced differently. Harmonised standards are written by European standardisation bodies (CEN, CENELEC, ETSI) on a Commission request and referenced in the Official Journal; they are the default route. Common specifications are written directly by the Commission as implementing acts and used only as a fallback where standards do not yet do the job. A harmonised standard can later supersede a common specification on the same ground.
Are common specifications mandatory?
No. Neither harmonised standards nor common specifications are mandatory. A provider may design a system to meet the requirements through other technical solutions. But if you depart from a common specification, Article 41 requires you to adopt solutions that meet the requirements at least to an equivalent level, and to justify that choice. Following the specification simply gives you the convenience of a presumption of conformity.
Does conforming to a common specification complete my conformity assessment?
No. A common specification gives you a presumption of conformity with the requirements it covers — an input to the assessment, not the assessment itself. You must still run the Article 43 conformity-assessment procedure (the Annex VI internal-control route for most Annex III categories, or the Annex VII notified-body route for biometrics), draw up the Article 47 Declaration of Conformity, and register the system under Article 49.
Which requirements can a common specification cover?
Common specifications under Article 41 can cover the high-risk requirements in Chapter III, Section 2 — that is, Articles 9 to 15, including risk management, data governance, technical documentation, transparency, human oversight, and accuracy and robustness — and, where relevant, the obligations on GPAI model providers. The specification names the requirements it addresses, and the presumption of conformity applies only to those.
When do these requirements actually apply?
The high-risk requirements that common specifications support apply from 2 December 2027 for stand-alone Annex III systems and from 2 August 2028 for high-risk AI embedded in Annex I products. Those dates are the law: Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. Plan against 2 December 2027.
Related guides
- Harmonised standards — Article 40 and the presumption of conformity
- Conformity assessment — what Article 43 requires
- Article 40 — harmonised standards explained
- Article 41 — common specifications explained
- Article 43 — conformity assessment procedures
- Declaration of Conformity — Article 47 and Annex V
- CE marking — Article 48 explained
- Notified body — definition and role
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →