Conformity Assessment (EU AI Act): Definition and the Two Routes
EU AI Act Article 3(20): conformity assessment proves a high-risk AI system meets Articles 8-15. The two Article 43 routes — Annex VI or Annex VII — explained.
Conformity assessment is the process of proving — on paper and in your engineering records — that a high-risk AI system meets the EU AI Act before you put it on the market. It is not a generic obligation for all AI. It is the structured exercise that turns the Article 8-15 requirements into a signed, defensible claim of compliance, for high-risk systems only.
The EU AI Act definition
Article 3, point 20 of Regulation (EU) 2024/1689 defines conformity assessment as:
"the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled."
In plain language: it is the work of proving your high-risk system meets the Articles 8-15 obligations before the system is placed on the market — risk management (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency (Article 13), human oversight (Article 14), and accuracy, robustness and cybersecurity (Article 15).
The scope boundary matters. Conformity assessment applies to high-risk systems only. Limited-risk systems carry only the Article 50 transparency duties, and an Article 5 prohibited practice cannot be assessed into compliance — it is simply banned.
One distinction to keep straight. The conformity assessment is the process. The organisation that may run a third-party version of it is the conformity assessment body (Article 3, point 21). The signed output is the EU declaration of conformity (Article 47). Three different things, three different definitions.
The two routes under Article 43
Article 43 prescribes exactly two procedures. There is no third option.
Annex VI — internal control (self-assessment)
Annex VI is the default for stand-alone Annex III high-risk systems in points 2 to 8 — critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and justice and democratic processes. The provider verifies its own system against the Chapter III, Section 2 requirements, draws up the technical documentation, and confirms compliance. No notified body is involved; the provider carries the responsibility, and the records must stand up to a market surveillance authority later.
Annex VII — third-party assessment
Annex VII brings in a notified body to assess the quality management system and the technical documentation. It is mandatory for Annex III, point 1 biometric systems — biometric identification and categorisation — where the provider has not fully applied harmonised standards or the Article 41 common specifications covering the Chapter III, Section 2 requirements. Where those standards are applied in full, the provider may choose either route.
The caveat that decides the route in practice
Harmonised standards for the AI Act are still in development. As of mid-2026 there is no complete set a biometrics provider can point to and say "applied in full", so most currently fall into the mandatory Annex VII path. Verify what standards actually exist for your specific system before assuming you have a choice.
Route comparison table
| System type | Harmonised standards applied in full? | Assessment route |
|---|---|---|
| Annex III points 2-8 (critical infrastructure, education, employment, essential services, law enforcement, migration, justice) | N/A | Annex VI internal control — no notified body |
| Annex III point 1 biometrics, standards applied in full | Yes | Provider's choice: Annex VI or Annex VII |
| Annex III point 1 biometrics, standards partial or none yet exist | No | Annex VII notified body — mandatory |
| Safety component of an Annex I product | Routed via sectoral law | Article 43(3): assessment runs through the applicable product legislation |
The last row is the trap. A high-risk AI system that is a safety component of a product already regulated under Annex I — a medical device under the MDR, machinery under Regulation (EU) 2023/1230 — does not take Articles 8-15 directly. Under Article 43(3) the AI requirements fold into the existing sectoral conformity assessment, and the notified body already reviewing the product reviews the AI component too.
What the conformity assessment produces
Take Lumière Diagnostics, a fictional Lyon-based company of 40 people building a stand-alone biometric access-control system for hospitals — Annex III, point 1. Because no complete harmonised standard yet covers its requirements, Lumière takes the Annex VII route, and the completed assessment leads to three outputs.
First, the provider draws up the EU declaration of conformity under Article 47 — the signed statement that the system meets the Chapter III, Section 2 requirements, retained for 10 years. Then it affixes the CE marking under Article 48 and registers the system in the EU database under Articles 49 and 71 before placing it on the market.
The assessment is not a one-time gate. A substantial modification or a change of intended purpose can make a deployer, importer or distributor a provider under Article 25 and trigger a fresh assessment. The quality management system required by Article 17 underpins it either way — it is what makes the records reproducible when the modification or the regulator arrives.
Timeline — plan against 2 December 2027
For stand-alone Annex III high-risk systems, the obligations under Article 6(2) read in statute as applying from 2 August 2026. The Digital Omnibus defers this to 2 December 2027; the European Parliament adopted it on 16 June 2026 and the Council on 29 June 2026, and it enters into force on publication in the Official Journal, expected before 2 August 2026. Plan against 2 December 2027.
How Confir helps
For most companies, conformity assessment is an internal exercise, and the hard part is not the verdict but the evidence behind it: a working risk management system (Article 9), the technical documentation (Article 11, Annex IV), and records demonstrating each Article 8-15 requirement has been met.
Confir's compliance tool classifies your system against Article 43 — Annex VI or Annex VII — and assembles the Annex IV documentation pack and the Article 47 EU declaration of conformity as structured outputs. The engine is deterministic and rule-based: no model inference, no hallucination, the same inputs producing the same findings with the rule that fired named for each result.
Frequently asked questions
What is conformity assessment under the EU AI Act?
Article 3, point 20 defines it as the process of demonstrating whether the Chapter III, Section 2 requirements relating to a high-risk AI system have been fulfilled. In practice it is the structured exercise of proving a high-risk system meets the Article 8-15 obligations — risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy, robustness and cybersecurity — before it is placed on the market. It is required for high-risk systems, not for all AI.
Do most high-risk AI systems need a notified body?
No. For stand-alone Annex III systems in points 2-8 — critical infrastructure, education, employment, essential services, law enforcement, migration and justice — Annex VI internal control applies, and no notified body is involved. The mandatory third-party route under Annex VII is limited to Annex III point 1 biometric systems that have not fully applied the relevant harmonised standards. Because AI Act harmonised standards are still being developed, most biometrics providers currently fall into that mandatory path.
What does a conformity assessment produce?
A completed assessment leads the provider to draw up the EU declaration of conformity under Article 47 — a signed statement that the system meets the Chapter III, Section 2 requirements, kept for 10 years. The provider then affixes the CE marking under Article 48 and registers the system in the EU database under Articles 49 and 71 before placing it on the market. A substantial modification or change of intended purpose can trigger a fresh assessment under Article 25.
When do conformity assessment obligations apply?
For stand-alone Annex III high-risk systems, the obligations under Article 6(2) read in statute as applying from 2 August 2026. The Digital Omnibus defers this to 2 December 2027; the European Parliament adopted it on 16 June 2026 and the Council on 29 June 2026, and it enters into force on publication in the Official Journal, expected before 2 August 2026. Plan your conformity assessment work against 2 December 2027.
Related terms
- Article 43 conformity assessment procedures — the article prescribing which route, Annex VI or Annex VII, applies to which high-risk systems
- Conformity assessment body — the independent organisation that performs third-party assessment, distinct from the process itself
- Notified body — a designated conformity assessment body that carries out the Annex VII assessment
- EU declaration of conformity — the signed Article 47 statement produced once the assessment is complete
- Run a conformity assessment with Confir — classify your system and generate the Annex IV documentation pack
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →