EU AI Act Conformity Assessment Checklist (Article 43)
A conformity assessment checklist for EU AI Act Article 43: the steps a high-risk system needs, and when a notified body is required vs self-assessment.
Before a high-risk AI system goes to market, its provider must run a conformity assessment under Article 43 of the EU AI Act, Regulation (EU) 2024/1689 — the procedure that demonstrates the system meets the Chapter III requirements. This page is the working checklist, with the one routing decision that trips people up: self-assessment versus a notified body.
The routing decision first
There are two routes:
- Annex VI — internal control (self-assessment). Used for most Annex III high-risk systems (points 2–8: critical infrastructure, education, employment, essential services, law enforcement, migration, justice). The provider assesses conformity itself.
- Annex VII — notified body. Required for Annex III point 1 (biometrics) where harmonised standards have not been applied or do not exist. A third-party notified body is involved.
Product-embedded high-risk systems (Annex I) run their conformity through the relevant sectoral legislation (e.g. medical devices, machinery) under Article 43(3). Establish your route before working the checklist.
The checklist (Annex VI internal-control route)
1. Confirm classification. The system is high-risk under Article 6 + Annex III, and you are the provider (including any Article 25 flip).
2. Quality management system (Article 17). A documented QMS is in place covering the design, development and post-market processes.
3. Requirements met (Articles 9–15). Evidence that the system satisfies: risk management (9), data governance (10), technical documentation (11, Annex IV), record-keeping/logging (12), transparency to deployers (13), human oversight (14), and accuracy, robustness and cybersecurity (15).
4. Technical documentation drawn up (Article 11, Annex IV). The full file exists and is current, retained 10 years (Article 18).
5. Assess conformity (Annex VI). Verify the QMS and the technical documentation against the requirements; document the assessment.
6. Declaration of Conformity (Article 47, Annex V). Draw up and sign it; keep it 10 years.
7. CE marking (Article 48). Affix it (physical or digital).
8. Register in the EU database (Article 49). Before placing the system on the market.
9. Plan post-market monitoring (Article 72). And the serious-incident process (Article 73).
Re-assessment on substantial modification
A substantial modification (Article 3(23)) — a change not foreseen in the original assessment that affects compliance or the intended purpose — triggers a fresh conformity assessment. Routine updates within the documented intended purpose do not. Build the trigger into your change process.
Worked example: a high-risk education provider
Lyceum Analytics builds a high-risk student-evaluation system (Annex III point 3). Because it is not biometrics, it uses the Annex VI internal-control route: it stands up a QMS, assembles the Annex IV documentation with evidence against Articles 9–15, self-assesses, draws up the Declaration of Conformity, CE-marks the system, and registers it under Article 49 — all before launch. A later change to add facial-based proctoring would shift it toward biometrics and the Annex VII notified-body route, and trigger a re-assessment.
How Confir helps
Confir structures the assessment around your specific high-risk system — routing you to Annex VI or Annex VII, assembling the Article 11 / Annex IV documentation, tracking the Articles 9–15 evidence, and generating the Article 47 Declaration — with an audit log of each step. The engine is deterministic and rule-based, so the checklist reflects your recorded inputs.
Frequently asked questions
What is a conformity assessment under the EU AI Act?
It is the Article 43 procedure by which a provider demonstrates that a high-risk AI system meets the Chapter III requirements before it goes to market. It runs either through internal control (Annex VI) or, for biometrics without harmonised standards, a notified body (Annex VII).
When do I need a notified body?
For Annex III point 1 (biometrics) where harmonised standards have not been applied or do not exist, the Annex VII notified-body route applies. Most other Annex III systems (points 2–8) use the Annex VI internal self-assessment route. Annex I product-embedded systems run through their sectoral legislation.
What does the assessment require evidence of?
That the system meets Articles 9–15 (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy/robustness/cybersecurity), supported by a quality management system (Article 17) and the Annex IV technical documentation, ending in the Declaration of Conformity (Article 47).
Do I need to re-run it if the system changes?
Yes, on a substantial modification under Article 3(23) — a change not foreseen in the original assessment that affects compliance or the intended purpose. Routine updates within the documented intended purpose do not trigger a fresh assessment.
When does this obligation apply?
Conformity assessment attaches to high-risk systems. Stand-alone high-risk Annex III obligations originally read 2 August 2026 in the statute, but the Digital Omnibus — adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026 — defers this to 2 December 2027. It enters into force on Official Journal publication, expected before 2 August 2026, so plan against 2 December 2027.
Related guides
- Conformity assessment, defined
- EU Declaration of Conformity
- CE marking under the AI Act
- EU database registration
- Annex III high-risk use cases
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →