Conformity Assessment Plan Template (EU AI Act, Article 43)
A conformity-assessment plan template: pick the Article 43 route (Annex VI vs Annex VII), map Article 9–15 evidence, sequence the Article 47–49 steps.
A conformity-assessment plan is the document that turns "we have a high-risk AI system" into a sequenced route to market. It records which Article 43 assessment route applies, what evidence each high-risk requirement (Articles 9–15) needs, and the order of the final steps — the Article 47 Declaration of Conformity, the Article 48 CE marking, and the Article 49 registration. The plan itself is not a statutory artefact — the Act requires the conformity assessment, not a "plan" document. But running the assessment without one is how providers discover, weeks before launch, that they chose the wrong route or are missing a piece of Annex IV evidence. The plan is the practice; the conformity assessment is the law. This page gives you the structure.
This is a provider's instrument. Conformity assessment under Article 43 is a provider duty, owed by whoever develops the high-risk system and places it on the market under their own name.
Step one: choose the Article 43 route
Conformity assessment is the EU's term for proving, before launch, that a high-risk system meets the Chapter III requirements. Article 43 sets out two routes, and which one applies turns on the kind of system:
| System | Route | What it means |
|---|---|---|
| Annex III points 2–8 (most high-risk: employment, creditworthiness, essential services, education, etc.) | Annex VI — internal control | The provider self-assesses against the requirements; no notified body needed |
| Annex III point 1 (biometrics) where no harmonised standard is fully applied | Annex VII — notified body | An independent notified body assesses the quality management system and the technical documentation |
| Annex I Section A product-safety components (medical devices, IVDs, toys, lifts, radio equipment, etc.) | Sectoral route | Conformity runs through the product legislation (MDR/IVDR, etc.), integrating the AI Act requirements (Article 43(3)) |
The headline rule: biometrics (Annex III point 1) is the route that can require a notified body under Annex VII; the other Annex III areas (points 2–8) go through Annex VI internal control. Even for biometrics, full application of the relevant harmonised standards (once cited in the Official Journal — none is yet) can keep a provider on the internal-control route — so the plan should state the route and the reason, because that reasoning is itself evidence.
Machinery has left the sectoral row. The Digital Omnibus moved the Machinery Regulation (EU) 2023/1230 into Annex I Section B, so AI in machinery now receives its AI requirements through Machinery Regulation delegated acts applying by 2 August 2028, not through an Article 43 assessment. And under Article 43(3) a Section A product does not need a notified body merely because it contains a high-risk AI safety component, if its own sectoral law would not require one.
Get this choice wrong and the rest of the plan is built on sand. It is the first decision the plan records, with the Annex III point and the route justification.
Step two: map the Article 9–15 evidence
Whichever route applies, the substance is the same: the system must satisfy the high-risk requirements, and you must be able to prove it. The plan's core is an evidence map — each requirement, the artefact that proves it, and its status.
| Requirement | What it is | Evidence artefact |
|---|---|---|
| Article 9 | Risk management system | Risk-management plan and records across the lifecycle |
| Article 10 | Data and data governance | Data-governance record; bias examination |
| Article 11 | Technical documentation | The Annex IV technical-documentation pack |
| Article 12 | Record-keeping / logging | Logging design and capability description |
| Article 13 | Transparency to deployers | Instructions for use |
| Article 14 | Human oversight | Oversight design and override mechanisms |
| Article 15 | Accuracy, robustness, cybersecurity | Model-validation report; declared accuracy metrics |
The evidence map is what makes the plan operational. It converts seven statutory requirements into a checklist of named documents with owners and a red/amber/green status, so the gaps are visible months out, not at the assessment itself. The Article 11 / Annex IV technical documentation is the spine — most of the other artefacts cross-reference into it.
Step three: sequence the declaration, marking, and registration
Once the requirements are met and the assessment passes, three closing steps run in order — and the plan sequences them because doing them out of order, or skipping one, is a documented compliance failure:
- Draw up the EU Declaration of Conformity (Article 47). The provider issues a written declaration that the system meets the high-risk requirements. Its required content is set out in Annex V — system identity, the provider, the standards applied, and the statement of conformity. The provider keeps it for ten years.
- Affix the CE marking (Article 48). The CE marking is the visible sign that the system has passed conformity assessment. It goes on the system (or its documentation/packaging) and, where a notified body was involved, carries that body's identification number.
- Register in the EU database (Article 49). Before placing the system on the market or putting it into service, the provider registers it in the EU database (the database itself is Article 71; the duty to register is Article 49). The data recorded is set out in Annex VIII.
The plan also notes the ten-year retention duty (Article 18) for the technical documentation and the Article 17 quality management system that underpins the whole process.
The SME relief the plan should record
Several reliefs matter for smaller providers and belong in the plan. Article 11(1) lets SMEs — and, since the Digital Omnibus, small mid-caps (SMCs, broadly non-SMEs under 750 staff) — use a simplified form of technical documentation that the Commission is to establish: the same Annex IV substance, lighter format. Article 17(2) lets both run a quality management system proportionate to their size. The Article 99(6) SME/start-up penalty cap means a fine is the lower of the percentage or the fixed amount, not the higher, and Article 99(6a) gives SMCs the same cap for fines under Article 99(4) and (5) — reassurance worth recording, though the goal of the plan is to avoid a fine entirely. (The Article 99 tiers are €35M/7%, €15M/3%, and €7.5M/1%.) Article 62 also provides for proportionate conformity-assessment fees for SMEs on the notified-body route.
The fields to capture
1. System identity and classification — name, version, intended purpose, the Annex III point (or Annex I product), and the provider role.
2. Route decision (Article 43) — Annex VI internal control vs Annex VII notified body vs sectoral, with the reason and any harmonised standards applied.
3. Notified body (if Annex VII) — selection, scope, and the Article 62 SME-fee position.
4. Evidence map (Articles 9–15) — each requirement, its artefact, owner, and status.
5. Technical documentation (Article 11 / Annex IV) — the pack, with the Article 11(1) simplified SME/SMC-form note where applicable.
6. Quality management system (Article 17) — the QMS the process runs under, proportionate for SMEs and SMCs (Article 17(2)).
7. Declaration of Conformity (Article 47 / Annex V) — drafted, with the Annex V content checklist.
8. CE marking (Article 48) — affixing plan; notified-body number if applicable.
9. Registration (Article 49) — EU-database entry, sequenced before placing on the market.
10. Retention and sign-off (Article 18) — ten-year retention plan; reviewer, role, and date.
Worked example: a fintech provider planning its route
Saldoria SL, a Spanish fintech provider with about 80 employees and roughly €19M turnover, develops a creditworthiness-scoring system for consumer lending. Its conformity-assessment plan opens with the route decision: creditworthiness is Annex III point 5(b) — that is points 2–8, not biometrics — so it runs through Annex VI internal control, no notified body required, and the plan records exactly that reasoning. The evidence map then lists the seven artefacts: an Article 9 risk-management plan, the Article 10 data-governance and bias records, the Article 11 / Annex IV documentation pack (using the Article 11(1) simplified SME form), the Article 12 logging description, the Article 13 instructions for use, the Article 14 oversight design, and the Article 15 model-validation report — each with an owner and a status. The closing sequence is set: draft the Article 47 / Annex V Declaration of Conformity, affix the CE marking (Article 48), then register in the EU database (Article 49) before going live. With the plan in hand, Saldoria's compliance lead can see in one page that two artefacts are still amber four months out — and fixes them before the assessment, not during it. (Stand-alone Annex III high-risk obligations apply from 2 December 2027, the date set by the Digital Omnibus, Regulation (EU) 2026/1744 — Saldoria plans against 2 December 2027.)
How Confir helps
Confir's risk-classification-and-compliance assessment determines the Annex III point and the Article 43 route, then opens the Article 9–15 evidence map as structured fields and assembles the Article 11 / Annex IV pack and the Article 47 / Annex V Declaration of Conformity from the same record. The route logic is deterministic and rule-based: a creditworthiness use always routes to Annex VI, a biometrics use flags the possible Annex VII notified-body route, and the rule that fired is shown in plain language — so the plan's first and most consequential decision is reproducible, not a judgement call made under deadline.
Frequently Asked Questions
What is a conformity-assessment plan and is it legally required?
It is a document that records which Article 43 route a high-risk system takes, what evidence each Article 9–15 requirement needs, and the sequence of the Article 47 declaration, Article 48 CE marking, and Article 49 registration. The Act requires the conformity assessment, not a "plan" document — the plan is a practice that makes the assessment achievable and auditable. It supports the statutory duty; it does not replace it.
How do I choose between the Annex VI and Annex VII routes?
It turns on the Annex III area. Biometrics (Annex III point 1) can require the Annex VII notified-body route, where an independent body assesses the quality management system and technical documentation. The other high-risk areas (Annex III points 2–8 — employment, creditworthiness, essential services, and so on) go through Annex VI internal control, a provider self-assessment. Full application of the relevant harmonised standards, once they are cited in the Official Journal (none is yet), can keep even a biometrics system on the internal-control route. Record the route and the reason.
What evidence does the conformity assessment need?
Proof that the system meets the high-risk requirements: an Article 9 risk-management system, Article 10 data governance, the Article 11 / Annex IV technical documentation, Article 12 logging, Article 13 instructions for use, Article 14 human oversight, and Article 15 accuracy/robustness/cybersecurity. The plan's evidence map lists each requirement, its artefact, an owner, and a status, so gaps are visible months before the assessment rather than at it.
What are the Article 47, 48, and 49 steps after assessment passes?
In order: draw up the EU Declaration of Conformity (Article 47, content per Annex V) and keep it for ten years; affix the CE marking (Article 48), carrying a notified body's number where one was involved; and register the system in the EU database (Article 49, the database being Article 71) before placing it on the market or putting it into service. Doing these out of order, or skipping one, is a documented failure.
Is there relief for SMEs in the conformity process?
Yes. Article 11(1) allows SMEs and, since the Digital Omnibus, small mid-caps (SMCs) a simplified form of technical documentation — the same Annex IV substance, lighter format — and Article 17(2) a proportionate quality management system. Article 62 provides for proportionate conformity-assessment fees for SMEs on the notified-body route. And the Article 99(6) cap means an SME fine is the lower of the percentage or fixed amount; Article 99(6a) gives SMCs the same cap for Article 99(4) and (5) fines. None of these removes the duty, but they make the path proportionate for smaller providers.
When does the conformity-assessment obligation apply?
Stand-alone high-risk obligations under Annex III apply from 2 December 2027 under the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026 — plan against 2 December 2027. Annex I product-embedded high-risk systems follow on 2 August 2028 (for machinery, through Machinery Regulation delegated acts rather than Article 43). Conformity assessment must be completed before the system is placed on the market in any case.
Related guides
- Article 43 conformity assessment — the two routes, in full
- Conformity assessment route — Annex VI vs Annex VII — choosing the route, step by step
- Conformity assessment steps — the end-to-end sequence
- Annex V Declaration of Conformity — the Article 47 declaration content
- EU database registration (Article 49) — the final registration step
- Conformity assessment checklist template — the requirement-by-requirement checklist
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →