EU AI Act Conformity Assessment: Routes, Notified Bodies and CE Marking

Which conformity assessment route applies to your high-risk AI system, when a notified body is required, and what CE marking, the EU declaration and registration involve.

Conformity assessment is the gate, not the goal

For a high-risk AI system, conformity assessment is the procedure that lets you place the system on the EU market lawfully. It does not create the requirements — those come from Chapter III, Section 2 — it verifies that you have met them and produces the paper trail.

The sequence is always the same:

1. Meet the substantive requirements (Art. 9–15) — see high-risk obligations.
2. Run the applicable conformity assessment procedure.
3. Draw up the EU declaration of conformity (Art. 47).
4. Affix the CE marking (Art. 48).
5. Register in the EU database (Art. 49).
6. Keep documentation for 10 years and run post-market monitoring.

Skipping straight to step 2 is the most common failure mode. There is nothing to assess until the Article 9–15 work is done.

Which route applies

The practical consequence is that most Annex III providers self-assess. The notified-body route is the exception, concentrated on biometrics — and even there, applying harmonised standards in full returns you to internal control. That is a strong commercial argument for tracking the standards as they are published.

What internal control actually requires

Annex VI is short, and its brevity is misleading. The provider must verify that:

• the quality management system conforms to Article 17
• the technical documentation is examined and demonstrates conformity with Article 9–15
• the design and development process and the post-market monitoring in Article 72 are consistent with that documentation

No one external checks this. But the market surveillance authority can demand all of it, and supplying incorrect or incomplete information carries its own penalty tier — €7.5 million or 1% of turnover under Article 99. Self-assessment lowers the process cost, not the evidentiary standard.

The quality management system

Article 17 is where many providers underestimate the workload. The QMS must be documented in written policies and procedures covering, among other things:

• a regulatory compliance strategy, including for conformity assessment and change management
• design, design control and design verification procedures
• development, quality control and quality assurance procedures
• examination, test and validation procedures, including the frequency at which they run
• technical specifications and the standards applied
• systems for data management across the whole data lifecycle
• the risk management system of Article 9
• post-market monitoring under Article 72
• incident reporting procedures under Article 73
• communication with authorities and notified bodies
• record-keeping
• resource management, including security-of-supply
• an accountability framework defining management and staff responsibilities

Providers already operating an ISO 9001 or ISO/IEC 42001 management system can extend it rather than build in parallel — but the AI-specific elements, particularly data management and Article 9 risk management, rarely exist already.

When you must reassess

A conformity assessment is not a one-off. A substantial modification requires a fresh assessment. Under the AI Act a change is not substantial if it was pre-planned and documented in the original technical documentation — including for systems that continue to learn after being placed on the market, provided the change stays within the pre-determined envelope.

The design implication is direct: define the intended change envelope in the initial technical documentation, or every model update becomes a substantial modification.

Note also that a deployer can trigger the obligation. Under Article 25, putting your name on a system, substantially modifying it, or changing its intended purpose so it becomes high-risk makes you the provider — with the full conformity assessment duty. See providers vs deployers.

Declaration, marking and registration

EU declaration of conformity (Art. 47) — drawn up by the provider, kept for 10 years, machine-readable where relevant, naming the system, the provider, the standards applied and the procedure followed. Where the system falls under several Union acts, a single declaration covers them all.

CE marking (Art. 48) — affixed visibly, legibly and indelibly, or digitally where the system is supplied digitally, provided it is easily accessible. Where a notified body was involved, its identification number accompanies the marking.

Registration (Art. 49) — providers register Annex III systems in the EU database before placing them on the market. Providers relying on the Article 6(3) exception register too, which is what makes the exception auditable. Deployers that are public authorities also register their use.

Timing

Following the 2026 Digital Omnibus, the obligations apply from 2 December 2027 for Annex III stand-alone systems and 2 August 2028 for Annex I embedded systems.

Those dates are the deadline for being assessed and marked, not for starting. A quality management system, an Annex IV documentation set and a validation programme are multi-quarter undertakings, and notified body capacity for the biometrics route is finite. Work backwards from the full timeline, and use the conformity selector to identify your route.