Conformity Assessment

The EU AI Act distinguishes between internal control and notified body assessment paths based on risk severity.

• Internal Control (Annex VI): For certain high-risk systems, the provider may self-declare conformity by compiling technical documentation and issuing a declaration themselves.
• Notified Body Assessment (Annex VII): For systems listed in Annex III, point 1 (biometric categorization) and other high-criticality areas, an independent accredited third party must audit the quality management system and technical documentation.
• Trigger: The involvement of a notified body is mandatory when harmonized standards are not applied or do not fully cover the system's requirements.

Providers must establish and maintain a documented Quality Management System (QMS) that governs the entire AI lifecycle. The conformity assessment verifies this system's adequacy.

• Design Control: Procedures for system design, development, and verification.
• Risk Management: Documented processes for identifying, estimating, and mitigating risks throughout the system's lifecycle.
• Post-Market Monitoring: A structured plan for collecting and analyzing real-world performance data after deployment.
• Incident Reporting: Clear protocols for notifying authorities of serious incidents or malfunctions.
• Record Keeping: Traceable documentation of all QMS processes, decisions, and corrective actions.

The core of any conformity assessment is the rigorous review of the technical documentation file that proves the system's compliance.

• System Architecture: Detailed description of the AI model, algorithms, data flows, and integration points.
• Data Governance: Evidence of training, validation, and testing dataset quality, provenance, and bias examination.
• Accuracy & Robustness: Performance metrics, error rates, and results from adversarial testing.
• Human Oversight: Built-in mechanisms that allow human operators to interpret, override, or halt the system.
• Cybersecurity: Documentation of defenses against adversarial attacks, data poisoning, and unauthorized access.

A legal mechanism that streamlines the assessment process. If a high-risk AI system is designed and tested in full compliance with harmonized standards published in the Official Journal of the EU, it is automatically presumed to meet the corresponding essential requirements.

• Efficiency: Reduces the burden of proof for providers by aligning with pre-approved technical specifications.
• Standardization Request: The European Commission issues formal mandates to bodies like CEN/CENELEC to draft these standards.
• Gap Analysis: If harmonized standards do not exist or are only partially applied, the provider must describe the alternative solutions adopted and the notified body must verify their adequacy directly.

A conformity assessment is not a one-time event. A substantial modification to the AI system after market placement invalidates the original certificate and triggers a new assessment.

• Change in Intended Purpose: Any alteration to the system's defined use case or operational context.
• Performance Alteration: A significant change to the model's accuracy, error rate, or behavior that could affect safety or fundamental rights.
• Provider Responsibility: The original provider must continuously evaluate whether software updates, retraining, or integration changes constitute a substantial modification.
• Continuous Compliance: This ensures the system's risk profile remains valid throughout its operational lifecycle.

The successful completion of the conformity assessment culminates in two formal legal instruments that permit market access.

• EU Declaration of Conformity: A legally binding document signed by the provider stating the system meets all applicable regulations. It must be kept for 10 years and translated into the language of the member state where the system is placed.
• CE Marking: A physical or digital mark affixed to the system or its packaging. It is the visible symbol of compliance, indicating the product can circulate freely within the European Economic Area.
• Registration: Before placing the system on the market, the provider must register it in the EU's public database for high-risk AI systems.