Pre-Market Assessment

The foundational review of the provider's iterative risk management process. Auditors verify that the system identifies, estimates, and mitigates reasonably foreseeable risks to health, safety, and fundamental rights. This includes examining the residual risk acceptance criteria and ensuring risks are minimized through design and development, not just post-hoc measures. The audit confirms the process is a living system, updated continuously throughout the AI lifecycle.

A rigorous examination of the training, validation, and testing datasets. Assessors scrutinize data for statistical bias, errors, and relevance to the system's intended purpose. This involves verifying data provenance, lineage, and the governance processes for collection and labeling. The goal is to confirm the data meets strict quality criteria and does not encode discriminatory patterns that would violate fundamental rights, ensuring the model's decisions are grounded in representative, high-integrity information.

A comprehensive audit of the system's design dossier. This documentation must provide a complete, transparent picture of the AI system, including its intended purpose, architecture, design specifications, and performance metrics. The review confirms the dossier is sufficiently detailed for authorities to assess compliance. Key elements include a description of the system's interaction with hardware, the logic of its algorithms, and the human oversight measures built into its operational interface.

An assessment of the system's ability to provide clear, meaningful information to deployers and end-users. For high-risk systems, this means verifying that the operation is sufficiently transparent to enable deployers to interpret the system’s output and use it appropriately. This includes testing the interpretability of model decisions, ensuring users are informed they are interacting with an AI, and validating that the logic behind consequential decisions can be explained in a human-understandable format.

A functional test of the built-in human control mechanisms. Assessors validate that the system's interface allows for meaningful human intervention, not just a tokenistic override. This involves verifying that a human operator has the competence, authority, and real-time capacity to monitor the system, interpret its outputs, and disregard or reverse an automated decision. The audit ensures the oversight measures prevent automation bias and enable effective human-on-the-loop or human-in-the-loop control.

A technical evaluation of the system's resilience against errors, faults, and malicious attacks. This includes testing for adversarial robustness—the ability to withstand evasion, data poisoning, and model inversion attempts. Assessors verify the system achieves an appropriate level of accuracy, robustness, and cybersecurity throughout its lifecycle. The process confirms that fallback plans and corrective measures exist for system failures, ensuring the AI does not become a critical vulnerability in a production environment.

The mandatory verification process by which a provider demonstrates that a high-risk AI system meets all applicable regulatory requirements prior to market placement. This is the core procedural mechanism of pre-market assessment.

• Can be based on internal control (Annex VI) or require a notified body (Annex VII)
• Verifies compliance with the essential requirements of the EU AI Act
• Results in the declaration of conformity and affixing of CE marking

An independent, accredited third-party organization designated by an EU member state to conduct conformity assessments of high-risk AI systems. These entities are the gatekeepers of market access for systems requiring external validation.

• Must be formally accredited for specific categories of AI systems
• Assesses technical documentation and quality management systems
• Issues EU-type examination certificates for compliant systems

The comprehensive dossier a provider must compile to demonstrate a high-risk AI system's design, development, and compliance. This is the evidentiary backbone of any pre-market assessment.

• Includes detailed descriptions of system architecture, training data, and performance metrics
• Must be kept for 10 years after market placement
• Enables market surveillance authorities to verify ongoing compliance

European technical specifications adopted by recognized standards bodies that provide presumption of conformity when applied. Adherence to these standards simplifies the pre-market assessment process significantly.

• Developed in response to a standardization request from the European Commission
• Covers areas like risk management, data quality, and human oversight
• Allows providers to avoid case-by-case justification of technical choices

A physical or digital mark affixed to an AI system indicating the manufacturer's declaration that the product complies with all applicable EU harmonization legislation. It is the visible outcome of a successful pre-market assessment.

• Must be affixed before the system is placed on the market
• Indicates compliance with the AI Act and other relevant directives
• Its absence or misuse triggers market surveillance authority intervention

A change to an AI system's intended purpose or a significant alteration to its performance characteristics that triggers a new conformity assessment. The original certification becomes void.

• Includes changes to the underlying algorithm or training data that materially affect outputs
• Shifts in intended purpose always constitute substantial modification
• The entity making the modification becomes the new provider under the Act