Conformity Assessment

The conformity assessment route depends on the system's classification and the use of harmonized standards. For most high-risk systems, providers may conduct an internal control (self-assessment) based on Annex VI of the AI Act. However, systems in critical domains like biometrics or law enforcement require a Notified Body—an independent third-party organization—to audit the quality management system and technical documentation.

A certified Quality Management System (QMS) is a non-negotiable prerequisite for self-assessment. The QMS must document the provider's strategy for regulatory compliance, covering the entire lifecycle from design to decommissioning. Key elements include:

• Design control and verification procedures
• Risk management protocols
• Post-market monitoring plans
• Incident reporting workflows Without a certified QMS, the provider cannot legally conduct an internal conformity assessment.

The assessment hinges on a comprehensive Technical Documentation File that proves compliance. This dossier must include a general system description, detailed design specifications, model development methodology, and the results of the risk management process. The documentation must be sufficiently transparent to allow authorities to verify that the system meets mandatory requirements for accuracy, robustness, and cybersecurity, and must be kept for 10 years after market placement.

Providers can streamline the process by adhering to harmonized standards published in the Official Journal of the EU. Compliance with these standards grants a legal 'presumption of conformity' with the AI Act's essential requirements. This mechanism reduces the scope of the audit, allowing the provider to focus verification efforts only on areas not covered by the standard, significantly lowering the administrative burden of the assessment.

The final output of a successful assessment is a legally binding Declaration of Conformity. By signing this document, the provider formally assumes full responsibility for the system's compliance. The declaration must contain the system's unique identification, the provider's name and address, and a reference to the relevant harmonized standards. This document is a prerequisite for affixing the CE marking and registering the system in the EU database.

An independent third-party organization designated by an EU member state to conduct external conformity assessments for high-risk AI systems. These bodies possess the technical competence to audit systems where self-assessment is insufficient, such as those involving biometric identification or critical infrastructure. A provider must select a notified body from the official NANDO database to perform the required evaluation before a CE marking can be affixed.

A European technical specification adopted by a recognized standards body like CEN or CENELEC. When a provider designs and tests an AI system in strict accordance with a harmonized standard, they benefit from a presumption of conformity with the essential requirements of the regulation. This significantly streamlines the conformity assessment process by reducing the burden of proof for specific technical criteria.

A change to an AI system's intended purpose or a modification that alters its risk profile beyond what was covered in the original conformity assessment. This event legally transforms the provider into a new manufacturer, triggering a mandatory fresh assessment. Examples include repurposing an HR chatbot for medical triage or updating a model with data that introduces new safety risks.

The continuous, systematic process by which providers must collect and analyze data on the real-world performance of an AI system after it has passed conformity assessment. This is not a one-time event but an ongoing obligation to feed operational data back into the risk management system. Findings may trigger a new assessment if they reveal previously unidentified residual risks.

The physical or digital mark affixed to a product indicating compliance with all applicable EU harmonization legislation. For AI systems, the CE marking is the visible outcome of a successful conformity assessment. It serves as a regulatory passport, allowing free movement of the product across the single market. Affixing a CE mark without proper assessment is a criminal offense in member states.