Pre-Market Authorization

Unlike self-assessment, pre-market authorization requires an independent Notified Body to audit the AI system. This body verifies that the Quality Management System and Technical Documentation File meet the essential requirements of the EU AI Act. The assessment focuses on the robustness of the risk management system, the quality of training data provenance records, and the validity of the intended purpose declaration. Only upon successful completion can the provider draft the legally binding Declaration of Conformity.

This authorization functions as an ex-ante (before the event) control, halting market entry until compliance is verified. It is the definitive step before affixing the CE marking and submitting data to the EU AI Act Database. The process ensures that residual risk disclosure has been transparently documented and that any remaining risks are acceptable. This gate is distinct from post-market monitoring, which occurs continuously after deployment to track real-world performance and trigger incident reporting linkage if necessary.

Authorization is not perpetual. A substantial modification—any change to the AI system's intended purpose or a performance alteration that affects compliance—automatically voids the existing authorization. This triggers a mandatory new conformity assessment. Examples include repurposing a medical diagnostic AI for financial risk scoring or updating a model with data that introduces new bias vectors. The Notified Body must re-evaluate the system before a new Unique Registration ID can be issued for the modified version.

Providers can streamline authorization by adhering to harmonized standards—technical specifications adopted by recognized European standards bodies. Compliance with these standards grants a presumption of conformity with the EU AI Act's essential requirements. This reduces the audit burden on the Notified Body by providing a pre-validated compliance pathway. The provider must still compile the full Technical Documentation File, but the assessment focuses on correct application of the standard rather than de novo evaluation of every requirement.

For non-EU providers, pre-market authorization is impossible without designating an Authorized Representative established within the Union. This entity acts as the legal point of contact, holding the Technical Documentation File and cooperating with National Competent Authorities. The mandate must be explicit and written, empowering the representative to perform compliance checks and manage market withdrawal notifications. This ensures that foreign manufacturers remain accountable under EU jurisdiction without a physical presence.

A limited exception to full pre-market authorization exists through Regulatory Sandbox Notification. Providers can test high-risk AI systems in a controlled environment under the direct supervision of a National Competent Authority. While formal CE marking is not required during the sandbox phase, a formal notification is mandatory. Data gathered during this phase informs the eventual conformity assessment. However, systems exiting the sandbox for commercial deployment must complete the full authorization process without shortcuts.