Conformity assessment and CE marking for high-risk AI: how does it work?

Short answer: As a provider you must first put a high-risk AI system through a conformity assessment (Art. 43). If it passes, you draw up an EU declaration of conformity (Art. 47), affix the CE marking (Art. 48) and register the system in the EU database (Art. 49) before placing it on the market.

Which route applies to my system?

The conformity assessment demonstrates that your system meets the requirements for high-risk AI (such as risk management, data governance, transparency and human oversight). For most Annex III systems there are two routes:

• Internal control (Annex VI): for most Annex III systems a self-administered assessment is enough. You check your quality management and technical documentation against the requirements, without a third party having to verify them.
• Notified body (Annex VII): in certain cases — notably biometrics — assessment by a notified body is required. This third party reviews your quality management system and technical documentation.

Which route applies depends on the type of system and whether harmonised standards were used. Decide early, because an external assessment takes time.

What must I record and issue?

• Technical documentation (Annex IV): a file showing the system meets the requirements — design, data, performance, risk management and testing. It is the foundation of the whole assessment.
• EU declaration of conformity (Art. 47): a signed statement in which you, as provider, take responsibility for the system's conformity. You keep it available for ten years.
• CE marking (Art. 48): affixed visibly, legibly and indelibly to the system, or to its packaging and documentation. For purely digital systems it may be applied digitally. Where a notified body is involved, its identification number is added.
• Registration (Art. 49): you register the system in the EU database before it is placed on the market or put into service.

What if my AI is built into a product?

If your product already falls under Annex I product legislation (for example machinery or medical devices), an integrated assessment applies: the AI requirements are folded into the conformity assessment that already governs that product. So you do not run two separate procedures, but one combined one. The CE marking the product already carries then also covers AI conformity. This avoids duplication, but means you must address the AI requirements within the existing product procedure.

Read more: AI Act: timeline of obligations. Take the scan.