EU AI Act conformity assessment and CE marking: a provider's guide

If you provide a high-risk AI system, the EU AI Act asks you to prove it before it goes to market, through a conformity assessment, an EU declaration of conformity and a CE marking. It sounds heavy, but for most Annex III systems you assess yourself, without a notified body. Here is the path.

New to the regulation? Start with our complete EU AI Act guide.

Self-assessment or a notified body?

Article 43 sets the route, and for most SMEs the answer is reassuring:

• Most Annex III systems self-assess (Annex VI). For the use cases in Annex III points 2 to 8 — education, employment, essential services, law enforcement, migration, justice — you follow internal control, with no notified body involved (Article 43(2)).
• Biometrics may need a notified body (Annex VII). For Annex III point 1 (biometrics), you can self-assess only if you applied harmonised standards or common specifications; otherwise a notified body must be involved (Article 43(1)).
• Medical-device and other product-safety AI follows the existing sectoral route (for example the MDR), into which the AI Act is folded (Article 43(3)).

The three documents

1. Conformity assessment. Run the internal-control (Annex VI) or notified-body (Annex VII) procedure and keep the evidence, built on your Annex IV technical file.
2. EU declaration of conformity (Article 47). Draw up a signed declaration for the system, take responsibility for meeting the requirements, and keep it for 10 years for the authorities.
3. CE marking (Article 48). Affix the CE marking visibly, legibly and indelibly (or digitally, or on the packaging). Where a notified body was involved, add its identification number.

Then register it

Before placing an Annex III high-risk system on the market, register yourself and the system in the EU database (Articles 49 and 71). Critical-infrastructure systems (Annex III point 2) use a separate, non-public registration.

Substantial changes trigger a re-check

A conformity assessment is not forever. If you substantially modify the system, beyond the changes you documented up front, you must run a new conformity assessment (Article 43(4)).

Deadlines

These duties apply on the high-risk timeline: Annex III systems from 2 December 2027, product-safety (Annex I) systems from 2 August 2028, both rescheduled by the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026). See the deadlines guide.

Check the law yourself

The route you take is decided by two annexes, and they are short enough to read before you commit to a plan. Annex VI is the internal-control procedure; Annex VII is the one that brings in a notified body. Article 43 says which applies to you, and Articles 47 and 48 cover the declaration of conformity and the CE marking itself.

• Regulation (EU) 2024/1689 — consolidated text as amended, 27 July 2026 (Articles 43, 47, 48; Annexes VI and VII)
• Regulation (EU) 2026/1744 — the Digital Omnibus on AI, which moved the high-risk dates

Where to start

Confirm whether your system is high-risk and which route it takes with the free EU AI Act Snapshot, then build the Annex IV file and work the 9-step checklist. Plans start at EUR 0.