EU AI Act conformity assessment and CE marking: a provider's guide

If you provide a high-risk AI system, the EU AI Act asks you to prove it before it goes to market, through a conformity assessment, an EU declaration of conformity and a CE marking. It sounds heavy, but for most Annex III systems you assess yourself, without a notified body. Here is the path.

Self-assessment or a notified body?

Article 43 sets the route, and for most SMEs the answer is reassuring:

• Most Annex III systems self-assess (Annex VI). For the use cases in Annex III points 2 to 8 — education, employment, essential services, law enforcement, migration, justice — you follow internal control, with no notified body involved (Article 43(2)).
• Biometrics may need a notified body (Annex VII). For Annex III point 1 (biometrics), you can self-assess only if you applied harmonised standards or common specifications; otherwise a notified body must be involved (Article 43(1)).
• Medical-device and other product-safety AI follows the existing sectoral route (for example the MDR), into which the AI Act is folded (Article 43(3)).

The three documents

1. Conformity assessment. Run the internal-control (Annex VI) or notified-body (Annex VII) procedure and keep the evidence, built on your Annex IV technical file.
2. EU declaration of conformity (Article 47). Draw up a signed declaration for the system, take responsibility for meeting the requirements, and keep it for 10 years for the authorities.
3. CE marking (Article 48). Affix the CE marking visibly, legibly and indelibly (or digitally, or on the packaging). Where a notified body was involved, add its identification number.

Then register it

Before placing an Annex III high-risk system on the market, register yourself and the system in the EU database (Articles 49 and 71). Critical-infrastructure systems (Annex III point 2) use a separate, non-public registration.

Substantial changes trigger a re-check

A conformity assessment is not forever. If you substantially modify the system, beyond the changes you documented up front, you must run a new conformity assessment (Article 43(4)).

Deadlines

These duties apply on the high-risk timeline: Annex III systems from 2 December 2027, product-safety (Annex I) systems from 2 August 2028, both rescheduled by the Digital Omnibus (adopted, pending Official Journal publication). See the deadlines guide.

Where to start

Confirm whether your system is high-risk and which route it takes with the free EU AI Act Snapshot, then build the Annex IV file and work the 9-step checklist. Plans start at EUR 0.