EveryAILaw.comDoes EU AI Act require Conformity Assessment?
European Union • phased enforcement
Yes — 1 provision
Requirements at a glance
This regulation imposes 7 specific requirements for Conformity Assessment across 1 provision:
- Conformity assessment — Must undergo before placing on market or putting into service (Article 43)
- Annex III assessment route — For Annex III point 1 systems, application of harmonised standards or common specifications permits a choice between Annex VI internal control and Annex VII assessment with a notified body; Article 43(1) requires Annex VII in its listed cases where standards or specifications are unavailable or unapplied, harmonised standards are applied only in part, or a published restriction affects the relevant part. Annex III points 2-8 follow Annex VI internal control without notified-body involvement (Article 43(1)-(2))
- CE marking — Required for high-risk AI systems once assessment complete (Article 48)
- Quality management — Must establish quality management system (Article 17); implementation must be proportionate to the size of the provider's organisation, in particular for SMEs, start-ups, and small mid-cap enterprises, without lowering the rigour needed for compliance (Article 17(2), as replaced by Regulation (EU) 2026/1744)
- Documentation — Keep the technical documentation, quality-management-system documentation, approved changes, and notified-body decisions and certificates at national-authority disposal for 10 years after the high-risk system is placed on the market or put into service (Article 18). SMEs, start-ups, and SMCs may provide the Annex IV elements in simplified form using the Commission-issued form (Article 11(1), as amended)
- Conditional route without a third party — Where Annex I Section A legislation permits a route without third-party assessment on application of harmonised standards ensuring all relevant sectoral requirements, that option additionally requires application of harmonised standards or applicable Article 41 common specifications covering all Chapter III Section 2 requirements. Subject to those conditions, high-risk classification or inclusion of a high-risk AI safety component does not by itself force third-party assessment (Article 43(3), as replaced)
- Annex III phasing — Annex III high-risk systems: 2027-12-02 (deferred from 2026-08-02 by Regulation (EU) 2026/1744). Covered Annex I Section A high-risk systems (including product-safety systems such as medical devices): 2028-08-02 (deferred from 2027-08-02). Notified bodies already notified under Annex I Section A legislation must apply for designation under the AI Act by 2028-01-28
Conformity Assessment
The Article 16(f)-(h) provider duties to ensure conformity assessment, draw up the declaration, and affix CE marking are in Chapter III Section 3: they apply on 2027-12-02 to Article 6(2)/Annex III systems and on 2028-08-02 to covered Article 6(1)/Annex I systems under amended Article 113(c), subject to Article 111 transitions. The `Effective` field carries the earlier date for those duties. Articles 40-49 are in Section 5 and are not themselves included in that Sections 1-3 deferral; Article 113 retains the general 2026-08-02 application date for provisions not otherwise excepted.
Requirements
| Requirement | Details |
|---|---|
| Conformity assessment | Must undergo before placing on market or putting into service (Article 43) |
| Annex III assessment route | For Annex III point 1 systems, application of harmonised standards or common specifications permits a choice between Annex VI internal control and Annex VII assessment with a notified body; Article 43(1) requires Annex VII in its listed cases where standards or specifications are unavailable or unapplied, harmonised standards are applied only in part, or a published restriction affects the relevant part. Annex III points 2-8 follow Annex VI internal control without notified-body involvement (Article 43(1)-(2)) |
| CE marking | Required for high-risk AI systems once assessment complete (Article 48) |
| Quality management | Must establish quality management system (Article 17); implementation must be proportionate to the size of the provider's organisation, in particular for SMEs, start-ups, and small mid-cap enterprises, without lowering the rigour needed for compliance (Article 17(2), as replaced by Regulation (EU) 2026/1744) |
| Documentation | Keep the technical documentation, quality-management-system documentation, approved changes, and notified-body decisions and certificates at national-authority disposal for 10 years after the high-risk system is placed on the market or put into service (Article 18). SMEs, start-ups, and SMCs may provide the Annex IV elements in simplified form using the Commission-issued form (Article 11(1), as amended) |
| Conditional route without a third party | Where Annex I Section A legislation permits a route without third-party assessment on application of harmonised standards ensuring all relevant sectoral requirements, that option additionally requires application of harmonised standards or applicable Article 41 common specifications covering all Chapter III Section 2 requirements. Subject to those conditions, high-risk classification or inclusion of a high-risk AI safety component does not by itself force third-party assessment (Article 43(3), as replaced) |
| Annex III phasing | Annex III high-risk systems: 2027-12-02 (deferred from 2026-08-02 by Regulation (EU) 2026/1744). Covered Annex I Section A high-risk systems (including product-safety systems such as medical devices): 2028-08-02 (deferred from 2027-08-02). Notified bodies already notified under Annex I Section A legislation must apply for designation under the AI Act by 2028-01-28 |
Penalties
| Violation | Fine |
|---|---|
| Provider non-compliance with Article 16, including conformity duties | Up to EUR 15 million; for undertakings, up to 3% of total worldwide annual turnover for the preceding financial year or EUR 15 million, whichever is higher. For SMEs (including start-ups) and SMCs, the lower of the amount or percentage applies (Article 99(4), (6), and (6a)). Applicability depends on the relevant duty and its application date. |