# Conformity Assessment for AI Systems — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/conformity-assessment-ai > Sources are cited per item. Verify against the official texts before relying on them. Provider obligations typically include conformity assessment procedures and documentation requirements, which is a specific compliance mechanism under the AI Act that warrants dedicated coverage. ## Overview ## Legal Framework Conformity assessment is the core compliance gateway under the AI Act for high-risk AI systems before they may be placed on the EU market. Providers of high-risk systems must undergo either an internal control-based assessment (Annex VI) or a third-party conformity assessment involving a notified body, depending on the system's classification. Article 43 establishes the two primary pathways: conformity assessment based on the quality management system and technical documentation review, or conformity assessment supplemented by a product quality assurance system. Article 46 provides a critical derogation: where a provider has already applied a harmonised standard covering the relevant requirements, or where the system is not otherwise subject to third-party assessment obligations, the provider may opt for internal control. This derogation does not apply where the provider has modified the system in ways that affect its compliance with the AI Act's requirements, or where the system is subject to separate sectoral legislation mandating third-party assessment. Article 47 requires the provider to draw up and retain an EU declaration of conformity for each high-risk AI system. This written declaration affirms that the system meets the requirements set out in Chapter III of the AI Act. The declaration must identify the provider, the system, the harmonised standards applied, and contain a reference to the technical documentation. It must be translated into an EU language determined by the Member State where the system is made available and retained for ten years after the system is placed on the market. The technical documentation underpinning the assessment (Article 11 AI Act) must demonstrate compliance with all applicable high-risk requirements, including risk management, data governance, transparency, human oversight, accuracy, and robustness. ## Key Developments No enforcement decisions have yet been issued under the AI Act, as the conformity assessment obligations for high-risk systems apply from 2 August 2026. However, the interaction between AI Act conformity assessment and GDPR accountability obligations is already shaping compliance strategies. The European Data Protection Board has signalled that data protection impact assessments under Article 35 GDPR and AI Act conformity assessments will need to be coordinated, particularly where high-risk AI systems process personal data. The designation of notified bodies is progressing through Member State notifications under the AI Act, with several bodies seeking designation under the NANDO database framework. Providers should monitor which notified bodies achieve designation for AI-specific competencies, as capacity constraints may create bottlenecks for third-party assessments. ## Practical Guidance - **Map your conformity assessment pathway early**: Determine whether your high-risk system qualifies for the Article 46 derogation based on harmonised standard coverage, or whether third-party notified body assessment is mandatory. This determination drives your entire compliance timeline. - **Prepare technical documentation to Article 11 specifications before initiating assessment**: The technical documentation must cover all Chapter III requirements. Incomplete documentation is the most common cause of assessment delays under analogous CE-marking regimes. - **Establish a quality management system compliant with Article 17**: The QMS is the backbone of the conformity assessment. It must cover compliance strategy, technical documentation management, data governance, and post-market monitoring procedures. - **Draft the EU declaration of conformity (Article 47) only after completing the full assessment**: The declaration is a legally binding attestation. Issuing it prematurely exposes the provider to substantial fines under Article 99, up to €15 million or 3% of global turnover. - **Retain the declaration and technical documentation for ten years**: This retention period aligns with the AI Act's post-market monitoring obligations and must be supported by internal records management that survives personnel turnover. ## Legislation (full text of key provisions) ### Derogation from conformity assessment procedure *Source: AI Act, aiact-art-46-en, 2024-06-12 — https://overview.legal/posts/92688* ### EU declaration of conformity *Source: AI Act, aiact-art-47-en, 2024-06-12 — https://overview.legal/posts/92704* ### Conformity assessment *Source: AI Act, aiact-art-43-en, 2024-06-12 — https://overview.legal/posts/92631* ### Application of a conformity assessment body for notification *Source: AI Act, aiact-art-29-en, 2024-06-12 — https://overview.legal/posts/92458* ### Conformity assessment bodies of third countries *Source: AI Act, aiact-art-39-en, 2024-06-12 — https://overview.legal/posts/92587* Conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies under this Regulation, provided that they meet the requirements laid down in Article 31 or they ensure an equivalent level of compliance. ### Technical documentation *Source: AI Act, aiact-art-11-en, 2024-06-12 — https://overview.legal/posts/92155* ### Presumption of conformity with requirements relating to notified bodies *Source: AI Act, aiact-art-32-en, 2024-06-12 — https://overview.legal/posts/92508* Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof, the references of which have been published in the Official Journal of the European Union, it shall be presumed to comply with the requirements set out in Article 31 in so far as the applicable harmonised standards cover those requirements. ### Recital 125 — High-risk AI systems conformity assessment procedure *Source: AI Act, aiact-rec-125-en, 2024-06-12 — https://overview.legal/posts/93932* Given the complexity of high-risk AI systems and the risks that are associated with them, it is important to develop an adequate conformity assessment procedure for high-risk AI systems involving notified bodies, so-called third party conformity assessment. However, given the current experience of professional pre-market certifiers in the field of product safety and the different nature of risks involved, it is appropriate to limit, at least in an initial phase of application of this Regulation, the scope of application of third-party conformity assessment for high-risk AI systems other than those related to products. Therefore, the conformity assessment of such systems should be carried out as a general rule by the provider under its own responsibility, with the only exception of AI systems intended to be used for biometrics. ### Recital 78 — conformity assessment cybersecurity high-risk AI *Source: AI Act, aiact-rec-78-en, 2024-06-12 — https://overview.legal/posts/93838* The conformity assessment procedure provided by this Regulation should apply in relation to the essential cybersecurity requirements of a product with digital elements covered by a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and classified as a high-risk AI system under this Regulation. However, this rule should not result in reducing the necessary level of assurance for critical products with digital elements covered by a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements. Therefore, by way of derogation from this rule, high-risk AI systems that fall within the scope of this Regulation and are also qualified as important and critical products with digital elements pursuant to a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and to which the conformity assessment procedure based on internal control set out in an annex to this Regulation applies, are subject to the conformity assessment provisions of a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements insofar as the essential cybersecurity requirements of that regulation are concerned. In this case, for all the other aspects covered by this Regulation the respective provisions on conformity assessment based on internal control set out in an annex to this Regulation should apply. Building on the knowledge and expertise of ENISA on the cybersecurity policy and tasks assigned to ENISA under the Regulation (EU) 2019/881 of the European Parliament and of the Council (37), the Commission should cooperate with ENISA on issues related to cybersecurity of AI systems. ### Recital 127 — Mutual recognition of conformity assessment results *Source: AI Act, aiact-rec-127-en, 2024-06-12 — https://overview.legal/posts/93936* In line with Union commitments under the World Trade Organization Agreement on Technical Barriers to Trade, it is adequate to facilitate the mutual recognition of conformity assessment results produced by competent conformity assessment bodies, independent of the territory in which they are established, provided that those conformity assessment bodies established under the law of a third country meet the applicable requirements of this Regulation and the Union has concluded an agreement to that extent. In this context, the Commission should actively explore possible international instruments for that purpose and in particular pursue the conclusion of mutual recognition agreements with third countries. ## Recent developments ### Is the AI Act caging ChatGPT and other General Purpose Artificial Intelligence systems? *Source: Gaming Tech Law, 2023-03-29 — https://overview.legal/posts/6223 — original: https://www.gamingtechlaw.com/2023/03/draft-ai-act-general-purpose-artificial-intelligence/#entry-4244* > The growth of generative artificial intelligence systems has led EU lawmakers to focus on General Purpose AI in drafting the AI Act, which will set the framework governing artificial intelligence in the European Union. As previously reported, the EU Parliament has already broadened the definition of artificial intelligence for the purposes of the AI Act… ## Related topics - **Provider Obligations for AI Systems** — https://overview.legal/topics/provider-obligations-ai The content specifically addresses obligations imposed on providers of high-risk AI systems, which is a distinct and important category of requirements that des - **Notified Bodies for AI Systems** — https://overview.legal/topics/notified-bodies-ai This topic is needed to comprehensively cover the role, responsibilities, and obligations of notified bodies in the AI Act conformity assessment framework, incl - **Conformity Body Notification** — https://overview.legal/topics/conformity-assessment-body-notification This new topic is needed because the content specifically addresses the application and notification procedures for conformity assessment bodies under the AI Ac - **Artificial Intelligence** — https://overview.legal/topics/ai AI systems and their implications for data protection - **AI Act Procedures** — https://overview.legal/topics/ai-act-procedural-framework The 'Procedure' section of the AI Act establishes the overarching procedural framework and mechanisms for implementing and enforcing the regulation. This topic - **AI Act Requirements** — https://overview.legal/topics/ai-act-requirements The content specifically addresses 'Compliance with the requirements' from the AI Act, which warrants a dedicated topic for AI Act-specific requirements that go --- Generated by overview.legal · https://overview.legal/topics/conformity-assessment-ai · 2026-08-22