Conformity Assessment Procedures and Methodologies
Follow topic LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this topic. Contains: the overview, key law text, case law, enforcement and guidance for this topic. Everything links back to its source on overview.legal — legal information, not advice.This new topic is needed to specifically address the procedural and methodological aspects of conformity assessment for AI systems, including step-by-step procedures, assessment phases, documentation requirements, and reporting mechanisms that are distinct from the general conformity assessment concept.
Overview
8 sources · Jul 23, 2026Legal Framework
Conformity assessment procedures under the AI Act are governed primarily by Articles 40 through 47, which establish the methodological and procedural requirements for demonstrating that high-risk AI systems comply with the regulation's substantive obligations. Article 43 sets out the available conformity assessment pathways, distinguishing between internal control mechanisms (Annex VI) and third-party assessment involving notified bodies (Annex VII), depending on the AI system's classification and intended purpose. Article 46 provides a derogation mechanism, permitting Member States to authorise the placing on the market of high-risk AI systems without having undergone the conformity assessment procedure, provided this is justified on grounds of public security, protection of life, or the protection of health and the environment, and subject to strict conditions and Union-level notification.
Recital 50 clarifies the classification logic for AI systems that serve as safety components of products, or are themselves products, falling within the scope of listed Union harmonisation legislation. Where the underlying product undergoes a third-party conformity assessment under that harmonisation legislation, the AI system is classified as high-risk under the AI Act, triggering the corresponding assessment obligations. This ensures that AI components embedded in regulated products such as machinery, lifts, toys, and equipment for explosive atmospheres are subject to the same scrutiny as the products they are integrated into.
Key Developments
The interplay between the AI Act's conformity assessment regime and existing Union harmonisation legislation represents the most significant practical development. The AI Act does not operate in isolation; where an AI system is a safety component of a product already subject to third-party conformity assessment under directives such as the Machinery Directive or the Lifts Directive, the AI-specific assessment must be integrated into the existing procedure rather than conducted as a parallel process. This avoids duplication while ensuring AI-specific risks are captured.
The derogation under Article 46 has not yet been tested in practice, but its design mirrors emergency authorisation provisions in other sectoral product safety legislation. The requirement to notify the Commission and other Member States, combined with the obligation to provide reasons and specify the scope and duration of the derogation, establishes a transparency mechanism that limits unilateral state discretion. Practitioners should expect the Commission to scrutinise derogations closely, particularly where they appear to circumvent third-party assessment obligations under Annex VII.
Practical Guidance
Map the conformity assessment pathway early: Determine whether the AI system falls under Annex VI (internal control) or Annex VII (notified body involvement) based on the system's classification and whether it is a safety component of a product subject to listed harmonisation legislation under Recital 50.
Integrate with existing product assessments: Where the AI system is embedded in a product already undergoing third-party conformity assessment under Union harmonisation legislation, coordinate the AI-specific assessment within that existing procedure to avoid parallel or conflicting obligations.
Prepare technical documentation before initiating assessment: Annex IV documentation requirements must be satisfied before any conformity assessment module can be applied, regardless of whether the pathway is internal or third-party.
Monitor derogation conditions closely: If relying on Article 46, ensure the public security or health justification is documented with specificity, notify the Commission and Member States with full reasoning, and set a defined duration — open-ended derogations are unlikely to withstand scrutiny.
Establish a post-market monitoring infrastructure: Conformity assessment is not a one-time event; Article 72 requires ongoing monitoring, and the assessment methodology must account for how the provider will detect and respond to emerging risks throughout the system's lifecycle.