AI Conformity Declaration

Legal Framework

Article 47 of the AI Act establishes the EU declaration of conformity as a mandatory, standalone compliance instrument that providers of high-risk AI systems must draw up before placing a system on the market or putting it into service. The declaration constitutes a formal attestation that the AI system satisfies the requirements set out in Chapter III of the AI Act, which encompasses risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, and robustness.

The declaration must be issued for each individual high-risk AI system and must contain the information specified in Annex V. It must be translated into an EU official language determined by the Member State where the system is made available. Providers must retain the declaration for ten years following the system's placement on the market — a retention period that aligns with the product safety regime under the Union harmonisation legislation framework.

Recital 77 clarifies an important interaction with the forthcoming Cyber Resilience Act: high-risk AI systems falling within the scope of that regulation may demonstrate compliance with the AI Act's cybersecurity requirements by fulfilling the essential cybersecurity requirements established under the Cyber Resilience Act. This creates a convergence point where a single conformity assessment can satisfy overlapping obligations.

Key Developments

The declaration of conformity mechanism draws directly from established practice under the New Legislative Framework for product safety in the EU. The Court of Justice has consistently reinforced the principle that compliance documentation serves not merely an administrative function but constitutes a substantive guarantee that enables effective market surveillance and enforcement — as reflected in the broader jurisprudence on independent supervisory oversight and the effectiveness of regulatory obligations.

The integration of the declaration requirement into the AI Act signals that high-risk AI systems are treated as products subject to the full weight of EU conformity assessment architecture. National market surveillance authorities, designated under Article 71, will rely on these declarations as a primary verification tool. The ten-year retention period exceeds typical GDPR documentation timelines and reflects the product-liability orientation of the regime.

Practical Guidance

• Draft a separate declaration per system: Article 47 requires an individual EU declaration of conformity for each high-risk AI system placed on the market or put into service — a blanket declaration covering a product portfolio will not satisfy the requirement.

• Verify Chapter III completeness before signing: The declaration attests to compliance with all Chapter III requirements, meaning providers must confirm that risk management systems, data governance measures, technical documentation, logging capabilities, transparency provisions, human oversight mechanisms, and accuracy/robustness standards are all in place and documented.

• Align with Annex V content specifications: The declaration must contain the specific elements listed in Annex V, including provider identification, system description, references to harmonised standards applied or common specifications used, and the identity of any notified body involved in conformity assessment.

• Leverage Cyber Resilience Act convergence: Where the AI system falls within the Cyber Resilience Act's scope, structure cybersecurity conformity assessments to satisfy both instruments simultaneously, as contemplated by Recital 77.

• Establish a ten-year retention and update protocol: Maintain the declaration for ten years post-placement on the market, and implement internal procedures to review and update the declaration when substantial modifications to the system trigger new conformity assessment obligations under Article 43.