What Conformity Assessment Actually Checks
Conformity assessment is the gate every high-risk AI system must pass before it can be placed on the EU market. It is not a single test but a structured verification that the system satisfies the seven requirement areas of Chapter III, Section 2: a functioning risk management system, data and data-governance quality, technical documentation, record-keeping and logging, transparency and instructions for use, human oversight, and accuracy, robustness and cybersecurity. If any pillar is missing, the assessment fails.
First, Confirm You Are High-Risk
Conformity assessment applies only to high-risk systems. Before investing in it, classify your system. If it falls in Annex III (employment, education, essential services, law enforcement, etc.) or is a safety component of an Annex I regulated product, you are in scope. If it is limited-risk (a chatbot) or minimal-risk (a spam filter), you have transparency duties at most and do not need a conformity assessment. Our free risk classifier and high-risk definition guide settle this quickly.
Choose Your Route: Internal Control vs Notified Body
The EU AI Act offers two assessment routes. Internal control (Annex VI) is self-assessment: the provider verifies its own quality management system and technical documentation against the requirements, with no external auditor. This is the default for the great majority of Annex III high-risk systems. Third-party assessment by a notified body (Annex VII) is required in narrower cases — principally certain biometric identification and categorisation systems, and high-risk AI built into products that already undergo third-party conformity assessment under Annex I harmonised legislation. Identify your route early, because the notified-body path adds time, cost, and an external audit.
The Step-by-Step Process
Step 1 — Build the quality management system. Article 17 requires a documented QMS covering your compliance strategy, design and development controls, testing, data management, post-market monitoring, and incident reporting. The conformity assessment verifies this exists and works.
Step 2 — Compile the technical documentation. Assemble the Annex IV technical file: system description, development process, monitoring and control, risk management, and validation results. This is the evidence base the assessment examines.
Step 3 — Run the assessment. Under internal control, verify the QMS and technical documentation against each Chapter III requirement and record the results. Under the notified-body route, submit the documentation and undergo the external audit, which may include examination of the system itself.
Step 4 — Draw up the EU declaration of conformity. Sign the declaration (Article 47) stating the system meets the requirements, referencing any harmonised standards or common specifications applied. Keep it for ten years.
Step 5 — Affix the CE marking. Apply the CE mark to the system, its documentation, or its packaging (electronically for digitally supplied AI). Where a notified body was involved, include its identification number.
Step 6 — Register in the EU database. Before placing the system on the market, register it (and yourself as provider) in the EU AI database for high-risk systems.
Keep It Current
Conformity is not a one-off. Post-market monitoring must continue throughout the system's life, serious incidents must be reported, and any substantial modification — a change to intended purpose or to the basis of compliance — triggers a fresh conformity assessment. Building monitoring and change-control into your QMS from day one avoids expensive re-assessment surprises.
GeraCompliance provides the QMS and conformity-assessment templates and a guided compliance checklist that walks through each step above. For a deadline-driven build, the AI Act sprint produces an assessment-ready documentation set in days.