Conformity assessment and CE marking

Before a high-risk AI system can be placed on the EU market or put into service, the provider must complete a conformity assessment under Article 43, sign an EU declaration of conformity under Article 47, and affix the CE marking under Article 48. Annex III providers register the system in the EU database under Article 49(1) (except for Annex III point 2 critical infrastructure; Annex III points 1, 6 and 7 in law enforcement, migration, asylum and border-control management are registered in the non-public section under Article 49(4)). AI systems covered by Annex I product legislation are not subject to Article 49 EU-database registration merely because of Article 6(1); any registration or notification duties arise, if at all, under the relevant sectoral product law. For Annex I Section A products, the AI Act requirements integrate with the sectoral conformity-assessment procedure under Article 43(3) rather than running in parallel; Section B products are channelled through the sectoral act instead.

This page sits inside the high-risk regime — see High-risk AI systems for what triggers the regime in the first place.

Quick decision

• Annex III standalone use case other than biometrics → Annex VI internal control under Article 43(2). Self-assess against Articles 8–15 and Article 17 QMS.
• Annex III(1) biometrics → Annex VII notified-body assessment under Article 43(1) unless harmonized standards or common specifications cover the requirements and you apply them — then Annex VI internal control becomes available.
• Annex I Section A product (product, or safety component, covered by Section A sectoral law that requires a third-party conformity assessment) → integrate AI Act requirements into the sectoral conformity-assessment procedure under Article 43(3). Annex I Section B → channelled through the sectoral act, not Article 43(3).
• Substantial modification after placing on the market → new conformity assessment under Article 43(4). Pre-declared continuous-learning changes within Annex IV point 2(f) do not trigger re-assessment.
• Successful assessment → EU declaration of conformity (Article 47), CE marking (Article 48), and — for Annex III systems other than the Annex III(2) critical-infrastructure carve-out — EU-database registration (Article 49) before market placement. Annex I products are outside Article 49; check the applicable sectoral product law for any separate registration or notification duty.

TL;DR

• Two routes for Annex III systems: Annex VI (provider internal control, default) and Annex VII (notified-body assessment, mandatory for Annex III point 1 biometrics unless harmonized standards / common specifications cover the requirements).
• Annex I Section A products integrate AI Act requirements into the sectoral conformity-assessment regime under Article 43(3) — no parallel AI Act assessment; Section B products are channelled through the sectoral act instead.
• Article 47 EU declaration of conformity — kept for 10 years; content in Annex V.
• Article 48 CE marking — visible, legible, indelible; followed by notified-body identification number where applicable; digital marking allowed for digital systems via machine-readable access.
• Article 49 EU database registration — for Annex III systems (with the Annex III(2) carve-out for critical infrastructure); also required under Article 49(2) for Annex III systems that the provider has determined are not high-risk under Article 6(3).
• Article 43(4) — substantial modification triggers a new conformity assessment; pre-declared continuous-learning changes (Annex IV point 2(f)) do not.

Digital Omnibus on AI

Status: Regulation (EU) 2026/1744 — in force from 27 July 2026

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026 (OJ L, 24.7.2026; CELEX 32026R1744), in force from 27 July 2026 (proposed 19 November 2025; Parliament approved 16 June 2026; Council adopted 29 June 2026; Procedure 2025/0359(COD)). It amends Regulation (EU) 2024/1689. See the EU AI Act hub for the full change set.

Relevant to this page:

• High-risk obligations apply from 2 December 2027 (Annex III; was 2 August 2026) and 2 August 2028 (Annex I; was 2 August 2027) — the deferral in amended Article 113 covers Chapter III, Sections 1 to 3. Conformity assessment (Article 43) and registration (Article 49) sit in Section 5, which is not deferred and applies from 2 August 2026; in practice they fall due through the deferred provider obligations (Article 16(f) for conformity assessment, Article 16(i) for registration), so the operative dates match the ones above.
• Annex III non-high-risk registration is retained but simplified — the Article 49(2) duty to register systems the provider has determined are not high-risk under Article 6(3) stays, with Annex VIII Section B points 7 and 9 deleted.
• Compliance is simplified for SMEs (incl. start-ups) and small mid-caps (SMCs as defined in Commission Recommendation (EU) 2025/1099) — Article 11 technical documentation may be filed in simplified form and the Article 17 QMS is proportionate to provider size.
• The AI Office runs third-party conformity assessment for the systems it exclusively supervises — under the new Article 75(1e), where a high-risk AI system falls under the AI Office's exclusive Article 75(1) competence (systems based on a general-purpose AI model from the same provider or undertaking, and AI constituting or integrated into a designated VLOP or VLOSE), the AI Office is responsible for the Article 43 third-party conformity assessments and tests; the Commission entrusts them to notified bodies acting on its behalf, and the fees are levied on the provider.
• Sectoral overlaps can be resolved through delegated acts — where Section A Annex I law gives an equivalent or higher level of protection, the Commission may limit the application of Articles 9-15 and 17-25 via delegated acts under the new Article 2(13) (due by 2 August 2027), provided the limitation does not reduce the overall level of protection of the Regulation. The Machinery Directive 2006/42/EC is deleted from Section A of Annex I and the Machinery Regulation (EU) 2023/1230 added to Section B (the sectoral track); the Commission is empowered under that Regulation to add health-and-safety requirements for high-risk AI via delegated acts, applicable by 2 August 2028.

Primary source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 — EUR-Lex CELEX 32024R1689 · OJ L, 12.7.2024 · Articles 43, 44, 47, 48, 49, Annexes V, VI, VII, VIII.

Article 43 — conformity-assessment procedure

Article 43(1) — Annex III(1) biometrics

For high-risk AI systems listed in point 1 of Annex III, where, in demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider has applied harmonised standards referred to in Article 40, or, where applicable, common specifications referred to in Article 41, the provider shall opt for one of the following conformity assessment procedures based on:

(a) the internal control referred to in Annex VI; or

(b) the assessment of the quality management system and the assessment of the technical documentation, with the involvement of a notified body, referred to in Annex VII.

In demonstrating the compliance of a high-risk AI system referred to in point 1 of Annex III with the requirements set out in Section 2, where the provider has not applied or has applied only in part harmonised standards referred to in Article 40, or where such harmonised standards do not exist and common specifications referred to in Article 41 are not available, the provider shall follow the conformity assessment procedure set out in Annex VII.

— Article 43(1), Regulation (EU) 2024/1689

The Annex III(1) biometrics route is structured around standards availability and application:

• Provider applies harmonized standards / common specifications and they cover the Section 2 requirements → choice between Annex VI and Annex VII.
• Harmonized standards / common specifications either don't exist, or aren't applied, or cover only part of the requirements → Annex VII is mandatory.

Article 43(2) — other Annex III high-risk systems

For high-risk AI systems referred to in points 2 to 8 of Annex III, providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body.

— Article 43(2), Regulation (EU) 2024/1689

For Annex III(2)–(8) — critical infrastructure, education, employment, essential services, law enforcement, migration / border, justice / democracy — the conformity assessment is Annex VI internal control. Article 43(2) does not provide a voluntary Annex VII alternative for these categories; notified-body involvement is reserved for Annex III(1) under Article 43(1).

Article 43(3) — Annex I Section A products

For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I, the provider shall follow the relevant conformity assessment procedure as required under those legal acts. The requirements set out in Section 2 of this Chapter shall apply to those high-risk AI systems and shall be part of that assessment.

— Article 43(3), first sub-paragraph, Regulation (EU) 2024/1689

Article 43(3) further provides that notified bodies designated under the sectoral law that perform the AI-Act-integrated assessment must meet the requirements set out in Article 31(4), (5), (10) and (11). Under the Digital Omnibus (Regulation (EU) 2026/1744), Article 43(3) lets notified bodies already notified under Section A Annex I legislation assess high-risk AI under stated conditions, requiring them to apply for designation under the AI Act by 28 January 2028 (per recital 18 of the amending Regulation they may apply at any time during and after the transition), preserves the manufacturer's choice of conformity-assessment procedure so a product is not forced into third-party assessment merely for embedding a high-risk AI, and applies the Section A procedure where a system falls under both Section A Annex I and Annex III. For Section B sectoral regulations (e.g., civil aviation security, agricultural vehicles, marine equipment, motor vehicles type-approval), the replaced Article 2(2) limits direct AI Act application to Article 6(1), the new Article 60a, and Articles 102-112, with Articles 57, 58 and 59 applying only where the high-risk requirements have been integrated into the relevant sectoral legislation — the substantive Section 2 obligations are channelled into the sectoral acts via Articles 102-112 rather than directly applied.

Article 43(4) — substantial modification

High-risk AI systems that have already been subject to a conformity assessment procedure shall undergo a new conformity assessment procedure in the event of a substantial modification, regardless of whether the modified system is intended to be further distributed or continues to be used by the current deployer.

For high-risk AI systems that continue to learn after being placed on the market or put into service, changes to the high-risk AI system and its performance that have been pre-determined by the provider at the moment of the initial conformity assessment and are part of the information contained in the technical documentation referred to in point 2(f) of Annex IV, shall not constitute a substantial modification.

— Article 43(4), Regulation (EU) 2024/1689

The Annex IV(2)(f) pre-declaration is the operative safe harbour for continuous-learning systems. Pre-declare the change envelope — drift bounds, retraining triggers, parameter update modalities — and updates that stay within the envelope do not trigger re-assessment. Changes outside the envelope, or material changes to intended purpose, are substantial modifications.

Annex VI — internal control

The Annex VI procedure has four operative elements:

1. Verify QMS conforms to Article 17 — the QMS covers design, development, post-market processes, data management, record-keeping, accountability framework, and the substantive Articles 8–15 requirements.
2. Verify technical documentation conforms to Article 11 and Annex IV — all Annex IV elements present, current, and traceable.
3. Verify the design and development of the AI system and its post-market monitoring conform to the Articles 8–15 requirements taking into account intended purpose and state of the art.
4. Draw up the EU declaration of conformity under Article 47, affix the CE marking under Article 48, and — for in-scope Annex III systems — register in the EU database under Article 49(1).

No notified body involvement. The provider assumes full responsibility for the assessment.

Annex VII — notified-body assessment

The Annex VII procedure has two operative parts, both involving the notified body (an accredited third-party conformity-assessment body — designated under Articles 28–39):

• Section 3 — assessment of the QMS — the notified body audits the provider's QMS documentation against Article 17. On approval, the notified body issues a QMS-approval certificate; Article 44(2) sets validity at maximum five years for Annex I and maximum four years for Annex III systems, with periodic surveillance audits in between. Material changes to the QMS that may affect compliance must be notified to the notified body.
• Section 4 — assessment of the technical documentation — the notified body examines the technical documentation drawn up under Article 11 and Annex IV for one or more representative samples of the high-risk AI system. Article 44(2) sets the validity periods for certificates issued by notified bodies: not exceeding five years for AI systems covered by Annex I, and not exceeding four years for AI systems covered by Annex III, in both cases extendable on the basis of a re-assessment.

The approved QMS is subject to ongoing surveillance under Annex VII point 5. Certificates can be suspended, withdrawn, or modified under Article 44(3) when the conditions for issuance are no longer met or when corrective action by the provider has not addressed identified non-conformities.

Article 44 — certificates issued by notified bodies

Article 44 governs the certificates issued by notified bodies under Annex VII. The certificates shall be drawn up in an official language of the Union easily accessible to the relevant national authorities and shall identify the high-risk AI system, the notified body, the validity period, and the conditions of issuance. Article 44(2) sets the validity period as not exceeding five years for Annex I systems and not exceeding four years for Annex III systems, extendable on the basis of a re-assessment. Article 44(3) governs suspension, withdrawal and changes to certificates. The accreditation, designation and operational requirements for notified bodies themselves live in Articles 28–39; the NANDO database is the public list.

Article 47 — EU declaration of conformity

Article 47(1) requires the provider to draw up a written, machine-readable, physical or electronically signed EU declaration of conformity for each high-risk AI system and keep it at the disposal of the national competent authorities for 10 years after the high-risk AI system has been placed on the market or put into service. The declaration shall identify the high-risk AI system for which it has been drawn up. A copy of the EU declaration of conformity shall be submitted to the relevant national competent authorities upon request.

The declaration content is specified in Annex V and includes provider identity, system identification, statement of compliance with the Regulation and applicable Union law, references to any harmonized standards or common specifications applied, the notified-body certificate identification number where applicable, and signature and date. By drawing up the declaration, the provider assumes responsibility for the system's compliance.

Where the high-risk AI system is subject to other Union harmonization legislation that also requires an EU declaration of conformity, a single EU declaration of conformity shall be drawn up in respect of all of that legislation, so that the declaration covers all applicable acts.

Article 48 — CE marking

Article 48(1) subjects the CE marking on high-risk AI systems to the general principles set out in Article 30 of Regulation (EC) No 765/2008. Article 48(2) allows a digital CE marking for digital high-risk AI systems only if it can easily be accessed via the interface from which the AI system is accessed or via an easily accessible machine-readable code or other electronic means. Article 48(3) requires the CE marking to be affixed visibly, legibly and indelibly on the high-risk AI system; where that is not possible or not warranted on account of the nature of the high-risk AI system, it shall be affixed to the packaging or to the accompanying documentation, as appropriate.

The CE marking is followed, where applicable, by the identification number of the notified body responsible for the conformity-assessment procedures under Article 43. The identification number is affixed by the notified body or, under its instructions, by the provider or the provider's authorized representative.

The CE marking attests that the high-risk AI system is in conformity with the Regulation. Affixing the marking on a system that does not comply is an Article 99 infringement.

Article 49 — registration in the EU database

Before placing on the market or putting into service a high-risk AI system listed in Annex III, with the exception of high-risk AI systems referred to in point 2 of Annex III, the provider or, where applicable, the authorised representative shall register themselves and their system in the EU database referred to in Article 71.

— Article 49(1), Regulation (EU) 2024/1689

Operative points:

• Annex III(2) carve-out — high-risk AI systems used in critical infrastructure are not subject to Article 49(1) EU-database registration. Article 49(5) requires Annex III(2) systems to be registered at national level.
• Article 49(2) — providers that have concluded under Article 6(3) that their Annex III system is not high-risk must still register themselves and the system (Annex VIII Section B fields) in the EU database. (The Digital Omnibus on AI (Regulation (EU) 2026/1744) retains this Article 49(2) duty but simplifies it — Annex VIII Section B points 7 and 9 are deleted.)
• Article 49(3) — deployers that are public authorities, agencies or bodies of the Union (including those acting on their behalf) register themselves and select information about their use of the high-risk AI system in the EU database before deployment.
• Article 49(4) — for high-risk AI systems referred to in Annex III points 1, 6 and 7 in the areas of law enforcement, migration, asylum and border-control management, the registration is in a non-public section of the EU database. Access is limited to the Commission and the Article 74(8) national authorities: the market-surveillance authorities designated for those systems, either the competent data-protection supervisory authority or another authority designated under the Directive (EU) 2016/680 conditions.

The Annex VIII content specifies the registration fields (provider identification, system identification, intended purpose, instructions for use, declaration-of-conformity reference). Annex VIII Section A governs registrations of high-risk Annex III systems; Annex VIII Section B governs the Article 49(2) non-high-risk determination registration (providers that have concluded under Article 6(3) that their Annex III system is not high-risk); Annex VIII Section C governs Article 49(3) public-authority deployer registrations.

How to operationalize conformity assessment in Modulos

The conformity-assessment regime maps onto these MFF-1 / OFF-1 requirements:

Requirement	Description	OJ Article
ORF-8	Art. 17 — Quality management system	Article 17
MRF-3	Technical Documentation	Article 11 + Annex IV
ORF-9, MRF-9	Art. 43 — Conformity assessment	Article 43 + Annex VI / VII
MRF-42	Art. 8 — Choice for handling sectoral requirements	Article 43(3) Section A integration
MRF-41	Disclosure of Contact Information	Article 16(b)
MRF-37	EU Representative	Article 22
MRF-116	EU Representative Registration	Article 22(3) / Article 49
MRF-53	Public Deployer Registration	Article 49(3) (public-authority deployers)
ORF-12	Duty of Information	Article 20
ORF-13	Cooperation with Competent Authorities	Article 21

Operating rules:

• Conformity-assessment route selection (MRF-9, ORF-9) — the Annex VI / Annex VII / sectoral choice is captured as a scoping decision; the rationale and the standards / common-specifications application status are recorded as control-level evidence.
• Annex IV technical documentation (MRF-3) is assembled as evidence linked to MFF-1 controls. Modulos serves as the evidence library that backs each Annex IV element; building the Annex IV document itself remains the provider's authoring task. Point-in-time project, control, and evidence exports support the documentation pack.
• Article 17 QMS (ORF-8) lives on OFF-1. The QMS documents are linked as control-level evidence; there is no dedicated QMS workflow surface.
• Article 47 EU declaration of conformity is recorded as control-level evidence on MRF-9. The declaration content (Annex V) is the provider's authoring task; the artifact lives in Modulos as a versioned evidence record.
• Article 48 CE marking is the provider's physical / digital affixing action; Modulos records the affixing attestation as control-level evidence on MRF-9.
• Article 49 EU-database registration is the provider's submission to the EU database (not via Modulos). The registration confirmation is recorded as control-level evidence on MRF-116 (EU representative registration) or MRF-53 (public-authority deployer registration), as applicable.
• Article 43(4) substantial-modification re-assessment triggers a fresh conformity-assessment evidence cycle on MRF-9. The Annex IV(2)(f) pre-declaration of continuous-learning bounds is recorded once on MRF-3 and serves as the safe-harbour reference for in-envelope changes.

Cross-framework mapping (preview)

EU AI Act	Adjacent provision
Article 43 conformity-assessment routes	Modular conformity-assessment framework under Decision 768/2008/EC; sectoral conformity-assessment procedures under Annex I sectoral acts
Article 44 certificates; Articles 28–39 notified-body designation	Regulation (EC) No 765/2008 accreditation framework
Article 47 EU declaration of conformity	Article 30 Regulation (EC) No 765/2008 (CE marking general principles); sectoral declaration regimes (MDR, machinery, etc.)
Article 48 CE marking	Article 30 Regulation (EC) No 765/2008; sectoral CE-marking regimes
Article 49 EU-database registration	(No direct GDPR equivalent; any product registration/notification duties depend on the relevant sectoral act)
Article 17 QMS	ISO 9001; ISO 42001
Annex IV technical documentation	ISO 42001 documented information; ISO 13485 medical-device technical-file conventions

Related pages

High-risk AI systems

Article 6 routing; Articles 8–15 substantive obligations

Post-market monitoring

Article 72 PMM plan; Article 73 serious-incident reporting

Roles and responsibilities

Article 16 provider duties; Article 22 authorized representative

Operationalizing in Modulos

OFF-1 + MFF-1, Annex IV evidence patterns, route-selection rationale

Source attribution

Regulation (EU) 2024/1689 — Articles 17, 28–39, 30, 43, 44, 47, 48, 49, 71 and Annexes IV, V, VI, VII, VIII — is published in the Official Journal of the European Union L of 12 July 2024 (CELEX 32024R1689). Blockquotes on this page may be partial extracts of the cited Article; consult the EUR-Lex source for the complete OJ-published text including all triggers, sub-paragraphs and cross-references. Regulation (EC) No 765/2008 (general principles of the CE marking, accreditation framework) is referenced via Articles 30 and 48. The Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026, OJ L, 24.7.2026; CELEX 32026R1744, in force from 27 July 2026) amends Regulation (EU) 2024/1689; its OJ text supersedes the 2024 text where amended.

See it in Modulos

Modulos turns the Annex IV technical documentation into an evidence library you assemble once and refresh on substantial modification — with a clear route-selection rationale traceable to Article 43.

Request a demo

Disclaimer

This page is for general informational purposes and does not constitute legal advice.