07 · Conformity Assessment & Notified Bodies
- Regulation (EU) 2024/1689 + Regulation (EU) 2026/1744 + Commission AI Act standardisation page
- Notified bodies chapter became applicable: 2 August 2025
Notified bodies chapter became applicable 2 August 2025. Chapter III high-risk conformity requirements apply from 2 December 2027 for Article 6(2) / Annex III systems and 2 August 2028 for Article 6(1) / Annex I systems.
What conformity assessment means
Before a high-risk AI system can be placed on the EU market, the provider must demonstrate it meets all requirements in Chapter III. This is the conformity assessment. Two routes:
Route 1 — Internal (self-assessment)
Available for most Annex III high-risk AI systems. The provider conducts and documents the assessment themselves against the requirements. If done correctly, they can then issue an EU Declaration of Conformity and affix the CE mark.
Route 2 — Third-party (notified body)
Required for:
- Article 6(1) / Annex I systems where the relevant Union harmonisation legislation requires third-party conformity assessment, with AI Act requirements integrated into that product-law assessment for Section A systems
- Remote biometric identification systems, biometric categorisation systems and emotion recognition systems where Article 43 requires notified-body involvement
A notified body assesses the technical documentation, quality management system, and the AI system itself.
What notified bodies are
Notified bodies (NBs) are independent third-party conformity assessment organisations designated by member state notifying authorities. They must meet criteria in Article 31 (independence, competence, impartiality, liability coverage). They notify the Commission of their designation. Once notified, they appear in the NANDO database.
Capacity warning: AI-focused notified bodies are scarce as of mid-2026. Most AI NBs come from adjacent sectors (medical devices, machinery). This gap is part of why the Omnibus extended the high-risk product transition to 2028.
Regulation (EU) 2026/1744 adds Annex XIV, which standardises the codes, categories and AI-system types used when notifying conformity assessment bodies. It also allows the Commission to identify cases where equivalent or stronger requirements in Annex I, Section A product law can limit duplicative AI Act requirements without reducing protection.
Conformity assessment process for a high-risk AI provider
Step-by-step (self-assessment route):
| Step | Action | Article |
|---|---|---|
| 1 | Confirm system is high-risk under Art. 6 (Annex I or III) | Art. 6 |
| 2 | Establish and document risk management system (lifecycle-long) | Art. 9 |
| 3 | Document data governance (training/validation/testing datasets) | Art. 10 |
| 4 | Compile Annex IV technical documentation package | Art. 11 + Annex IV |
| 5 | Build in automatic event logging | Art. 12 |
| 6 | Prepare instructions for use for deployers | Art. 13 |
| 7 | Design and validate human oversight mechanisms | Art. 14 |
| 8 | Establish quality management system | Art. 17 |
| 9 | Conduct internal assessment (or engage notified body if required) | Art. 43 |
| 10 | Issue EU Declaration of Conformity (keep for 10 years) | Art. 47 |
| 11 | Affix CE marking | Art. 48 |
| 12 | Register system in EU database (before deployment for public-body deployers) | Art. 71 |
Post-market obligations
- Post-market monitoring plan: continuous monitoring of performance in production per Art. 72
- Serious incident reporting: providers must report to national market surveillance authorities without undue delay (Art. 73)
- Market surveillance: national authorities conduct checks; can require access to training data and documentation
Harmonised standards
CEN/CENELEC are developing harmonised standards under the AI Act. Once referenced in the Official Journal, compliance with them creates a presumption of conformity for the requirements they cover. The Commission's standardisation page still described the standards as under development on 3 August 2026; no AI Act harmonised-standard reference was located in the Official Journal during the 7 September 2026 audit.
Standards page: https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation FLI standards overview: https://artificialintelligenceact.eu/standard-setting-overview/
Technical verification framework (academic perspective)
The arXiv paper (arXiv:2512.13907, Dec 2024) maps each legal requirement to concrete technical verification methods — covering dataset documentation, algorithmic auditing, robustness testing, and human oversight mechanisms. Useful for technical teams building compliance processes. URL: https://arxiv.org/html/2512.13907v3
Key articles
| Topic | Article(s) |
|---|---|
| Conformity assessment procedures | Art. 43 |
| Annex I / product-law conformity route | Art. 43(1), Art. 43(3), Annex I |
| Self-assessment (Annex III) | Art. 43(2) |
| Notified body criteria | Art. 31 |
| Notifying authorities | Arts. 28–30 |
| EU Declaration of Conformity | Art. 47 |
| CE marking | Art. 48 |
| EU database | Art. 71 |
| Post-market monitoring | Art. 72 |
| Serious incident reporting | Art. 73 |
| Quality management system | Art. 17 |
| Technical documentation | Art. 11 + Annex IV |