For Heads-of · Practitioner
Conformity Assessment
The procedure by which the provider of a high-risk AI system shows that it meets the EU AI Act's requirements before placing it on the market. For most high-risk systems it is an internal control the provider carries out itself; for some biometric systems it needs a notified body.
- EU AI Act
- Article 43
- notified body
- harmonised standards
- CE marking
- EN 18286
The two routes
Article 43 sets the route. Annex III systems in points 2 to 8 (critical infrastructure, education, employment, essential services including credit, law enforcement, migration and justice) follow internal control (Annex VI): the provider checks its own quality management system and technical documentation against the requirements. Biometric systems (point 1) need a notified body (Annex VII) unless the provider has applied harmonised standards in full. Systems that are safety components of products already regulated by EU law follow that product's existing procedure.
Harmonised standards
A system built to harmonised standards cited in the Official Journal is presumed to meet the requirements they cover (Article 40). CEN and CENELEC are writing them: EN 18286, the quality management standard for Article 17, was approved in July 2026 but not yet cited, and the risk management standard was still being finalised in autumn 2026. Until standards are cited, providers show conformity against the Act's text directly.
After assessment
The provider draws up an EU declaration of conformity, affixes the CE marking (Article 48), registers the system in the EU database (Article 49) and keeps monitoring it; see post-market monitoring. A substantial modification means a new assessment. The gap is the AI system lifecycle controls gap; the AI impact assessment process supports classification.
Sources
Related Terms
EU AI Act
The European Union's regulation of AI systems by risk category, in force since 1 August 2024 and applying in stages. As of October 2026 the prohibitions, the AI literacy duty, the general-purpose model obligations and the Article 50 transparency duties all apply. The 2026 Digital Omnibus, Regulation (EU) 2026/1744, deferred the high-risk obligations to December 2027 and August 2028, softened the literacy duty and added two prohibitions. It reaches any organisation whose AI output is used in the EU, wherever the organisation sits.
High-Risk AI System
An AI system that the EU AI Act subjects to its full set of requirements, either because it is a safety component of a product covered by EU product law (Annex I) or because it is used in one of eight listed areas (Annex III), which include credit scoring and life and health insurance pricing. Since the 2026 Digital Omnibus the obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
ISO/IEC 42001
The international standard for an AI management system (AIMS): the policies, roles, risk assessment, impact assessment, controls and evidence an organisation puts around its development and use of AI so that the whole can be audited and certified. Published December 2023, and since 2025 surrounded by companion standards for impact assessment (42005) and for the bodies that certify against it (42006), and from 2026 by EN 18286, the European quality management standard written for the EU AI Act.
Post-Market Monitoring
A provider's documented, continuous collection and analysis of data on how its high-risk AI system performs once in use, so that problems are found and fixed throughout the system's life. It is the legal form of model monitoring under the EU AI Act.
Provider and Deployer
The two main roles the EU AI Act assigns obligations to. The provider develops an AI system or general-purpose model, or has one developed, and places it on the market or puts it into service under its own name. The deployer uses an AI system under its authority in a professional capacity. Which role an organisation holds decides which obligations it carries, and an organisation can move from one to the other without intending to.