Conformity assessment and registration failure

What it is

Before a high-risk system under the EU AI Act is placed on the market or put into service, its provider must complete a conformity assessment, draw up a declaration of conformity, affix the marking and register the system. Certain deployers must also register their use. These are formal steps with documentary outputs, and a substantial modification can require them to be repeated. The risk is that they are missed, usually because the system was not recognised as high-risk or the organisation did not realise it was the provider.

How it happens

• The system was misclassified, so no one started the process.
• An organisation that modified or rebranded a system did not see that it had become its provider.
• The assessment was done once and not revisited after substantial change.
• A deployer assumed that registration was the supplier's task alone.

Why it matters

Operating without these steps is a breach carrying significant penalties, and the system may have to be withdrawn. For Annex III systems the obligations apply from 2 December 2027, which leaves time to prepare and none to spare for systems already in use.

Warning signs

• No list exists of systems the organisation provides or deploys that are high-risk.
• No declaration of conformity is held for a high-risk system in use.
• Supplier contracts do not state who is provider.
• Substantial changes have been made with no review of conformity.

Who owns it

Compliance or legal owns the regulatory process. The system owner is accountable for supplying the evidence. Procurement obtains declarations from suppliers.

In practice

A lender builds its own creditworthiness model for use in two EU member states and treats it as an internal tool. It is a high-risk system and the lender is its provider. The same pattern generalises to any organisation that builds for its own use and does not see itself as a provider.