Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.
Choose the route before release, then prepare the technical file, quality records, declaration, CE marking and registration.
Choose the assessment route from the reason the system is high-risk. Annex III points 2-8 use internal control. Point 1 biometric systems can use that route only when Article 43 standards conditions are met. Annex I Section A products follow their product-law procedure. A notified body is an authorised independent assessor. The route determines whether you need one.
Write down why the system is high-risk. Product-linked systems and Annex III use cases follow different assessment routes. That decision determines the evidence needed and whether a product-law assessor can assess the AI requirements.
For product-linked systems under Article 6(1), the AI system is high-risk when it is a safety component, or is itself a product, covered by Annex I Union harmonisation legislation and that product is already subject to third-party under that legislation.
For Annex III systems, Article 43 generally points to internal control, with a narrower notified body route for point 1 Annex III systems in the conditions listed in Article 43(1).
Check the application date separately from the route. Regulation (EU) 2026/1744 was published on 24 July 2026 and enters into force on 27 July 2026. It applies Chapter III Sections 1-3, except Article 6(5), from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Article 6(1) systems.
For Article 6(1) systems related to products under Annex I Section B, the amendment limits direct AI Act application to Article 6(1), Article 60a, and Articles 102-112; Articles 57-59 apply only where the high-risk requirements have been integrated into the sector law.
Record the exact Annex I instrument before selecting an AI Act conformity route.
Sources (3)
Supports the Article 6 high-risk classification split and Article 43 route selection for internal control, notified body assessment, and Annex I product-law assessment.
Classification rules for high-risk AI systems
Provides official Commission context for the AI Act risk-based framework and high-risk obligations.
comprehensive legal framework on AI
Binding amendment supporting the revised Chapter III application dates and the limited direct AI Act provisions for Article 6(1) systems related to Annex I Section B products.
Under Annex VI internal control, the provider checks three things: the quality management system meets Article 17; the technical file demonstrates Chapter III Section 2 compliance; and design, development and monitoring after release match that file.
Connect the Section 2 requirements to system design and operating controls: risk management, data governance, technical documentation, logging, deployer information, human oversight, accuracy, robustness, and cybersecurity. Keep the system evidence as well as any policy or supplier statement.
Sources (1)
Supports Article 11 technical documentation, Article 17 quality management, Article 18 retention, and Annex VI internal control evidence.
conformity assessment procedure based on internal control
An Annex III point 1 biometric system needs a notified body when the Article 43 standards conditions for internal control are not met. Triggers include missing standards or common specifications, partial standards use, unused common specifications and restrictions on a relevant part of a cited standard.
For high-risk AI systems covered by Annex I Section A product legislation, Article 43(3) sends the provider to the procedure required by that product law.
Notified bodies notified under those product laws may control conformity with AI Act Section 2 requirements if their compliance with specified AI Act notified-body requirements has been assessed in the relevant notification procedure.
Those sector-law notified bodies must apply for designation under AI Act Chapter III Section 4 by 28 January 2028; keep that application requirement with the assessor qualification record.
Amended Article 43(3) also requires assessment of Article 17 quality management and preserves the sector-law procedure when the system is also an Annex III use case.
A product does not need a third-party assessment solely because it includes a high-risk AI safety component if the relevant Section A legislation does not require that procedure.
When Annex VII applies to a system intended for use by law-enforcement, immigration, or asylum authorities, or by Union institutions, bodies, offices, or agencies, the relevant market surveillance authority acts as the notified body. Do not route those systems to an ordinary commercial notified body.
Check whether amended Article 75 assigns the system to the AI Office before selecting the assessor. For high-risk systems within that competence that require third-party assessment, the AI Office is responsible for the assessment and entrusts the work to designated notified bodies acting on the Commission's behalf.
Record that authority route instead of assuming the provider can engage any commercial assessor.
Sources (2)
Supports Article 43 notified-body triggers and Annex VII assessment of the quality management system and technical documentation.
assessment of the technical documentation
Supports the independence, competence, quality management, confidentiality, and cybersecurity expectations for notified bodies.
Requirements relating to notified bodies
The provider owns the pre-release checks under Article 16: system compliance, quality management, documentation, assessment, EU declaration of conformity, CE marking and registration where Article 49 requires it.
Article 47 and Annex V require a declaration for each high-risk AI system, issued under the provider's sole responsibility. It must identify the system, the provider or authorised representative, applicable Union law, relevant standards or common specifications, and, where applicable, the notified body, procedure, and certificate.
Sources (2)
Supports Article 16 provider obligations, Article 47 EU declaration of conformity, Article 48 CE marking, Article 49 registration, and Annex V declaration contents.
EU declaration of conformity
Supports registration requirements for high-risk AI systems before placement on the market or putting into service.
Registration
EN 18286:2026 covers provider quality management for AI Act purposes. Decision (EU) 2026/2274 cited it in the Official Journal on 14 October 2026. From that date, its relevant normative clauses support a presumption of conformity for the requirements they cover. The citation does not change application dates.
Annex ZA maps the standard to Article 17(1) quality-management requirements and the first sentence of Article 11(1), with conditions. Technical documentation must contain all Annex IV elements; the QMS must document Article 17(1)(a)-(m), and its risk-management system must comply with Article 9.
Article 17(2)-(4) remain outside the standard's coverage and need separate treatment where applicable.
EN 18286 alone does not cover all Chapter III Section 2 requirements or establish entitlement to Annex VI internal control for Annex III point 1 biometrics. Check the standards or common-specification coverage for every relevant Section 2 requirement before choosing that route.
Where Annex VII applies, the notified body still assesses the QMS and system technical documentation. Use the harmonised standards and quality-management guide to connect each procedure to evidence.
Check which applicable AI Act requirements each technical standard covers. A harmonised standard creates a presumption of conformity only after its reference is published in the Official Journal and only for the requirements covered by that reference.
A draft standard, an ISO or ETSI publication, or a standard used elsewhere in the organisation does not receive that legal effect automatically.
Common specifications are Commission acts used under the conditions in Article 41. Providers can use other technical solutions, but they must justify how those solutions meet an equivalent level of compliance. Codes of practice and Commission or standards-body guidance can organise evidence without replacing the binding requirement or the conformity route.
Sources (7)
Article 1 and the Annex cite EN 18286:2026; Article 2 and recital 6 establish 14 October 2026 entry into force and presumption limited to covered requirements.
Official publication announcement for the provider QMS standard; the later Official Journal decision controls citation status.
Commission explanation of harmonised standards, Official Journal citation, presumption of conformity, international standards, and the distinction from codes of practice.
Primary source for harmonised standards and common specifications.
Standards-body mapping used as non-binding technical context; it does not itself create a presumption of conformity.
Official ISO page for the management-system standard cited as supporting evidence.
Official ISO page for the risk-management guidance cited as supporting evidence.
Before release, check whether the file lets an authority, assessor, importer, distributor or customer understand the chosen route and verify its evidence. Keep the decision and supporting records together.
Escalate the file for legal and regulatory review when the route depends on Annex I product law, Annex III point 1 conditions, partial standards coverage, a restricted harmonised standard, non-application of common specifications, a substantial modification, or a notified-body refusal or restriction.
Article 46 permits a market surveillance authority, on a duly justified request and for a limited period, to authorise a specific high-risk system before is complete for exceptional public-security, life and health, environmental, or key industrial and infrastructure reasons.
The authority controls this exceptional authorisation; the conformity procedure must still be completed without undue delay. For systems covered by Annex I Section A product legislation, Article 46(7) instead limits the derogation to the one available under that product law.
No. Article 43 uses internal control for high-risk AI systems in Annex III points 2 to 8. Notified body involvement is triggered for Annex III point 1 systems in the conditions listed in Article 43(1), and Annex I product systems follow the relevant product-law route.
Article 18 requires providers to keep, for 10 years after placement on the market or putting into service, technical documentation, quality management documentation, approved notified-body change records where applicable, notified-body decisions and documents where applicable, and the EU declaration of conformity.
Article 43 requires a new after a substantial modification. For systems with a Union technical documentation assessment certificate, Annex VII also requires provider notice to the issuing notified body for changes that could affect compliance or intended purpose.
Sources (1)
Supports the practical release-gate checks across Articles 16, 17, 18, 43, 47, 48, 49, Annex IV, Annex V, Annex VI, and Annex VII.
Obligations of providers
Check the route, assessor requirements and evidence needed for your high-risk system.
"Conformity assessment"
"Classification rules for high-risk AI systems"
"conformity assessment procedure based on internal control"
"assessment of the technical documentation"
"EU declaration of conformity"
"Obligations of providers"
"Notifying authorities"
"notified bodies"
"Requirements relating to notified bodies"
"Identification numbers"
"lists of notified bodies"
"Registration"
"risk-based approach"
"comprehensive legal framework on AI"
"Notified Bodies"
Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.
Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.
Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.
Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.
Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.
Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.
Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.
See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.
Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.
Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.
Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.
Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.
Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.
Check each AI tool, decide which duties apply, and give every action an owner and evidence link.
Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.
Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.
High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.
Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.
Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.
Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.
Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.
Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.
Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.
Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.
Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.
Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.
Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.
Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.
See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.
See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.
Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.
Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.
Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.
Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.