EU AI Act Conformity Assessment and Notified Bodies

Start by recording why the AI system is high-risk. Article 6 separates product-linked high-risk AI from Annex III use cases. That split controls the conformity route, the evidence package, and whether an existing product-law notified body may become part of the assessment.

For product-linked systems under Article 6(1), the AI system is high-risk when it is a safety component, or is itself a product, covered by Annex I Union harmonisation legislation and that product is already subject to third-party conformity assessment under that legislation. For Annex III systems, Article 43 generally points to internal control, with a narrower notified body route for point 1 Annex III systems in the conditions listed in Article 43(1).

Check the application date separately from the route. Regulation (EU) 2026/1744 was published on 24 July 2026 and enters into force on 27 July 2026. It applies Chapter III Sections 1-3 from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Article 6(1) systems. For Article 6(1) systems related to products under Annex I Section B, the amendment limits direct AI Act application to Article 6(1), Article 60a, and Articles 102-112; Articles 57-59 apply only where the high-risk requirements have been integrated into the sector law. Record the exact Annex I instrument before selecting an AI Act conformity route.

Annex VI internal control still requires the provider to verify that the quality management system complies with Article 17, examine the technical documentation against the high-risk requirements in Chapter III Section 2, and verify that the design, development process, and post-market monitoring match the technical documentation.

The minimum evidence package should therefore connect the Section 2 requirements to system design and operating controls: risk management, data governance, technical documentation, logging, deployer information, human oversight, accuracy, robustness, and cybersecurity. A self-assessment that only stores a policy or vendor attestation does not answer Annex VI.

A notified body is required under Article 43(1) for high-risk AI systems listed in point 1 of Annex III when the provider cannot rely fully on the relevant harmonised standards or common specifications, including where no such standards or specifications exist, only part of a standard is applied, a common specification is not applied, or a standard is published with a restriction for the relevant part.

For high-risk AI systems covered by Annex I Section A product legislation, Article 43(3) sends the provider to the conformity assessment procedure required by that product law. Notified bodies notified under those product laws may control conformity with AI Act Section 2 requirements if their compliance with specified AI Act notified-body requirements has been assessed in the relevant notification procedure.

When Annex VII applies to a system intended for use by law-enforcement, immigration, or asylum authorities, or by Union institutions, bodies, offices, or agencies, the relevant market surveillance authority acts as the notified body. Do not route those systems to an ordinary commercial notified body.

Article 16 makes the provider responsible for the complete pre-market chain: comply with Section 2 requirements, operate a quality management system, keep documentation, run the Article 43 conformity assessment before placement or putting into service, draw up the EU declaration of conformity, affix CE marking, and register where Article 49 applies.

Article 47 and Annex V require a declaration for each high-risk AI system, issued under the provider's sole responsibility. It must identify the system, the provider or authorised representative, applicable Union law, relevant standards or common specifications, and, where applicable, the notified body, procedure, and certificate.

Notifying authorities are Member State authorities responsible for the assessment, designation, notification, and monitoring of conformity assessment bodies. They must be organised to avoid conflicts of interest and to safeguard objectivity and impartiality. A notifying authority is not the provider's assessor in the same way as a notified body; it controls which conformity assessment bodies can become notified bodies and monitors them.

A notified body is the conformity assessment body that has been notified and may perform the notified-body assessment tasks within the scope of its notification. Article 31 requires notified bodies to be independent of providers and other economically interested operators, to avoid consultancy conflicts, to maintain confidentiality, and to have sufficient administrative, technical, legal, and scientific personnel for the relevant AI systems, data, computing, and AI Act requirements.

A technical standard supports conformity only to the extent that it covers an applicable AI Act requirement. A harmonised standard creates a presumption of conformity only after its reference is published in the Official Journal and only for the requirements covered by that reference. A draft standard, an ISO or ETSI publication, or a standard used elsewhere in the organisation does not receive that legal effect automatically.

Common specifications are Commission acts used under the conditions in Article 41. Providers can use other technical solutions, but they must justify how those solutions meet an equivalent level of compliance. Codes of practice and Commission or standards-body guidance can organise evidence without replacing the binding requirement or the conformity route.

Treat this checklist as a release gate for a high-risk AI system. It focuses on whether the conformity file would let a competent authority, notified body, importer, distributor, or enterprise customer understand the route chosen and verify the evidence without rebuilding the history from memory.

Escalate the file for legal and regulatory review when the route depends on Annex I product law, Annex III point 1 conditions, partial standards coverage, a restricted harmonised standard, non-application of common specifications, a substantial modification, or a notified-body refusal or restriction.

Article 46 permits a market surveillance authority, on a duly justified request and for a limited period, to authorise a specific high-risk system before conformity assessment is complete for exceptional public-security, life and health, environmental, or key industrial and infrastructure reasons. This is an authority-controlled derogation, not an alternative provider route; the conformity procedure must still be completed without undue delay.