EU AI Act High-risk conformity route selector

Do not choose an assessment procedure until the high-risk basis is written down. The AI Act treats Annex I product-law systems differently from Annex III standalone use cases, and Article 43 routes them through different assessment mechanics.

For Annex I, identify the section and sector legislation first. Section A includes New Legislative Framework legislation such as toys, radio equipment, pressure equipment, lifts, PPE, gas appliances, medical devices, and in vitro diagnostic medical devices. Article 43 sends those systems through the conformity assessment procedure required by the sector law, with the AI Act Chapter III Section 2 requirements included in that assessment.

Regulation (EU) 2026/1744 moves machinery from Annex I Section A to Section B. For machinery and other Section B systems, only the AI Act provisions identified in amended Article 2(2) apply directly unless the relevant high-risk requirements have been integrated into the sector legislation. Do not route a Section B system through Article 43 merely because it appears in Annex I.

For Annex III, record the exact point and use case. Annex III covers biometrics, critical infrastructure, education and vocational training, employment and workers' management, access to essential private and public services, law enforcement, migration and border control, and justice and democratic processes.

Route selection and application timing are separate questions. Regulation (EU) 2026/1744 entered into force on 27 July 2026 and applies Chapter III Sections 1-3 from 2 December 2027 for systems classified under Article 6(2) and Annex III, and from 2 August 2028 for systems classified under Article 6(1) and Annex I. Record the applicable route and date even when conformity work starts earlier.

Once the high-risk basis is known, apply Article 43 without collapsing the categories. Annex III point 1 systems can use internal control under Annex VI only when the provider has applied harmonised standards, or common specifications where applicable, that cover the relevant requirements. Otherwise Article 43 requires the Annex VII procedure with assessment of the quality management system and technical documentation by a notified body.

For Annex III point 1 systems, also use Annex VII when harmonised standards do not exist and common specifications are unavailable, when the provider has not applied the harmonised standard or has applied it only partly, when common specifications exist but are not applied, or when a harmonised standard is published with a restriction for the restricted part.

For Annex III points 2 to 8, Article 43 points providers to the internal-control procedure in Annex VI. That still requires the provider to verify the quality management system, examine the technical documentation, and confirm that design, development, and post-market monitoring are consistent with the documentation.

For Annex I Section A product-law systems, follow the conformity assessment procedure required by the relevant product legislation. If that legislation allows the manufacturer to opt out of third-party assessment because all relevant harmonised standards are applied, Article 43 allows that option only when harmonised standards or common specifications also cover all AI Act Chapter III Section 2 requirements.

The standards decision changes whether Annex III point 1 can stay with internal control or must move to Annex VII. For every requirement relied on, record whether the provider applied an OJEU-referenced harmonised standard in full, applied it only in part, used a common specification, or adopted another technical solution.

Harmonised standards and common specifications can create a presumption of conformity only to the extent that they cover the relevant AI Act requirements or obligations. If the provider does not comply with common specifications, Article 41 requires justification that the adopted technical solutions meet the requirements to at least an equivalent level.

When Annex VII applies, the evidence package must be ready for a notified body review of both the quality management system and the technical documentation. Annex VII allows the notified body to request further evidence or tests, and in limited circumstances to access training, validation, and testing datasets or trained models where necessary for the assessment.

The selector is complete only when the post-assessment outputs are assigned. Article 47 requires a written, machine-readable, physical or electronically signed EU declaration of conformity for each high-risk AI system and requires the provider to keep it available to national competent authorities for 10 years after placement on the market or putting into service.

Article 48 requires CE marking for high-risk AI systems. Digital systems can use a digital CE marking if it is easily accessible through the interface, a machine-readable code, or another electronic means. Where a notified body is responsible for the Article 43 conformity assessment, the CE marking must be followed by that body's identification number.

Registration depends on the high-risk basis and actor. Article 49 requires providers or authorised representatives to register Annex III high-risk systems, except point 2 critical infrastructure systems, in the EU database before placing them on the market or putting them into service. Providers that classify an Annex III system as not high-risk under Article 6(3) must also register that conclusion. Public authorities and Union bodies deploying Annex III systems, except point 2, must register themselves and the use of the system. Article 49 routes point 2 critical infrastructure systems to national registration.

A new conformity assessment is required after a substantial modification. A planned change to a continuously learning system does not count as a substantial modification when the provider predetermined the change and its performance in the initial conformity assessment and included it in the technical documentation. Store that predetermined-change evidence with the initial route decision.

Article 46 allows a market surveillance authority, on a duly justified request and for a limited period, to authorise a specific high-risk system before the conformity procedure is complete for exceptional public-security, life and health, environmental, or key industrial and infrastructure reasons. For high-risk systems related to products covered by Annex I Section A, only the derogations in the applicable sector legislation apply. Treat this as an authority-controlled derogation, not a fifth route: the required conformity assessment must still be completed without undue delay.