EU AI Act Choose a high-risk assessment route

Write down the high-risk classification first. Annex I product systems and Annex III use cases follow different conformity assessment procedures.

For Annex I, identify the section and sector legislation first. Section A includes New Legislative Framework legislation such as toys, radio equipment, pressure equipment, lifts, PPE, gas appliances, medical devices, and in vitro diagnostic medical devices.

Article 43 sends those systems through the conformity assessment procedure required by the sector law, with the AI Act Chapter III Section 2 requirements included in that assessment.

Regulation (EU) 2026/1744 moves machinery from Annex I Section A to Section B. For machinery and other Section B systems, only the AI Act provisions identified in amended Article 2(2) apply directly unless the relevant high-risk requirements have been integrated into the sector legislation.

Do not route a Section B system through Article 43 merely because it appears in Annex I.

For Annex III, record the exact point and use case. Annex III covers biometrics, critical infrastructure, education and vocational training, employment and workers' management, access to essential private and public services, law enforcement, migration and border control, and justice and democratic processes.

Route selection and application timing are separate questions.

Regulation (EU) 2026/1744 entered into force on 27 July 2026 and applies Chapter III Sections 1-3, except Article 6(5), from 2 December 2027 for systems classified under Article 6(2) and Annex III, and from 2 August 2028 for systems classified under Article 6(1) and Annex I.

Record the applicable route and date even when conformity work starts earlier.

For Annex III point 1 biometric systems, provider-run internal control under Annex VI is available only when the provider fully applies harmonised standards or applicable common specifications covering the relevant requirements. Otherwise use Annex VII: a notified body assesses the quality management system and technical documentation.

Use Annex VII if relevant harmonised standards and common specifications are unavailable. Also use it when a standard is unused or only partly applied, applicable common specifications are unused, or a cited standard has a restriction affecting the relevant part.

For Annex III points 2 to 8, Article 43 points providers to the internal-control procedure in Annex VI. That still requires the provider to verify the quality management system, examine the technical documentation, and confirm that design, development, and post-market monitoring are consistent with the documentation.

For Annex I Section A product-law systems, follow the conformity assessment procedure required by the relevant product legislation.

If that legislation allows the manufacturer to opt out of third-party assessment because all relevant harmonised standards are applied, Article 43 allows that option only when harmonised standards or common specifications also cover all AI Act Chapter III Section 2 requirements.

If the same system is covered by Annex I Section A product legislation and also falls within an Annex III category, amended Article 43(3) selects the relevant product-law conformity assessment procedure. Record both classifications, then use the sector procedure rather than opening a separate Annex III route for the same system.

EN 18286:2026 was cited on 14 October 2026 by Decision (EU) 2026/2274. Its presumption of conformity covers only the mapped requirements.

Annex ZA maps Article 17(1) and the first sentence of Article 11(1), with conditions: document every aspect in Article 17(1)(a)-(m), include every Annex IV element in the technical file, and maintain an Article 9-compliant risk-management system. Assess Article 17(2)-(4) separately because the standard does not cover them.

Applying EN 18286 alone does not cover all Chapter III Section 2 requirements or establish the Annex III point 1 conditions for Annex VI internal control. Check every relevant Section 2 requirement against the applied standards or common specifications; retain Annex VII when Article 43 requires it.

The citation changes neither application dates nor the notified body's QMS and technical-documentation assessment duties. Follow the harmonised standards and quality-management guide for procedure and evidence mapping.

Standards coverage determines whether a point 1 biometric system can use internal control or needs Annex VII assessment. For each requirement, identify the harmonised standard used and whether its reference is published in the Official Journal of the European Union (OJEU).

Record full or partial application, any common specification used, and any alternative technical solution.

Harmonised standards and common specifications can create a presumption of conformity only to the extent that they cover the relevant AI Act requirements or obligations. If the provider does not comply with common specifications, Article 41 requires justification that the adopted technical solutions meet the requirements to at least an equivalent level.

When Annex VII applies, the evidence package must be ready for a notified body review of both the quality management system and the technical documentation.

Annex VII allows the notified body to request further evidence or tests, and in limited circumstances to access training, validation, and testing datasets or trained models where necessary for the assessment.

Assign the remaining market-entry records before closing the route decision. Article 47 requires a written, machine-readable EU declaration of conformity for each high-risk system, signed physically or electronically. Keep it available to national authorities for 10 years after supplying or first using the system.

Article 48 requires CE marking for high-risk AI systems. Digital systems can use a digital CE marking if it is easily accessible through the interface, a machine-readable code, or another electronic means.

Where a notified body is responsible for the Article 43 conformity assessment, the CE marking must be followed by that body's identification number.

Registration depends on the high-risk basis and actor. Article 49 requires providers or authorised representatives to register Annex III high-risk systems, except point 2 critical infrastructure systems, in the EU database before placing them on the market or putting them into service.

Providers that classify an Annex III system as not high-risk under Article 6(3) must also register that conclusion. Public authorities and Union bodies deploying Annex III systems, except point 2, must register themselves and the use of the system. Article 49 routes point 2 critical infrastructure systems to national registration.

A new conformity assessment is required after a substantial modification. A planned change to a continuously learning system does not count as a substantial modification when the provider predetermined the change and its performance in the initial conformity assessment and included it in the technical documentation.

Store that predetermined-change evidence with the initial route decision.

Article 46 allows a market surveillance authority, on a duly justified request and for a limited period, to authorise a specific high-risk system before the conformity procedure is complete for exceptional public-security, life and health, environmental, or key industrial and infrastructure reasons.

For high-risk systems related to products covered by Annex I Section A, only the derogations in the applicable sector legislation apply. Treat this as an authority-controlled derogation, an exceptional authorisation: the required conformity assessment must still be completed without undue delay.