Article 43: choosing your conformity route

Lesson 2 of 5 in Conformity Assessment, Standards, CE Marking, and Post-Market Duties.

Conformity assessment is the checkpoint between development and market. Article 43 assigns every high-risk system one of three routes, and the assignment follows directly from how the system became high-risk in the first place — the Article 6 classification you already know.

Route A — most Annex III systems (points 2–8): internal control. The provider itself verifies its quality management system, technical documentation and design against the requirements, following Annex VI. No third party is involved. This surprised many observers: employment screeners, credit scorers, exam proctors — all self-assessed.

Route B — Annex III point 1 (biometrics): it depends on standards. If the provider has applied harmonized standards (or common specifications) in full, it may choose internal control or a notified body. If standards don’t exist, weren’t applied, or were applied only in part, Annex VII third-party assessment is mandatory — a notified body audits the quality management system and examines the technical documentation before any certificate issues.

Route C — Annex I Section A products: ride the sectoral procedure. An AI safety component in a machine, lift, or medical device doesn’t get a separate AI Act assessment. The AI Act requirements are checked inside the third-party conformity procedure the sectoral law already demands — one assessment, one notified body, with the AI checklist folded in.

Conformity route planner (Art 43)

  1. High-risk AI system
  2. High-risk via Annex I Section A product law?

    Safety components under sectoral Union harmonisation legislation (machinery, medical devices, lifts, toys…) that already requires third-party conformity assessment.

  3. Embed in the sectoral procedure

    The sectoral notified body verifies the AI Act requirements within the existing product procedure — no separate AI assessment (Art 43(3)).

  4. Annex III point 1 (biometrics)?

    Post remote biometric identification, biometric categorisation of sensitive attributes, emotion recognition.

  5. Internal control — Annex VI

    Provider self-verifies QMS, technical documentation and design against Section 2 requirements. Applies to Annex III points 2–8 (Art 43(2)).

  6. Harmonized standards / common specs applied in full?

    Partial application, or standards that do not exist yet, count as “no” (Art 43(1)).

  7. Provider chooses: Annex VI or Annex VII

    Full application of cited standards buys the option of self-assessment even for biometrics.

  8. Notified-body assessment — Annex VII

    Notified body audits the quality management system and assesses the technical documentation; issues a certificate if satisfied.

  9. Declaration of conformity + CE marking

    Arts 47–48, then registration in the EU database (Art 49) before placing on the market.

Annex VI — internal control

Who assesses: the provider itself. What it covers: verifying the quality management system complies with Article 17, checking the technical documentation against the requirements, and confirming the design/development process and post-market monitoring are consistent with that documentation.

No certificate issues — your EU declaration of conformity is the output, and you carry the full burden of proof if an authority ever asks.

Annex VII — notified body

Who assesses: a notified body. What it covers: a full audit of the quality management system plus assessment of the technical documentation, with power to demand further evidence, run tests, and — where needed to assess conformity — request access to training and trained models, including under strict confidentiality.

Output: a Union technical documentation assessment certificate. Changes to the approved system or QMS go back to the notified body.

Sectoral embedding

Who assesses: the notified body under the sectoral regime (MDR, machinery, lifts…). What it covers: everything the sectoral law requires, with the AI Act’s Section 2 requirements verified inside the same procedure (Art 43(3)).

Points of the Annexes VI/VII machinery apply with sectoral adaptations. One product, one procedure, one CE mark — the AI Act rides along rather than duplicating.

Conformity assessment is not a one-time gate. A substantial modification — a change not foreseen in the initial assessment that affects compliance or the intended purpose — sends the system back through the procedure (Art 43(4)). But the Act carved out an exemption engineered for machine learning: changes to a continuously learning system that were pre-determined by the provider at the initial assessment and documented in the technical documentation are not substantial modifications. Define your learning envelope up front — retraining cadence, data sources, performance bounds — and the system can keep learning inside it without re-assessment. Step outside the envelope, and the clock resets.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.