AI Act Conformity Assessment

Full definition

Two paths exist: (1) internal conformity assessment (Annex VI) — the provider self-assesses against the regulation, used for most Annex III high-risk systems; (2) third-party assessment by a notified body (Annex VII) — mandatory for Annex III biometric systems when the provider has not fully applied harmonised standards or common specifications (with them, it may choose Annex VI instead); AI built into Annex I products, such as medical devices, follows the notified-body procedure of that product law, with the AI Act requirements and parts of Annex VII folded in (Article 43(3)). Successful conformity yields a CE marking and EU declaration of conformity, plus, for Annex III systems, registration in the EU AI database. Substantial modifications trigger reassessment.

Why it matters

Conformity assessment is the gate between developing a high-risk AI system and lawfully selling it in the EU. Cycle time and cost must be in every product timeline and budget.

Example

A medical-device manufacturer integrates AI triage into its product; because the device falls under MDR, it requires third-party notified-body assessment combining MDR and AI Act Annex VII before CE marking.

Next steps

• Get a free workflow map →We map one of your workflows and give you a written verdict: software, a process change or AI. No obligation.
• AI consulting cost guide →Hourly rates and project budgets by firm tier, from independents to the Big Four.

Related terms

• EU AI Act
  The EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025: general-purpose AI model rules from 2 August 2025 (Commission fines from 2 August 2026; models already on the market have until 2 August 2027) and, after the Digital Omnibus (Regulation (EU) 2026/1744), high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• EU AI Act Risk Tier
  EU AI Act risk tiers are the four-level classification — unacceptable, high, limited, and minimal/no risk — that determines which obligations apply to an AI system placed on the EU market under Regulation (EU) 2024/1689.
• Fundamental Rights Impact Assessment (FRIA)
  A Fundamental Rights Impact Assessment (FRIA) is the structured analysis required by Article 27 of the EU AI Act for certain deployers of high-risk AI systems — bodies governed by public law, private entities providing public services, and deployers of credit-scoring AI or of life- and health-insurance risk-assessment and pricing AI (Annex III points 5(b) and 5(c)).
• AI Governance
  AI governance is the framework of policies, roles, controls, and processes an organization uses to ensure its AI systems are lawful, safe, fair, accountable, and aligned with business intent — across the full lifecycle from problem framing to retirement.

More governance & risk terms

• Data Residency
  Data residency is the requirement — imposed by law, regulation, contract, or policy — that data be stored, processed, or accessed only within specified geographic or jurisdictional boundaries.
• AI Bias
  AI bias is systematic, unfair difference in an AI system's outputs across demographic, geographic, or other groups — usually caused by biased training data, biased labels, or biased problem framing rather than the algorithm itself.