Complete the Required Conformity Assessment for High-Risk AI

Sub-obligations

These are independently assessable parts of the parent requirement.

1. Article 43(1)

   Upcoming

   Apply the Required Conformity Assessment Route for Annex III Point 1 High-Risk AI

   Tracker Guidance

   For Annex III point 1 systems, select the permitted conformity-assessment route when applicable harmonised standards/common specifications are used; use the Annex VII notified-body procedure where the conditions in Article 43(1) require it.

   Official text

   1. For high-risk AI systems listed in point 1 of Annex III, where, in demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider has applied harmonised standards referred to in Article 40, or, where applicable, common specifications referred to in Article 41, the provider shall opt for one of the following conformity assessment procedures based on: (a) the internal control referred to in Annex VI; or (b) the assessment of the quality management system and the assessment of the technical documentation, with the involvement of a notified body, referred to in Annex VII. In demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider shall follow the conformity assessment procedure set out in Annex VII where: (a) harmonised standards referred to in Article 40 do not exist, and common specifications referred to in Article 41 are not available; (b) the provider has not applied, or has applied only part of, the harmonised standard; (c) the common specifications referred to in point (a) exist, but the provider has not applied them; (d) one or more of the harmonised standards referred to in point (a) has been published with a restriction, and only on the part of the standard that was restricted. For the purposes of the conformity assessment procedure referred to in Annex VII, the provider may choose any of the notified bodies. However, where the high-risk AI system is intended to be put into service by law enforcement, immigration or asylum authorities or by Union institutions, bodies, offices or agencies, the market surveillance authority referred to in Article 74(8) or (9), as applicable, shall act as a notified body.

2. Article 43(2)

   Upcoming

   Use Internal-Control Conformity Assessment for Annex III Points 2 to 8 High-Risk AI

   Tracker Guidance

   For high-risk AI systems in Annex III points 2 to 8, follow the conformity assessment based on internal control under Annex VI, subject to later delegated changes.

   Official text

   2. For high-risk AI systems referred to in points 2 to 8 of Annex III, providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body.

3. Article 43(3)

   Upcoming

   Integrate AI Act Requirements Into the Applicable Annex I Section A Product Conformity Assessment

   Tracker Guidance

   For a high-risk AI system covered by Union harmonisation legislation listed in Annex I Section A, follow the relevant conformity-assessment procedure required by that legislation. Include the AI Act Chapter III Section 2 requirements in that assessment and ensure the Article 17 quality management system is also assessed. If the sectoral legislation permits a conformity assessment without third-party involvement only when harmonised standards are applied, use that option only if harmonised standards or applicable Article 41 common specifications also cover all AI Act Section 2 requirements. If the system also falls within an Annex III use case, continue to use the conformity-assessment procedure required by the relevant Annex I Section A legislation.

   Official text

   3. For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I, the provider of the system shall follow the relevant conformity assessment procedure as required in accordance with the relevant Union harmonisation legislation. The requirements set out in Section 2 of this Chapter shall apply to those high-risk AI systems and shall be part of that assessment. Assessment of the quality management system set out in Article 17 shall also be undertaken, and points 3, 4.3, 4.4. and 4.5, the fifth paragraph of point 4.6 and point 5 of Annex VII shall apply. For the purposes of that conformity assessment, notified bodies which have been notified under the Union harmonisation legislation listed in Section A of Annex I shall have the power to assess the conformity of high-risk AI systems with the requirements set out in Section 2 of this Chapter, provided that the compliance of those notified bodies with the requirements laid down in Article 31(4), (5), (10) and (11) has been assessed in the context of the notification procedure in accordance with the relevant Union harmonisation legislation, which is evidenced through the assessment as part of the existing notification. Without prejudice to Article 28, such notified bodies which have been notified under the Union harmonisation legislation in Section A of Annex I, shall apply for designation in accordance with Section 4 of this Chapter by 28 January 2028. [Excerpt - see official source for complete provision]

   Excerpt stored at a complete legal-unit boundary. See the official source for the full provision.

4. Article 43(4)

   Upcoming

   Perform a New Conformity Assessment After a Substantial Modification

   Tracker Guidance

   A high-risk AI system already assessed must undergo a new conformity assessment after a substantial modification, except for pre-determined learning changes already covered by the initial assessment and technical documentation.

   Official text

   4. High-risk AI systems that have already been subject to a conformity assessment procedure shall undergo a new conformity assessment procedure in the event of a substantial modification, regardless of whether the modified system is intended to be further distributed or continues to be used by the current deployer. For high-risk AI systems that continue to learn after being placed on the market or put into service, changes to the high-risk AI system and its performance that have been pre-determined by the provider at the moment of the initial conformity assessment and are part of the information contained in the technical documentation referred to in point 2(f) of Annex IV, shall not constitute a substantial modification.