What is a conformity assessment?
A conformity assessment is the procedure by which the provider of a high-risk AI system demonstrates, before placing it on the EU market or putting it into service, that the system meets the requirements of the EU AI Act. The mechanism is borrowed from European product safety law, where it sits behind the CE marking on machinery, toys, and medical devices. The output is an EU declaration of conformity signed by the provider, the CE marking on the product or its documentation, and an entry in the EU database of high-risk systems.
How a conformity assessment works
There are two routes. Under internal control, the provider assesses itself. It verifies that its quality management system meets the Act, checks the technical documentation against each requirement, and confirms that the design and development process matches that documentation. Most Annex III systems, such as hiring tools and credit scoring, take this route. Under third-party assessment, a notified body, an independent organization designated by a member state, examines the quality management system and the technical documentation and issues a certificate. The Act requires this route for certain biometric systems where harmonized standards have not been applied in full.
Systems embedded in products covered by other EU legislation follow that legislation’s own procedure, with the AI requirements folded in, so a medical device with an AI component is assessed by the notified body already involved. Harmonized standards shorten the work: when a provider follows a published standard covering a requirement, the system is presumed to conform on that point. The assessment must be repeated whenever the system is substantially modified, although a provider that pre-defines how its model will keep learning can include those changes in the original assessment.
Conformity assessment in practice
A software vendor sells a candidate ranking tool to staffing agencies in Germany and Poland. The tool is high-risk under the employment annex, so the vendor documents its quality management system, assembles technical documentation covering data sources, bias testing, accuracy metrics, and logging design, and verifies each requirement in a traceability matrix. The compliance lead signs the declaration of conformity, the product documentation carries the CE marking, and the system is registered. Customers receive the declaration and the instructions for use as part of the contract pack.
What to watch for
- Self-assessment still has to be evidenced, since market surveillance authorities can demand the documentation at any time.
- Line up a notified body early if your system needs one, because capacity is limited.
- Decide in advance which model changes count as substantial modification, or every retraining becomes a legal question.
- As a buyer, ask for the declaration of conformity and check that it names the version you are deploying.