What is conformity assessment under the EU AI Act?
Conformity assessment is the process by which a provider of a high-risk AI system demonstrates that the system meets all applicable EU AI Act requirements before it is placed on the market. For most high-risk AI systems, providers can use internal self-assessment (Annex VI). For specific categories — notably biometric systems — third-party assessment by a notified body is required (Annex VII).
Self-assessment is not informal: it requires structured evidence, complete technical documentation, and a formal declaration of conformity.
Key points
- Internal conformity assessment (Annex VI) requires the provider to verify compliance with all applicable requirements, maintain technical documentation, implement a quality management system, and issue a declaration of conformity.
- Third-party assessment (Annex VII) by a notified body is mandatory for certain biometric identification systems and may be required by sector-specific legislation.
- Conformity assessment is not a one-time event. Substantial modifications to the system require a new assessment.
- The CE marking can only be affixed after successful conformity assessment and is the visible sign that the system has been assessed.
Why it matters
Conformity assessment is the formal gate between development and market placement. Without it, a high-risk AI system cannot legally be placed on the EU market. Organizations that treat it as a future step rather than an integral part of the governance chain risk finding — too late — that their documentation, evidence, and quality management are insufficient to support the assessment.
How EAB approaches this
EAB structures the governance record to support conformity assessment readiness. Technical Documentation Readiness ensures Annex IV requirements are met. The Obligation Matrix maps every applicable requirement. Evidence Readiness shows whether the evidence basis is sufficient to support a conformity assessment.