Digital Lexicon Hub

The process of demonstrating that a product or system meets legal or standard requirements before it is placed on the market or put into service.

For providers of high-risk AI systems, a completed conformity assessment is a precondition for the EU market, so its timing, evidence and cost affect launch plans, contracts and the liability that deployers will accept.

A provider of an AI tool that ranks job applicants, an Annex III use case, follows internal control: it checks its quality management system and technical documentation against the requirements, signs an EU declaration of conformity, affixes CE marking and registers the system.

Passing an assessment shows compliance at one point in time, not ongoing safety, and a substantial modification triggers a new one. Internal control depends on the provider's own rigor, and certificates from bodies that are not notified carry no legal weight.

Under Article 43 of the EU AI Act, providers of high-risk AI systems use either internal control (Annex VI) or a notified body assessment of the quality management system and technical documentation (Annex VII). Most Annex III systems use internal control; biometric systems need a notified body when harmonised standards or common specifications are not fully applied. The process ends with an EU declaration of conformity and CE marking. ISO/IEC 42006 covers bodies certifying AI management systems, a separate activity.