Digital Lexicon Hub

The process of demonstrating that a product or system meets legal or standard requirements before it is placed on the market or put into service.

For providers of high-risk AI systems, a completed conformity assessment is a precondition for the EU market, so its timing, evidence and cost affect launch plans, contracts and the liability that deployers will accept.

A provider of an AI tool that ranks job applicants, an Annex III use case, follows internal control: it checks its quality management system and technical documentation against the requirements, signs an EU declaration of conformity, affixes CE marking and registers the system.

Passing an assessment shows compliance at one point in time, not ongoing safety, and a substantial modification triggers a new one. Internal control depends on the provider's own rigor, and certificates from bodies that are not notified carry no legal weight. In October 2026 only quality management had a cited harmonized standard, so most other requirements still need evidence without a presumption of conformity.

Under Article 43 of the EU AI Act, providers of high-risk AI systems use either internal control (Annex VI) or a notified body assessment of the quality management system and technical documentation (Annex VII). Most Annex III systems use internal control; biometric systems need a notified body when harmonized standards or common specifications are not fully applied. Applying a Harmonized Standard simplifies the evidence: since 14 October 2026, providers that follow EN 18286:2026 are presumed to meet the Article 17 quality management requirements it covers. The process ends with an EU declaration of conformity and CE marking. ISO/IEC 42006 covers bodies certifying AI management systems, a separate activity.