Glossary term
AI Act Conformity Assessment
Also: AI Act Art. 43, EU AI Act Konformitätsbewertung
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 August 2026.
The AI Act distinguishes two conformity assessment routes: internal control (Annex VI) for most Annex III applications and assessment by a notified body (Annex VII) only for biometric identification systems and Annex I products. Self-assessment is therefore the rule, not the exception.
Substantive requirements (Art. 8-15, Annex IV): risk management system, data governance, technical documentation, logging, transparency and information for deployers, human oversight, accuracy/robustness/cybersecurity, quality management system. Output: CE marking, EU declaration of conformity, registration in the EU database (Art. 71).
Practice 2026: providers must complete conformity assessment before 2 August 2026 or remove the system from the EU market from that date. Existing systems with substantial modifications require renewed assessment. Notified bodies are still being set up; capacity bottlenecks are foreseeable.
Related terms
EU AI Act
World's first comprehensive AI law. Four risk classes: prohibited, high-risk, limited (transparency)…
FRIA
Mandatory assessment under EU AI Act Art. 27 for deployment of specific high-risk AI systems. Requir…
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited …
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a thir…
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for…
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI…
BSI C5
Cloud audit catalogue of the German BSI that defines minimum security baseline and transparency duti…
CASB
Security layer between users and SaaS providing visibility (shadow IT discovery), data protection (D…