Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).

The AI Act distinguishes two conformity assessment routes: internal control (Annex VI) for most Annex III applications and assessment by a notified body (Annex VII) only for biometric identification systems and Annex I products. Self-assessment is therefore the rule, not the exception.

Substantive requirements (Art. 8-15, Annex IV): risk management system, data governance, technical documentation, logging, transparency and information for deployers, human oversight, accuracy/robustness/cybersecurity, quality management system. Output: CE marking, EU declaration of conformity, registration in the EU database (Art. 71).

Practice 2026: since the Digital Omnibus the cut-off is 2 December 2027, no longer 2 August 2026. Providers must complete the conformity assessment by then or remove the system from the EU market. Existing systems with substantial modifications require renewed assessment. The extra time was granted precisely because harmonised standards are missing and notified bodies are still being set up; the capacity bottleneck remains foreseeable.

AI Act Conformity Assessment

Related terms