Conformity assessment

Conformity assessment is a mandatory procedure under the EU AI Act that providers of high-risk AI systems must complete before placing their system on the EU market or putting it into service. The purpose is to verify that the AI system complies with all requirements laid out in Chapter III, Section 2 of the Regulation, covering risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, and cybersecurity.

The AI Act provides for two main conformity assessment procedures. The first is an internal control procedure (based on Annex VI), where the provider conducts the assessment themselves following a prescribed methodology. The second involves a third-party assessment by a notified body (based on Annex VII), required for certain high-risk AI systems, notably those used for biometric identification and categorisation of natural persons.

Upon successful completion of the conformity assessment, the provider draws up an EU declaration of conformity, affixes the CE marking to the AI system, and registers the system in the EU database. The declaration of conformity must be kept up to date and made available to national competent authorities upon request for a period of 10 years after the AI system is placed on the market.

It is important to note that conformity assessment is not a one-time event. If a high-risk AI system undergoes substantial modification, a new conformity assessment must be performed. This reflects the dynamic nature of AI systems that may evolve through updates and retraining.

• EU AI Act