Conformity assessment under Article 43: Annex VI or Annex VII
Providers of high-risk AI systems follow Annex VI or Annex VII (notified body). Article 43 decides which.
Providers of high-risk AI systems must complete a conformity assessment (Article 43). They do so before placing the system on the market or putting it into service (Article 16(f)). Annex III points 2 to 8 follow Annex VI, an internal control. Biometric systems (point 1) must follow Annex VII unless the provider applied harmonised standards or common specifications.
The duty applies from 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I products). Provider fines reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: find your Annex III point, then follow the matching route.
Annex VI is an internal check; Annex VII adds a notified body
A notified body is a conformity assessment body notified under the Act and other relevant Union harmonisation legislation (Article 3(22)).
Annex VI: internal control
The provider verifies that its quality management system meets Article 17. It examines the technical documentation against the requirements of Chapter III, Section 2. It also verifies that design, development and post-market monitoring match that documentation (Annex VI).
Annex VII: notified body assesses quality management system and technical documentation
The notified body assesses both. It may ask for further evidence or tests. If the system conforms, it issues a Union technical documentation assessment certificate and later audits the quality management system (Annex VII).
The route depends on the system
Annex III points 2 to 8
The provider follows Annex VI, with no notified body (Article 43(2)).
Annex III point 1 (biometrics)
If the provider applied harmonised standards (Article 40) or, where applicable, common specifications (Article 41), it chooses Annex VI or Annex VII. Annex VII is mandatory where no such standards or specifications exist, where the provider applied them only in part or not at all, or where a standard was published with a restriction (for the restricted part) (Article 43(1)).
Law enforcement, immigration and asylum
For a system that law enforcement, immigration or asylum authorities or Union institutions are to put into service, the market surveillance authority referred to in Article 74(8) or (9) acts as the notified body (Article 43(1)).
Products under Annex I Section A laws
The provider follows the conformity procedure of that product law. The Section 2 requirements become part of it, the Article 17 quality management system is also assessed, and parts of Annex VII apply (Article 43(3)). Medical devices are an example (Annex I, Section A).
After a substantial modification
A system that was already assessed needs a new conformity assessment. For systems that continue to learn after release, changes that the provider pre-determined at the initial assessment and recorded in the technical documentation (Annex IV, point 2(f)) are not a substantial modification (Article 43(4)).
After the assessment: declaration, CE marking and registration
EU declaration of conformity
The provider draws up a written declaration for each system and keeps it at the disposal of the national competent authorities for 10 years after the system was placed on the market or put into service. By drawing it up, the provider assumes responsibility for meeting the Section 2 requirements (Article 47).
CE marking
The provider affixes the CE marking visibly, legibly and indelibly. For systems provided digitally, a digital CE marking is used if it is easily accessible from the interface (Article 48).
Registration
Before placing an Annex III system on the market, the provider registers itself and the system in the EU database. Systems under Annex III point 2 are registered at national level (Article 49(1) and (5)).
What Scanara’s conformity readiness assessment does
Scanara does not perform a conformity assessment and is not a notified body. It prepares the evidence; you choose and run the route.
Guided preparation
A guided assessment collects your readiness answers. Other Scanara assessments, such as AIRA, feed evidence into it.
Draft declaration and documentation
Scanara drafts the Annex V declaration of conformity and the Annex IV technical documentation from your inputs. You complete, check and sign them.
Structured registration data
Scanara structures the registration data for the EU database (Article 49, Annex VIII). You file the registration yourself.
Read the detail behind each step
Article 16: Provider Obligations for High-Risk AI
Lists the 12 duties of providers, conformity assessment included.
Article 11: Technical Documentation and Annex IV
Covers the technical documentation that the assessment examines (Annex IV).
AI risk assessment (AIRA): the Article 9 risk management system
Covers the risk management system that the conformity assessment checks.
Common questions about conformity assessment
Is Scanara’s conformity readiness assessment the same as a conformity assessment?
No. The conformity assessment is the procedure of Article 43, run by the provider (Annex VI) or with a notified body (Annex VII). Scanara’s assessment prepares the evidence for it.
When is a notified body needed?
Under Annex VII, which is mandatory for Annex III point 1 systems in the cases described above and optional there where standards or common specifications were applied. For products under Annex I Section A laws, that product law decides whether a third-party assessment is needed (Article 43(3)).
What must the EU declaration of conformity contain?
It states that the system meets the requirements of Section 2 and contains the information set out in Annex V. It is translated into a language that the national competent authorities of the Member States concerned can easily understand (Article 47(2)). Where other Union product laws also require a declaration, one single declaration covers all applicable Union law (Article 47(3)).
Does every AI system need a conformity assessment?
No. It applies to high-risk AI systems. For high-risk systems related to products under Annex I Section B laws, only Article 6(1), Article 60a and Articles 102 to 112 apply (Article 2(2)), so Article 43 does not apply to them.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.