AI Act, Article 43 (conformity assessment procedures)

Article 16, point (f), obliges the provider of a high-risk AI system to ensure that it undergoes the relevant conformity assessment procedure referred to in Article 43, prior to its being placed on the market or put into service. A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.

For high-risk AI systems listed in point 1 of Annex III, where the provider has applied the harmonised standards referred to in Article 40, or, where applicable, the common specifications referred to in Article 41, in demonstrating compliance with the Section 2 requirements, the provider must opt for either the internal control procedure of Annex VI or the assessment of the quality management system and of the technical documentation with the involvement of a notified body under Annex VII.

The provider must follow the Annex VII procedure where harmonised standards do not exist and common specifications are not available, where the provider has not applied, or has applied only part of, the harmonised standard, where it has not applied existing common specifications, or, as to the restricted part, where a harmonised standard has been published with a restriction.

For the Annex VII procedure the provider may choose any of the notified bodies, but where the high-risk AI system is intended to be put into service by law enforcement, immigration or asylum authorities or by Union institutions, bodies, offices or agencies, the market surveillance authority referred to in Article 74(8) or (9), as applicable, acts as a notified body.

For high-risk AI systems referred to in points 2 to 8 of Annex III, providers must follow the conformity assessment procedure based on internal control referred to in Annex VI, which does not provide for the involvement of a notified body.

Regulation (EU) 2026/1744 replaced Article 43(3), so that for high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I the provider of the system follows the relevant conformity assessment procedure as required in accordance with that legislation, and the Section 2 requirements apply to those systems and are part of that assessment.

Where a high-risk AI system is both covered by the Union harmonisation legislation listed in Section A of Annex I and within one of the categories listed in Annex III, the provider follows the conformity assessment procedure required pursuant to that Section A legislation.

A high-risk AI system that has already been subject to a conformity assessment procedure must undergo a new one in the event of a substantial modification, regardless of whether the modified system is intended to be further distributed or continues to be used by the current deployer.

For a system that continues to learn after being placed on the market or put into service, changes pre-determined by the provider at the moment of the initial conformity assessment and set out in the technical documentation referred to in point 2(f) of Annex IV do not constitute a substantial modification.

Under Annex VI the provider verifies that the established quality management system complies with the requirements of Article 17, examines the information in the technical documentation to assess the system's compliance with the Chapter III, Section 2 requirements, and verifies that the design and development process and the post-market monitoring referred to in Article 72 are consistent with the technical documentation.

Annex VII provides for the approved quality management system to be examined and to be subject to surveillance, and for the technical documentation of the AI system to be examined. Under Annex VII, point 5.3, the notified body carries out periodic audits to make sure that the provider maintains and applies the quality management system and provides the provider with an audit report.

For the assessment the provider must allow the notified body to access the premises where the design, development and testing of the AI systems take place and share with it all necessary information. The provider must inform the notified body that issued the Union technical documentation assessment certificate of its intention to introduce a change to the AI system that could affect compliance with the requirements or its intended purpose, or if it otherwise becomes aware of such a change.

Article 113 gives application dates of their own to Chapters I and II, Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, Article 78 and Article 6(1), and none to Chapter III Section 5, in which Article 43 sits.

The Digital Omnibus on AI (Regulation (EU) 2026/1744) wrote into Article 113 that Chapter III, Sections 1, 2 and 3, which hold the Article 6 classification rules and the Article 16 provider obligations, apply from 2 December 2027 to a system classified as high-risk under Article 6(2) and Annex III and from 2 August 2028 to one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

Recital 39 of Regulation (EU) 2026/1744 says that any significant change to the design of that AI system after the date specified in Article 111(2) should trigger the obligation of the provider to fully comply with all relevant provisions of the Regulation applicable to high-risk AI systems, including the conformity assessment requirements.