EU AI Act Art. 43 — Conformity assessment
Article 43 sets the pre-market exam for high-risk AI. Most Annex III systems self-assess via internal control; biometrics and remote biometric identification need third-party assessment by a notified body — unless fully harmonised standards apply.
At a glance
What this article requires
- Annex III points 2–8 (most high-risk areas): internal control (Annex VI) — the provider self-assesses.
- Annex III point 1 (biometrics, incl. remote biometric identification): third-party assessment under Annex VII, unless the provider fully applies harmonised standards.
- For Annex I products (e.g. medical devices, machinery), the AI Act assessment integrates with the product's existing conformity procedures.
- Substantial modifications trigger a fresh conformity assessment.
Scope
Who this applies to
Providers of high-risk AI. Deployers must verify that a vendor's system carries a completed conformity assessment before procurement.
Obligations
What you must actually do
Pick the right route early
Biometric and remote-biometric-ID systems need a notified body; misrouting wastes months of lead time.
Document the internal control
Even self-assessment requires the full Annex VI evidence: technical documentation, QMS, and a declaration that the system meets the requirements.
Re-assess on substantial change
Change the intended purpose or materially modify the system, and the assessment must be re-run.
Action plan
Practical first steps
- 1
Classify your system (Art. 6) and confirm which route applies before starting development.
- 2
For third-party routes, line up a notified body early — capacity is limited.
- 3
Build the evidence pack in parallel with development so the assessment is a formality, not a rescue.
Penalty exposure
Conformity-assessment failures sit in the general tier: up to €15 million or 3% of global annual turnover.
FAQ
Questions about Art. 43
Can I self-certify my high-risk system?
For most Annex III categories, yes — internal control under Annex VI. For biometrics and remote biometric identification under Annex III point 1, you need third-party assessment unless you fully apply harmonised standards.
What is a notified body and when do I need one?
A notified body is a designated conformity-assessment organisation. You need one for biometrics (Annex III point 1) and for Annex I products where sectoral law requires third-party assessment.
Sources
Citations & further reading
Related
More article explainers
Wondering which articles apply to your AI?
Describe your system in the free Risk Scanner and get a preliminary risk read with the obligations that likely apply — in seconds.
Check my use casePreliminary EU AI Act clarity summary. Not legal advice.