Conformity assessment

Before selling or putting a high-risk system into service, the provider must complete a conformity assessment (Article 43): checking and documenting that it meets every requirement (risk management, data, documentation, logs, transparency, human oversight, accuracy and cybersecurity).

For most Annex III systems an internal control (Annex VI) is enough: the provider itself verifies its quality system and technical documentation. Biometric systems may need an external notified body (Annex VII) if harmonised standards have not been applied. Annex I products follow the procedure in their own sector legislation.

If the system undergoes a substantial modification, the assessment must be repeated. Once passed, the provider signs the EU declaration of conformity and affixes the CE marking.