Conformity Assessment for High-Risk AI (Article 43 + Annex IV)

What Article 43 actually requires

Article 43 of Regulation (EU) 2024/1689 sets the conformity assessment procedure that providers must complete before placing a high-risk AI system on the market or putting it into service.

The route depends on the system class:

• Annex III §1 biometric identification (real-time RBI and post-RBI in law enforcement): the provider chooses between the Annex VI internal-control procedure (where harmonised standards or common specifications are applied in full) or the Annex VII notified-body assessment (otherwise).
• All other Annex III systems: the Annex VI internal control (self-assessment) procedure.
• Annex I (safety-component / Union harmonisation): the procedure under the relevant sectoral legislation (e.g., MDR notified-body assessment for medical devices).

Annex VI — internal control (self-assessment)

For most Annex III high-risk systems, the provider self-assesses against the Section 2 requirements (Articles 8–15). The provider must:

• Ensure the quality management system under Article 17 is established and maintained.
• Examine the Article 11 / Annex IV technical documentation.
• Ensure the design and development process and the post-market monitoring conform to the technical file.

The self-assessment is documented as part of the QMS, and the Article 47 EU declaration of conformity is then drawn up and signed.

Annex VII — notified-body assessment

For Annex III §1 biometric identification systems where harmonised standards or common specifications are not applied in full, the provider must engage a notified body designated under Article 31 for AI-Act conformity. The notified body assesses the QMS and the technical documentation, and issues an EU technical-documentation assessment certificate valid for up to five years.

Substantial modifications — Article 43(4)

A substantial modification within the meaning of Article 3(23) requires a new conformity assessment under Article 43(4). The §5 lifecycle-changes log is the front-line evidence of what triggers this.

What to do

1. Identify your system class (Annex III §X) and the applicable conformity-assessment route.
2. Build the QMS under Article 17.
3. Complete the Annex IV technical file.
4. Run the self-assessment (Annex VI) or engage a notified body (Annex VII).
5. Sign the Article 47 declaration.
6. Affix the CE marking under Article 48.
7. Register in the EU Database under Article 49.
8. Re-assess on substantial modification under Article 43(4).

Inline crosswalk

• ISO/IEC 42001:2023 Clause 9.2 — Internal audit.
• NIST AI RMF GOVERN 4.1 — Effective challenge for AI deployment is in place.

Common mistakes

• Late conformity assessment. Article 16(f) is before placement on the market.
• Missing CE marking on systems where Article 48 requires it.
• No re-assessment after substantial modification.
• Choosing Annex VI when full harmonised-standard alignment is missing for Annex III §1 systems.

---

Disclaimer. Reference; not legal advice. Verify with counsel. Reg text from Regulation (EU) 2024/1689.