Governome

regulations

Conformity Assessment

The formal process a high-risk AI system goes through to demonstrate it meets the EU AI Act's requirements — internal self-assessment for most Annex III systems, or third-party assessment where a notified body is involved — before the system can be placed on the market or put into service.

Governome Editorial Team2 min readHow we source and review this content.

Conformity assessment is the checkpoint between "we built a high-risk AI system" and "we're legally allowed to place it on the market." It's the process that verifies the system actually satisfies the substantive obligations the Act attaches to high-risk status — risk management, data governance, technical documentation, logging, transparency, and human oversight — before deployment, not an audit that happens after the fact.

Two routes, depending on the system

For most high-risk systems classified under Annex III, the provider carries out the conformity assessment internally, based on internal control — essentially a rigorous, documented self-assessment against the Act's requirements. A smaller set of systems, generally those tied to product-safety legislation already requiring third-party assessment (certain Annex I categories), go through assessment by a notified body — an independent organization authorized to verify conformity, similar to the role notified bodies already play under existing EU product-safety law like the Medical Device Regulation.

What a successful assessment produces

A system that passes conformity assessment gets a declaration of conformity and, where applicable, a CE marking — the same visible signal used across other EU product regulation to indicate a product has been verified against the relevant legal requirements. Conformity assessment isn't a one-time event tied only to first launch, either: a substantial modification to a high-risk system generally triggers a fresh assessment, which is one reason the risk management process required under Article 9 needs to track predetermined changes in advance — an unplanned modification can force an unplanned reassessment. For the full mechanics of both routes, including what triggers notified-body involvement and what a substantial modification actually looks like in practice, see our step-by-step walkthrough of the conformity assessment process.

For the classification step that determines whether a system needs conformity assessment at all, see how Article 6 high-risk classification works.

Suggested next reading

ai governance

AI Governance

The structure of accountability, review, and decision rights a company puts in place to control how it builds, buys, and deploys AI systems.
Governome Editorial Team · 2 min read

regulations

High-Risk AI System

An AI system subject to heightened legal obligations because of what it's used for — not because of the underlying technology — typically because it materially affects access to employment, credit, healthcare, housing, or legal standing.
Governome Editorial Team · 2 min read

regulations eu

The EU AI Act

The EU AI Act classifies AI systems into risk tiers and phases its obligations in on a multi-year schedule. Here's what's actually in force today, what's still phasing in, and how the risk tiers work.
Governome Editorial Team · 4 min read

regulations eu

EU AI Act Article 9: Building a Compliant Risk Management System

Article 9 requires high-risk AI providers to run a continuous risk management process across the system's entire lifecycle, not produce a one-time document. Here's what the process actually has to include, and the gap auditors flag most.
Governome Editorial Team · 7 min read

regulations eu

EU AI Act Conformity Assessment: The Process, Step by Step

Article 43 conformity assessment has two routes: internal control, which covers most high-risk systems and involves no external reviewer at all, and notified-body assessment, reserved for a narrow slice of biometric systems. Here's how each one actually works, what gets produced, and what forces a redo.
Governome Editorial Team · 7 min read

regulations eu

EU AI Act High-Risk Classification: How Article 6 Actually Works

Article 6 of the EU AI Act classifies a system as high-risk through a combination of Annex I product-safety overlap and Annex III use-case categories. Here's how the two-step test actually applies, with the exemption most teams get wrong.
Governome Editorial Team · 3 min read