Conformity assessment
Also called AI Act conformity assessment
A conformity assessment is the procedure that shows a product meets EU legal requirements before it is placed on the market or put into service. Under the EU AI Act, providers of high-risk AI systems complete one, by internal control or through a notified body, then sign an EU declaration of conformity and affix the CE marking.
How it works
The provider checks the system against the Act's requirements: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, plus a quality management system. For most Annex III uses, including creditworthiness assessment and life and health insurance pricing, this is an internal control under Annex VI. Some biometric systems need a notified body. A substantial modification triggers a new assessment.
Banks and insurers that build their own credit scoring or pricing models count as providers and carry the full assessment. Firms that buy such systems are deployers, with separate duties. After the 2026 omnibus amendment, obligations for Annex III high-risk systems apply from 2 December 2027 and for Annex I product systems from 2 August 2028. Supervisors can request the documentation.
The rules
Sets the conformity assessment procedures for high-risk AI systems, by internal control under Annex VI or with a notified body under Annex VII.
Providers of high-risk AI systemsMoves high-risk duties for Annex III systems to 2 December 2027 and for Annex I product systems to 2 August 2028.
Providers and deployers of high-risk AI systemsSets the standard conformity assessment modules and CE marking principles that EU product laws, including the AI Act, build on.
EU product legislation and notified bodiesCommon questions
Who carries out a conformity assessment under the AI Act?
The provider, meaning the organisation that develops the high-risk AI system or has it developed and places it on the market under its own name. For most financial services uses it is an internal assessment. Certain biometric systems need a notified body.
Does a bank's credit scoring model need a conformity assessment?
AI systems used to evaluate the creditworthiness of individuals are high-risk under Annex III, except those used to detect financial fraud. A bank that develops such a system is a provider and must complete the assessment before use.
When do AI Act conformity assessment duties apply?
Under the omnibus amendment Regulation (EU) 2026/1744, duties for Annex III high-risk systems apply from 2 December 2027. Duties for high-risk systems covered by Annex I product legislation apply from 2 August 2028.
What happens after a conformity assessment?
The provider draws up an EU declaration of conformity, affixes the CE marking, registers Annex III systems in the EU database and runs post-market monitoring. A substantial change to the system requires a new assessment.
