Self-Assessment or Notified Body? Choosing the Right Conformity Pathway

Conformity assessment is the gate. A high-risk AI system cannot be lawfully placed on the EU market until it has been through one, and the first question, often answered too late, is which pathway it takes. Get this right and the rest of the programme has a clear target. Get it wrong and you either over-engineer or, worse, ship a system that has not been properly assessed.

There are two routes. Internal control under Annex VI is the self-assessment pathway, where the provider attests conformity based on its own quality management and technical documentation. Third-party assessment under Annex VII brings in a notified body to examine the system before it goes to market. The Act decides which applies, and for most Annex III categories the route is internal control.

The category matters, so the sensible first step is to work through the Annex III taxonomy and place each system, because the pathway follows from the classification rather than from the provider's preference. The exceptions, where third-party involvement is required, are specific and worth identifying early, because engaging a notified body is not instant.

If a notified body is required, selection and engagement take planning. There is a finite pool, capacity is a real constraint as deadlines approach, and the body needs time and a complete technical file to do its work. Leaving this late is one of the more avoidable ways to miss a deadline.

Whichever route applies, the destination is the same: a declaration of conformity under Article 47, in which the provider takes formal responsibility that the system meets the Act's requirements, and CE marking. The declaration is not a formality, it is a statement an authority can hold you to, so the evidence behind it has to be real.

Conformity assessment is also not the end. Post-market obligations and lifecycle governance continue, and a system that drifts materially from its assessed state may need reassessment. The declaration captures a moment; the obligation is ongoing.

Our whitepaper, Conformity Assessment Pathways, works through the Annex III taxonomy category by category, the internal-control and third-party procedures, how to select and engage a notified body, and the Article 47 declaration, with decision matrices and checklists. The pathway decision shapes the whole programme, so it is worth making early and making well.