high risk ai system classification rules
The conformity assessment procedure under the EU AI Act establishes a rigorous framework for ensuring high-risk artificial intelligence systems meet strict fundamental rights standards before market entry. Generally, providers must conduct an internal conformity assessment, documenting technical design, development processes, and quality management systems. This self-declared process requires comprehensive technical documentation and a detailed record of the system’s lifecycle to demonstrate compliance with essential requirements. However, certain high-risk applications, particularly those involving medical devices or aviation safety, may necessitate involvement from a notified body. These independent third-party organizations conduct thorough audits to verify that the AI system adheres to all regulatory mandates, ensuring robust safety and reliability standards are consistently maintained throughout the product’s operational lifespan.
Also worth reading: Which Enterprise AI Risk Assessment Tools Ensure Compliance and Security? · How can enterprises effectively conduct an agentic AI risk assessment to mitigate emerging threats? · How Can an AI Readiness Assessment Framework Shape Technical White Papers?
Recent amendments via the Digital Omnibus have clarified procedural nuances, particularly regarding continuously learning AI models and specific sectoral overlaps. Providers must now integrate updated risk management frameworks that dynamically adapt to new data inputs while maintaining strict accountability measures. The revised guidelines emphasize traceability and transparency, requiring detailed logs of data governance and algorithmic decision-making processes. Furthermore, post-market monitoring obligations have been strengthened, mandating continuous evaluation of system performance in real-world environments. This adaptive approach ensures that compliance is not merely a one-time certification but an ongoing commitment to ethical AI deployment, balancing innovation with the protection of user safety and democratic values across all member states.
technical documentation and record keeping
One unresolved question is what happens to conformity when a high-risk system keeps learning after reaching the market. Most models are assessed once, against a frozen version, through internal control plus technical documentation. Yet a device whose weights update continuously may drift from the artefact that passed review. The emerging answer treats drift as a post-market monitoring duty rather than a trigger for repeat assessment, provided the manufacturer predefines change boundaries in the technical file. The first harmonised standard grants presumption of conformity, and the Digital Omnibus shifted deadlines.
In practice, manufacturers classify the system, compile documentation covering risk management, data governance, logging and instructions, apply internal control or involve a notified body where required, issue the EU declaration of conformity, and register in the EU database before market placement. Records then persist for ten years, with performance events logged and incidents feeding post-market monitoring. Because edge cases are settled through guidance and standards rather than statute, disciplined documentation is the cheapest insurance a vendor can buy.
third party conformity assessment requirements
For high-risk AI systems listed in Annex III, providers must involve a notified body when their system is placed on the market, unless an exemption applies. The notified body reviews the technical documentation, quality management system, and evidence that the system meets the essential requirements, then issues an EU technical certificate. The unresolved question for many providers has been which systems actually qualify for this third-party route, since Article 43 allows providers of certain Annex III systems to follow the internal control procedure instead, provided their quality management systems are certified under recognised standards such as ISO 9001 and ISO/IEC 42001.
The Digital Omnibus amendments, now in force, clarify this boundary by deferring the application dates for Annex III obligations and confirming that the internal control route remains available where those harmonised certifications are in place. Providers should therefore decide early whether to pursue notified body engagement or build the certified management infrastructure that keeps conformity assessment in-house.
continuous monitoring and post market
The procedure begins with classification: only high-risk systems require a conformity assessment. The provider then applies harmonised standards, operates a quality management system, and compiles risk management, data governance, technical documentation, testing, human-oversight, accuracy, robustness and cybersecurity evidence. Most Annex III high-risk systems use internal control under Annex VI; biometric and certain product-safety cases need a notified body under Annex VII, ending with an EU declaration and CE marking.
For continuously learning systems, the unresolved link is post-market change control. A one-off certificate cannot cover every model update. The workable settlement is to treat the approved QMS as the anchor: post-market monitoring detects drift and incidents, predefined change-control criteria decide whether an update is significant, and significant changes reopen the assessment before deployment while minor updates remain within the approved monitoring plan. That keeps the procedure risk-based rather than turning every learning cycle into a new certification.
harmonised standards implementation timeline
The first harmonised technical standard under the EU AI Act has been published, but Official Journal citation and the full package remain staged, so providers should plan conformity assessment on a rolling basis rather than waiting. For high-risk systems, the procedure starts with the provider’s quality management system, risk management file, data governance, testing, logging and human-oversight evidence. Annex III systems generally use internal control; Annex I products may need notified-body assessment under Annex VII unless full harmonised standards or common specifications are applied. Where standards are unavailable or uncited, providers must document alternative technical specifications and explain residual gaps.
The unresolved point is the fallback evidence when standards lag. The practical answer is that conformity assessment remains evidence-led: a provider can rely on harmonised standards only once cited, and otherwise must build a traceable gap analysis against the Act’s essential requirements, use common specifications where available, and obtain notified-body assessment where the product route requires it. That makes the timeline a compliance planning input, not a precondition for starting assessment.
conformity assessment method comparison
| AI System Risk Category | Assessment Method | Key Compliance Step | Responsible Entity |
|---|---|---|---|
| High-Risk AI Systems | Internal Conformity Assessment | Technical documentation review | Notified Body (if required) |
| General-Purpose AI | Risk Management | Fundamental rights impact | Provider |
| Prohibited AI | Prohibition Check | Immediate removal | Provider |
| Limited-Risk AI | Transparency | Information disclosure | Provider |