CE marking, conformity assessment, and the EU declaration of conformity
In short
Three distinct steps sit between a high-risk AI system meeting the Articles 9-15 substantive requirements and lawfully being placed on the EU market: the conformity assessment procedure itself, the written declaration that it was completed, and the physical CE mark that signals this to the market. Each is a separate obligation, and each depends on the one before it.
Conformity assessment, internal or third-party
Article 43 sets out which conformity assessment route applies. Most Annex III high-risk systems use internal control, based on the provider’s own quality management system. A narrower set of systems (biometric identification systems in particular) requires involvement of a notified body, an independent organisation designated to assess conformity. Which route applies depends on the specific Annex III category and, for Annex I product-safety systems, on the sectoral legislation that already governs the underlying product.
The EU declaration of conformity
Article 47 requires a written EU declaration of conformity for each high-risk system, stating that the Chapter III Section 2 requirements have been met. It has to identify the specific system and version it covers (a generic company-wide statement is not sufficient) and must be retained for 10 years after the system is placed on the market. The declaration is a formal legal statement of compliance, not merely a marketing claim, and drawing it up before the underlying conformity assessment is actually complete is itself a breach.
Affixing the CE marking
Once conformity assessment and the declaration are both complete, Article 48 requires the CE marking to be affixed visibly, legibly, and indelibly to the system itself. Where that is not possible (the common case for pure software) it is affixed to the packaging or accompanying documentation instead. Where a notified body was involved in the assessment, its identification number must appear alongside the marking.
The marking has to keep meaning what it says
If a high-risk system is substantially modified in a way that could affect its conformity ( a materially different training approach, a new intended purpose, a significant model update) the conformity assessment, declaration, and marking all need to be re-verified. An unchanged CE marking on a materially changed system misrepresents the system’s actual conformity status.
These three steps are provider obligations, but importers (Article 23) and distributors (Article 24) are independently required to verify the marking, declaration, and technical documentation exist before importing or distributing the system, a missing or implausible CE marking is one of the clearest signals in the supply chain that a system was never properly assessed.
Frequently asked questions
- Does every high-risk AI system need a notified body?
- No. Under Article 43 most Annex III high-risk systems use internal control based on the provider's own quality management system; a narrower set (biometric identification systems in particular) requires a notified body, and Annex I product-safety systems follow their sectoral legislation.
- What is the EU declaration of conformity?
- A written statement under Article 47 that a specific high-risk system and version meets the Chapter III Section 2 requirements. It must identify the exact system, be retained for 10 years after the system is placed on the market, and must not be drawn up before the conformity assessment is actually complete.
- Where does the CE marking go for AI software?
- Article 48 requires the CE marking to be affixed visibly, legibly, and indelibly to the system, or, where that isn't possible (the common case for pure software), to the packaging or accompanying documentation, with a notified body's identification number alongside it where one was involved.
Related guides
Not sure where your company stands?
Our free assessment gives you an indicative result in minutes (free and anonymous) no account needed.
Start the free check