conformity assessment
In plain wordsThe check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used.
Under the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., the procedure that establishes, before a high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks. is placed on the market or put into service, whether it satisfies the Act's requirements for such systems: risk management, data governance, technical documentation, record-keeping (logging), transparency, human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked., and accuracy, robustness and cybersecurity. For most Annex III uses the provider assesses itself through internal control (Annex VI). For biometric systems, assessment of the quality management system and technical documentation by a notified bodynotified body, n.: An independent testing and certification organization, approved by an EU government, that checks whether certain risky products — including some AI systems — meet the law before they can be sold. (Annex VII) is required unless the provider has fully applied harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch. or common specifications. AI in products covered by Annex I goes through the existing sectoral procedure, such as that for medical devices. A successful assessment is followed by an EU declaration of conformity, CE marking and, for Annex III systems, registration in the EU database; a substantial modificationsubstantial modification, n.: A change to an AI system after release that is big enough, under EU law, to require a fresh check — and that can make whoever made the change legally responsible as its maker. requires a new assessment.
We completed conformity assessment by internal control, so no notified body was involved.
Origin
Borrowed from the EU's New Legislative Framework for product safety (2008), which uses conformity assessment modules and CE marking for goods from toys to machinery; the Commission's April 2021 AI Act proposal applied this product-safety model to AI.
Usage note
Critics point out that self-assessment dominates: outside biometrics and regulated products, no independent body checks Annex III systems before they reach the market. Not to be confused with an AI auditAI audit, n.: An independent check of an AI system, or of the company using it, against agreed standards — for example, testing whether a hiring tool treats women and men fairly. or third-party AI evaluationthird-party AI evaluation, n.: Testing of an AI system by someone other than the company that made it — a government institute, a nonprofit lab or independent researchers — to check what it can do and how risky it is., which have no fixed legal form.
Related
- high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
- notified bodynotified body, n.: An independent testing and certification organization, approved by an EU government, that checks whether certain risky products — including some AI systems — meet the law before they can be sold.
- harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch.
- EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.
- substantial modificationsubstantial modification, n.: A change to an AI system after release that is big enough, under EU law, to require a fresh check — and that can make whoever made the change legally responsible as its maker.
- post-market monitoringpost-market monitoring, n.: The duty of an AI system's maker to keep watching how it performs after release, gathering evidence from real use so that problems are found and fixed.
- AI auditAI audit, n.: An independent check of an AI system, or of the company using it, against agreed standards — for example, testing whether a hiring tool treats women and men fairly.
Defined in law or standards
EU AI Act (Reg. (EU) 2024/1689), Art. 3(20), Art. 43 and Annexes VI–VII; declaration Art. 47; CE marking Art. 48; registration Art. 49
Mentioned in
AI regulationAI regulation, n.: Laws and binding government rules about artificial intelligence: what AI may be used for, what checks its makers must run, and what penalties apply when they break the rules., EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks., AI auditAI audit, n.: An independent check of an AI system, or of the company using it, against agreed standards — for example, testing whether a hiring tool treats women and men fairly., AI regulatory sandboxAI regulatory sandbox, n.: A supervised testing ground where companies can try out new AI with regulators watching and advising, before the product faces the full weight of the rules., harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch., provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes., risk-based approachrisk-based approach, n.: A way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest., intended purposeintended purpose, n.: The use a maker says its AI system is meant for. In EU law, the rules that apply to a system depend largely on this declared purpose., notified bodynotified body, n.: An independent testing and certification organization, approved by an EU government, that checks whether certain risky products — including some AI systems — meet the law before they can be sold., substantial modificationsubstantial modification, n.: A change to an AI system after release that is big enough, under EU law, to require a fresh check — and that can make whoever made the change legally responsible as its maker.