Three routes, and only one of them is a choice
Article 43 of Regulation (EU) 2024/1689 sets three conformity assessment routes, and only one ever offers a choice. Annex III points 2 to 8 take internal control under Annex VI, with no notified body. Annex III point 1 biometrics takes Annex VI or Annex VII, but only where harmonised standards or common specifications were applied. Annex I Section A products ride their own sectoral assessment.
None of it binds today. Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, applies Chapter III Sections 1, 2 and 3 from 2 December 2027 to Annex III systems and from 2 August 2028 to Annex I systems. Article 16(f) binds the provider, not the deployer, importer or distributor. See the rest of the timeline.
| System | Route | Notified body |
|---|---|---|
| Annex III point 1, standards applied | Annex VI or VII, Art 43(1) subpara 1 | Provider's choice |
| Annex III point 1, standards absent or partial | Annex VII, Art 43(1) subpara 2 | Compulsory |
| Annex III point 1, put into service by law enforcement, immigration or asylum authorities or Union institutions | Annex VI or VII on the subpara 1 and 2 tests | Where Annex VII applies, the Art 74(8) or 74(9) authority acts as notified body, Art 43(1) subpara 3 |
| Annex III points 2 to 8 | Annex VI internal control, Art 43(2) | Unavailable in law |
| Annex I Section A products | Sectoral procedure plus Art 17 QMS assessment, Art 43(3) | As the sectoral act requires |
| Annex I Section B, incl. machinery | None, Art 2(2) | None |
Article 43 is already in application, the duty to use it is not. Article 113 defers only Chapter III Sections 1, 2 and 3. Article 43 sits in Section 5, left at 2 August 2026, and nothing explains how it runs before Article 6 and Article 16(f) apply. The defensible reading: available, but not yet owed. A provider may complete it now, and cannot be penalised until 2 December 2027 for a standalone Annex III system, or 2 August 2028 for an Annex I Section A embedded product.
Annex III points 2 to 8: internal control, no certificate
The most common misreading is that high-risk means a notified body. For seven of the eight Annex III categories it is the opposite. Article 43(2): providers of systems in points 2 to 8 "shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body". Those seven are critical infrastructure, education, employment, essential services, policing, migration and justice.
Annex VI is four points and entirely self-performed. The provider verifies its Article 17 quality management system, examines the technical documentation against the Section 2 requirements, and checks that the design process and Article 72 post-market monitoring are consistent with it. No external body, no audit, no certificate, so such a system is never "certified", and the file examined is the Annex IV technical documentation.
Recital 125 gives the intent: third-party assessment is limited in an initial phase "with the only exception of AI systems intended to be used for biometrics". Annex XIV, added by Regulation (EU) 2026/1744, confirms it structurally, because the only codes it lists for Annex III systems are exactly three, AIB 0201 for remote biometric identification, AIB 0202 for biometric categorisation and AIB 0203 for emotion recognition. Article 43(6) lets the Commission move points 2 to 8 onto Annex VII by delegated act, weighing notified body capacity. No such act has been adopted.
Annex III point 1: where a notified body becomes unavoidable
Biometrics is the exception, and its choice is conditional. The first subparagraph of Article 43(1) offers an Annex III point 1 provider either Annex VI or Annex VII, but only where "the provider has applied harmonised standards referred to in Article 40, or, where applicable, common specifications referred to in Article 41". The second subparagraph makes Annex VII compulsory in four cases: no standard and no common specification exists, the standard was not applied or only partly applied, common specifications were not applied, or a standard was restricted, where Annex VII covers only that part.
Article 40(1) is why that matters now: the presumption attaches only to standards "the references of which have been published in the Official Journal of the European Union". The Commission's standardisation page, updated 3 August 2026, records that none has been cited, and that the first candidate, prEN 18286 on quality management systems, went to public enquiry on 30 October 2025. No Article 41 common specifications exist. Point (a) is therefore satisfied today, making Annex VII the default rather than an option, though that can change before 2 December 2027.
There is free choice of body, except where the system is intended to be put into service by law enforcement, immigration or asylum authorities or by Union institutions: the third subparagraph then makes the Article 74(8) or 74(9) market surveillance authority the notified body. Annex VII also reaches past a document review, to the training, validation and testing data sets under point 4.3, including by API, the body's own tests under 4.4, and the trained models and their parameters as a last resort under 4.5.
Annex I embedded products keep their existing route
Regulation (EU) 2026/1744 replaced Article 43(3) in full on 27 July 2026, so earlier summaries quote superseded wording. The current text keeps the recital 124 principle, that AI Act compliance is assessed inside the assessment the product already undergoes, and widens it: an Article 17 quality management system assessment is added, and Annex VII points 3, 4.3 to 4.5, the fifth paragraph of 4.6 and point 5 apply. Neither point 3 nor point 5 was in the 2024 version. Machinery has also left Section A for Section B point 21, which Article 2(2) leaves outside Article 43 entirely.
The party bound is normally the product manufacturer rather than the AI supplier: under Article 25(3) the manufacturer is treated as the provider of a high-risk AI system that is a safety component of a Section A product where the system is placed on the market together with the product under the manufacturer's name or trade mark, or is put into service under that name or trade mark after the product has been placed on the market. Whether a third party is involved is the sectoral act's call. The third subparagraph is explicit that manufacturers "are not required to choose a conformity assessment procedure involving third-party conformity assessment only because the product includes a high-risk AI system as a safety component". Self-assessment survives, but only where the manufacturer has also applied harmonised standards or, where applicable, Article 41 common specifications covering all the Section 2 requirements.
The fourth subparagraph sends Annex III overlaps down the sectoral route. Bodies already notified under a Section A act may assess Section 2 conformity on that notification, but only where their compliance with Article 31(4), (5), (10) and (11) was assessed in the sectoral notification procedure and is evidenced through that existing notification, and they must apply for designation under Chapter III Section 4 by 28 January 2028. The enacting text does not spell out the consequence of missing that deadline, but recital 18 of Regulation (EU) 2026/1744 frames the power as running "for 18 months from 27 July 2026", so it lapses on 27 January 2028.
Substantial modification and the second assessment
Article 43(4) requires a system already assessed to undergo a new conformity assessment on a substantial modification, "regardless of whether the modified system is intended to be further distributed or continues to be used by the current deployer". Those closing words catch changes that never leave the organisation.
Article 3(23) sets two alternative limbs, both gated by the change not being foreseen in the initial conformity assessment: compliance with the Section 2 requirements is affected, or the intended purpose is modified. Recital 128 gives a change of operating system or architecture. The carve-out for systems that keep learning is cumulative: changes fall outside only where pre-determined at the initial assessment and documented under Annex IV point 2(f).
On the Annex VII route this is not a unilateral call: point 4.7 obliges the provider to notify intended changes, and the body decides between a new assessment and a certificate supplement. Article 43(4) does not say whether the new assessment keeps the original route. The defensible reading is that the Article 43(1) conditions are tested afresh, so a modification taking a biometrics system outside its standard forces Annex VII.
The burden can change hands. Under Article 25(1)(b) and (c) a distributor, importer, deployer or other third party that substantially modifies a high-risk system, or changes an intended purpose so a system becomes high-risk, becomes the provider and owes Article 16 in full, including the fresh assessment. That is what catches a downstream modifier fine-tuning a model, and Article 25(2) obliges the initial provider to cooperate on it.
What comes out, and why capacity has to be booked
The output is the same pair either way. Under Article 47(1) the provider draws up a written machine readable, physical or electronically signed EU declaration of conformity for each system and keeps it at the disposal of the national competent authorities for 10 years after the system is placed on the market or put into service, and under Article 47(2) that declaration must contain the Annex V information. Article 47(4) makes drawing it up the moment the provider assumes responsibility for Section 2 compliance.
Then the CE marking, affixed by the provider under Article 16(h) and Article 48, not by the notified body. Article 48(4) adds the body's identification number only where applicable, so on a standalone Annex III system a bare CE marking is the visible signature of an Annex VI assessment. Annex V point 7 is drafted the same way, leaving an internal control declaration silent about the procedure followed. The defensible reading is that this is deliberate: the Annex VI record belongs in the Article 17 system and the Annex IV file, where an authority can call for it. The rest of the set is on the high-risk systems page, and classification in what high-risk means.
Which leaves scheduling. The designation pipeline has been open since 2 August 2025 under Chapter III Section 4, and designation is scope-bound: Annex XIV point 1 permits a body to assess "only for the activities related to the types of AI systems concerned". What matters is whether a body holds AIB 0201, 0202 or 0203, and those codes only entered the Regulation on 27 July 2026. Recital 2 of Regulation (EU) 2026/1744 records "the delayed establishment of the governance and the conformity assessment frameworks at national level".
Nor is Annex VII one booking. It is a quality management system assessment under point 3, a technical documentation assessment under point 4 and surveillance under point 5, and under Article 44(2) an Annex III certificate lasts four years at most, so one issued in December 2027 needs re-assessment by around December 2031. Article 43 sets no deadline for completing an assessment, and the Article 44(3) appeal addresses decisions, not delay. The live position is the Article 35(2) list.
Getting the route wrong is priced through Article 16, not Article 43. Article 99(4)(a) puts breach of the provider obligations, including 16(f) on the assessment, 16(g) on the declaration and 16(h) on the CE marking, at up to 15,000,000 euro or 3 percent of worldwide annual turnover, whichever is higher. For SMEs, start-ups and small mid-caps the cap is whichever is lower.