conformity assessment

advancedspreading

The process by which a manufacturer or an independent body certifies that a product – for example, an AI system – complies with legal requirements.

In plain terms

Conformity assessment is similar to a car technical inspection, with two important differences: it takes place before the product enters circulation, and often it is not an independent inspector but the manufacturer itself that performs it. Before a risky product is sold or put into use, someone must check and certify in writing that it complies with the rules.

In the EU, toys, lifts and medical devices have long been brought to market this way. The EU AI Act applies the same logic to high-risk AI systems, such as those that screen job applicants, assess creditworthiness or support medical decisions.

The procedure does not assess whether a system is smart or useful. It examines whether the manufacturer manages risks, whether data and documentation are in order, whether human oversight is ensured, and whether the system is accurate and secure.

For most high-risk AI systems, the manufacturer conducts the assessment itself, with internal controls. In certain cases, involving an independent certification body is mandatory, for example, in some biometric identification systems or in AI embedded in medical devices.

How it works

The provider (developer or manufacturer) first decides whether its system is considered high-risk under the law. If not, this procedure is unnecessary, but if the system operates in one of the sensitive areas listed in the regulation, this decision must be justified in writing.
If so, it builds the mandatory elements: risk management, a quality management system, technical documentation, logging, human oversight, and it tests accuracy and cybersecurity.
Next comes the evaluation itself. This is carried out either by the provider through internal inspection or by a designated independent body (notified body) that reviews the documentation and quality management.
After a successful assessment, the provider issues an EU declaration of conformity, affixes the CE marking, and the system is usually registered in the EU database.
The assessment is not a one-time event: if the system is substantially modified, it must be re-evaluated, and its operation must be monitored after it reaches the market.

An everyday example

You apply for a job, and the company's AI system ranks the resumes. This is a high-risk use case in the EU, so the software developer must conduct a conformity assessment before selling the system to the employer. This obligation is expected to take effect from December 2027 due to the 2026 postponement. The same applies if the screening is performed by a standalone AI agent.

Who is affected

developerIf you are building a high-risk AI system or an agent intended for such purposes, you must align documentation, testing, and logging with the assessment requirements already during the design phase. → Code

entrepreneur, executiveWhen purchasing an AI system, it is advisable to request the declaration of conformity, as using a non-compliant system can bring risk and fines to your company.

patient, doctorUnder medical device rules, AI tools that assist diagnosis can already typically reach clinics only after independent certification. This is one of the safeguards of their reliability. → Health

lawyer, citizenThe documentation and statement produced during the procedure form one of the bases for authorities to hold the manufacturer of AI systems that make decisions about you accountable. → Law

A common misconception

MythThe CE marking means that an authority has tested and approved the AI system.

In realityIn most cases, the manufacturer evaluates its own system and declares compliance on its own responsibility. The authority typically investigates only afterward, during market surveillance inspections.

Limits and risks

Compliance is not a guarantee of flawless operation: the system can still make mistakes or show bias; the assessment only confirms that risks are managed according to rules.
Self-assessment depends on the manufacturer's diligence and honesty, so the effectiveness of actual oversight relies on the capacity of market surveillance authorities.
An assessment captures a specific state, while AI systems are updated and change, so the document can easily become outdated compared with reality.
The procedure is costly and time-consuming, which disproportionately burdens smaller companies.

Similar, but not the same

audit – An audit can be carried out at any time, often as a voluntary review, while conformity assessment is a procedure mandated by law and required as a condition for market entry.
fundamental rights impact assessment – The impact assessment is carried out by some organizations applying the system (for example, public service bodies, credit assessment companies) for their own use, while the conformity assessment is performed by the system provider on the product itself.
certification – Certification is a form of conformity assessment where an independent third party issues a certificate, but assessment can also be done via self-audit.

Related concepts

Broader

AI regulation, EU AI Act, product safety

Narrower

internal audit, bejelentett szervezet, EU declaration of conformity, CE marking

On the edge

high-risk AI system, harmonised standard, risk management, market surveillance, fundamental rights impact assessment

A brief history

Conformity assessment is a long-standing tool in EU product regulation. Its foundations were laid by the 1985 "New Approach," and today's system of procedures builds on the 2008 "New Legislative Framework." This framework governs how risky products reach the market. The 2024 EU AI Act extended these rules to AI systems.

Where things stand

By the end of 2026, the legal framework is in place, but obligations for high-risk systems are not yet applicable. The original August 2026 deadline was postponed by the EU legislator in 2026 (digital omnibus): rules must apply to standalone high-risk systems from December 2, 2027, and to systems embedded in other products (such as medical devices) from August 2, 2028. Harmonized standards are still being prepared, and companies and certification bodies are typically in the preparation phase.

Status: 2026 November

In the news

Appears in 2 Agent Age stories; the curve shows weekly occurrence in the news magazine.

EU AI Act high-risk deadline: medical devices follow the sector-specific conformity routeSep 19, 2026 · Health
Vara receives world-first CE certification for autonomous AI in breast cancer screeningSep 2, 2026 · Health

Also known as

conformity assessment · conformity assessment procedure · conformity assessment · compliance assessment · conformity assessment · conformity assessment procedure · CE certification · third-party conformity assessment

Sources

Conformity assessment – Wikipedia

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.