! High compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
Which assessment procedure applies to your high-risk AI system
Article 43 establishes the conformity assessment framework for high-risk AI systems — the process by which providers formally demonstrate that their system meets all the requirements of Section 2. It creates a tiered system: most Annex III systems can use self-assessment, while biometric identification systems and certain others require third-party assessment by a notified body.
WHAT IT SAYS
Two routes — self-assessment or notified body, depending on system type
- For high-risk AI systems listed in point 1 of Annex III (biometric systems) where the provider has applied harmonised standards or common specifications: the provider may choose either internal control (Annex VI) or notified body assessment (Annex VII)
- For all other Annex III high-risk AI systems (points 2 through 8): providers must use internal control (Annex VI) — self-assessment — which does not require a notified body
- For AI systems that are safety components of products regulated under Annex I legislation (medical devices, machinery, etc.): the conformity assessment procedure required by that sectoral legislation applies, and the AI requirements are assessed as part of that procedure
- A new conformity assessment is required whenever a substantial modification is made to a high-risk AI system after it has been placed on the market
- For systems intended for law enforcement or immigration authorities: the market surveillance authority acts as the notified body for conformity assessment purposes
- Where a provider has not applied harmonised standards or common specifications, a notified body assessment is required regardless of the Annex III category
WHO IS AFFECTED
All providers of high-risk AI systems before market placement
- Providers of biometric AI systems — face a choice between self-assessment and notified body assessment
- Providers of all other Annex III high-risk AI systems — must use self-assessment (Annex VI procedure)
- Providers of AI systems embedded in regulated products — must follow the sectoral assessment procedure
- Providers who substantially modify their systems post-market — must reassess regardless of original procedure used
WHAT IT MEANS FOR SMES
Most SMEs can self-assess — but must do it properly
- The most important practical insight from this article: if your high-risk AI system is listed in Annex III points 2 through 8 — covering employment, education, essential services, law enforcement, migration, justice and critical infrastructure — you do not need a notified body. You can self-assess.
- Self-assessment under Annex VI is not a rubber stamp — it requires documented evaluation of all Section 2 requirements, maintained in your technical documentation
- Only biometric AI systems in point 1 of Annex III potentially require notified body involvement — and even then, only if you have not applied harmonised standards
- The substantial modification trigger is critical: if you update your AI system in a way that changes its performance, purpose, or risk profile after market placement, you must repeat the conformity assessment — build this into your product update procedures
- Apply harmonised standards or common specifications wherever possible — doing so gives you both the presumption of conformity and, for biometric systems, the option to self-assess
Related Articles
- Article 6 — High-risk classification (determines whether Article 43 applies)
- Article 40 — Harmonised standards (applying these determines which procedure is available)
- Article 16 — Provider obligations (conformity assessment is one of the twelve mandatory obligations)
- Article 47 — EU declaration of conformity (the document issued after successful assessment)
- Annex VI — Internal control procedure (the self-assessment methodology)
