Annex VI Internal Controls
under the EU AI Act

Annex VI of the EU AI Act sets out the "internal control" procedure - a self-assessment route that allows providers of most high-risk AI systems to demonstrate conformity without mandatory third-party (notified body) involvement. It is the conformity assessment pathway required for Annex III points 2 to 8, and one of two routes for Annex III point 1 where harmonised standards or common specifications are applied in full. This article articulates when and how the Annex VI internal controls route applies, its detailed requirements, practical application, advantages and limitations, edge cases, and the interplay with EN 18286:2026 once cited.

Regulatory Foundation: When Annex VI Internal Controls Applies

Article 43 and Annex VI set the route by category:

• Annex III points 2 to 8 (critical infrastructure, education, employment, essential services, law enforcement, migration, justice and democratic processes): Article 43(2) requires the internal control procedure in Annex VI. That procedure does not provide for a notified body.
• Annex III point 1 (biometrics): if the provider has applied harmonised standards or common specifications in full, the provider chooses Annex VI or the Annex VII notified-body route. If those standards or specifications are not applied in full, Annex VII is required.
• Annex I Section A (AI that is, or is a safety component of, a product under listed Union harmonisation legislation): the provider follows the sectoral conformity assessment. Annex VI is not that route. Notified-body involvement follows the sectoral law.

A provider of an Annex III points 2 to 8 system cannot opt into Annex VII under Article 43. A commercial third-party review is not the Annex VII procedure. The Commission may, by delegated act, require notified-body assessment for particular points 2 to 8 uses; that act has not been adopted.

Requirements of the Annex VI Internal Controls Procedure

Annex VI requires the provider to perform a complete internal conformity assessment before placing the high-risk AI system on the market or putting it into service. The core obligations include:

1. Quality Management System (QMS) Compliance: Demonstrate that a QMS meeting Article 17 (including the 13 elements) is established, implemented, documented, and maintained.
2. Technical Documentation: Prepare and maintain comprehensive technical documentation per Annex IV, covering system description, development process, risk management details, data governance, validation results, robustness measures, and post-market monitoring plan.
3. Internal Verification: Verify through internal review that the system complies with all essential requirements (Chapter III, Section 2) and that the QMS ensures ongoing conformity.
4. EU Declaration of Conformity: Draw up and sign a formal declaration attesting full compliance, including unique identifier, standards applied (or justification for non-application), and responsible person details.
5. CE Marking & Registration: Affix the CE mark and register the system in the EU database before deployment.
6. Ongoing Obligations: Maintain documentation for 10 years (Article 18), operate post-market monitoring (Article 72), and report serious incidents (Article 73).

EN 18286:2026 was published on 22 July 2026. It is not yet cited in the Official Journal. Until that citation, alignment with it does not confer presumption of conformity under Article 40. Once the reference is cited, full alignment grants presumption of conformity for the QMS element within the limits of the standard's scope, which reduces the evidential burden during internal verification and later market surveillance.

Practical Application: How Providers Execute Annex VI Internal Controls

The internal controls route places full responsibility on the provider but offers flexibility and cost/time savings when executed well:

• Documentation & Evidence: Maintain a single, traceable compliance file (often digital) linking quality policy, risk assessments, validation records and the post-market plan.
• Internal Review Process: Conduct structured internal audits/checklists covering all essential requirements; involve cross-functional team (engineering, quality, legal, risk).

Examples:

• An employment screening AI (Annex III point 4) uses Annex VI: builds a QMS aligned with EN 18286:2026, prepares an Annex IV technical file showing bias mitigation and validation, performs internal verification, issues the declaration, and registers. Article 43(2) does not provide for notified-body involvement.
• A critical-infrastructure predictive maintenance AI (point 2) follows the same route: Annex VI is the required procedure.

Advantage: Faster to market, lower cost (€10k-€50k vs. €50k-€200k+ for notified-body), full control over timing. Limitation: Higher burden of proof during market surveillance - authorities can challenge any element at any time.

Edge Cases and Nuances When Annex VI Applies (or Does Not)

Applies:

• Annex III points 2 to 8: Annex VI is required.
• Annex III point 1, where harmonised standards or common specifications are applied in full and the provider chooses internal control.
• Systems where the provider already has a mature QMS (e.g., ISO 9001 certified) and can map it to Article 17 requirements. The mapping does not change the route.

Does Not Apply:

• Annex III point 1 where harmonised standards or common specifications are not applied in full - Annex VII is required.
• Safety components of, or products that are, Annex I Section A products (medical devices, machinery and the other listed laws) - the sectoral conformity assessment applies, and notified-body involvement follows that law.

Edge case: Continuously learning systems using Annex VI must document robust change-control and post-market monitoring procedures internally; authorities will scrutinise these heavily due to the dynamic risk profile. A substantial modification triggers a fresh conformity assessment under Article 43.

Integration, Strategic Implications, and Link to EN 18286:2026

Annex VI integrates with EN 18286:2026. The standard is published. It is not yet a cited harmonised standard. Until the Official Journal citation, it is the published European text for the Article 17 QMS, not a presumption. Once cited, alignment provides presumption of conformity for the QMS element within the standard's scope, making internal verification more defensible. Providers should map existing processes to EN 18286:2026, conduct gap analyses, and prepare internal audit trails that would stand a market-surveillance request - even on the self-assessment route.

Strategic implications: Annex VI is the required route for eligible Annex III points 2 to 8 systems. It can reduce time and cost compared with a notified-body assessment, but it requires internal governance and documentation discipline. Missteps can lead to post-market enforcement. Best practice: document the classification and the Article 43 route, implement a risk-based internal audit programme, use EN 18286:2026 as the QMS reference, and maintain a living compliance file ready for an authority request.

In summary, Annex VI internal controls is the self-assessment route required for high-risk AI systems in Annex III points 2 to 8. It demands internal verification of the QMS and the essential requirements, can be faster and less costly than notified-body assessment, and will benefit from presumption of conformity for the QMS element only once EN 18286:2026 is cited in the Official Journal.

Content based on the EU AI Act (Regulation (EU) 2024/1689), as amended by Regulation (EU) 2026/1744, Articles 17 and 43, Annexes VI and VII, and EN 18286:2026 (published 22 July 2026; not yet cited in the Official Journal, so no presumption of conformity yet). Annex III high-risk obligations apply from 2 December 2027. Annex I high-risk obligations apply from 2 August 2028.