Conformity assessment is the gate. A high-risk AI system is not placed on the Union market, and is not put into service, until that gate has been passed. EN 18286 is explicit: the system must be in compliance with the applicable regulatory requirements at that moment. Article 43 of the Act is the procedure that stands at the gate. The quality management system has to select that procedure and follow it.
The system therefore has to be prepared, and then presented, for assessment. Preparation is not the assessment. It is the work that makes the file readable when the assessment is run - by the provider under internal control, or with a notified body, or inside a sectoral procedure the product already follows.
EN 18286 sets out how that preparation is done for the essential requirements. There are four approaches. The provider uses one of them, or a combination of them, for each applicable essential requirement. There is no fifth approach in that list.
Who this applies to
If you are established in the Union and you place a high-risk system on the market, or put one into service, you are in scope. That is the usual case for EU companies. The quality system, the technical documentation, the Article 43 procedure and the declaration of conformity sit with you as provider.
The same file is asked for inside the Union even when you are not the only party in the chain. An importer or distributor on Union territory picks up duties of their own. A deployer in the Union who uses your system in a high-risk process will ask you for instructions, technical information and evidence that the system can be used as intended. Banks, hospitals, public bodies and insurers will not take a vendor brochure in place of that file.
If part of the system is supplied from outside the Union - a model, a tool, or a complete product from a UK, US or other third-country vendor - you still need the file for the system you place or put into service. Article 22 of the Act requires a provider established outside the Union to appoint an authorised representative established in the Union before the system is made available there. That representative keeps a copy of the declaration of conformity and the technical documentation, and is the address an authority can write to.
The United Kingdom is outside the Union. A UK company that places a high-risk system on the Union market, or puts one into service there, needs a Union authorised representative in the same way as a company anywhere else outside the EU. A UK establishment, a UK responsible person under UK product law, or a UK office of a European group does not meet that duty on its own. EU companies buying from UK providers should confirm that representative is in place, and that the technical file can be produced in the Union.
The gate: conformity assessment
The Blue Guide describes assessment as the process of showing that the product meets the legislative requirements. At one end the provider carries out the checks itself. At the other a notified body is involved. In either case the provider draws up the technical documentation, completes the procedure the Act names, signs the EU declaration of conformity, and affixes CE marking where required. A notified body does not take that responsibility away.
EN 18286 puts that choice inside the regulatory compliance strategy. The strategy is the high-level plan. It is not the working method. It has to include the essential requirements, post-market monitoring, serious incidents, data management, modifications - and the Article 43 procedure that will be used at the gate. Intended purpose and application area have to be taken into account when that plan is written. The plan is documented.
The documented information of the quality system has to be available to notified bodies and competent authorities, in a clear, version-controlled form, in an official language of the Union. That is what "presented for assessment" means in practice.
What has to be prepared
The essential requirements the quality system has to hold are those in Chapter III, Section 2 of the Act:
- the risk management system
- data and data governance
- technical documentation
- record-keeping
- transparency and information to deployers
- human oversight
- accuracy, robustness and cybersecurity
Those requirements can be assessed even where a harmonised standard does not yet exist. The four approaches below are how the provider shows each one before the file goes through the gate.
The four approaches
For each essential requirement the provider selects one of the following, or a combination of them.
1. Cited harmonised standards
A harmonised standard whose reference has been published in the Official Journal. This is the only approach to which EN 18286 attaches presumption of conformity with the essential requirements the standard covers. The Blue Guide is the same rule for New Legislative Framework products generally.
EN 18286 is that standard for the quality management system required by Article 17. Annex ZA maps it to Article 17 and to the first sentence of Article 11. Neighbouring standards in the same family are intended to sit under this quality system for risk, data, logging, oversight, accuracy and cybersecurity. Presumption follows citation. Publication by CEN is not citation.
Where this approach is used, the technical documentation records which essential requirements it covers. If a cited standard is restricted and does not cover a requirement in full, that gap is written into the file and closed by one of the other approaches.
The burden here is the lightest of the four for what the cited standard actually covers. The authority that wants to contest those points has to overcome the presumption. The quality system and the technical file still have to exist. Presumption is not a substitute for presenting the system for assessment.
2. Common specifications
Common specifications adopted in an implementing act. EN 18286 lists these as a full approach, next to cited standards. They are used where a cited standard does not cover the requirement, or has not been applied.
The technical documentation records which essential requirements they cover. There is no presumption note under this heading in EN 18286. The file has to show that the specification was applied and that the requirement is met. That is more to prove at the gate than a cited standard, and less than an unexplained internal method.
3. Other standards
Standards that are not cited harmonised standards for the Act. An international management-system standard, a sectoral standard, or a technical standard used in the industry can sit here. EN 18286 itself notes that a sectoral quality system - the standard's example is medical devices - can be extended so that it also meets this document. That extension is still "other standards" until the relevant text is a cited harmonised standard for the requirement in question.
The burden is on the provider. The technical documentation has to state which essential requirements are not covered by a cited standard or a common specification, and how the other standard meets them. At assessment, that mapping is what is read. There is no presumption.
4. Other technical specifications
Internal specifications, industry methods, or a technical solution developed for the use case. EN 18286 gives the example of a provider of AI-enabled fall detectors that uses a solution developed in-house, or recommended by an industry body, after a risk assessment of that use.
This approach is allowed. It is also the heaviest of the four at the gate. The technical documentation has to describe, in detail, how each essential requirement that rests on this specification is met. Nothing in the Blue Guide or in EN 18286 reverses the burden of proof for an in-house method.
Combination
The standard allows a mix. A provider may use a cited standard for the quality system, a common specification for one essential requirement, and an internal specification for another. Each requirement still has to be accounted for. The file has to show which approach was used for which requirement, and where a cited standard does not reach, how the gap was closed.
A medical-device manufacturer already running a sectoral quality system will often combine (3) and (1): keep the existing certified system, extend it so that it meets EN 18286, and move onto presumption for Article 17 once that standard is cited. A provider with no sectoral certificate will often combine (4) and (1) in the same way: run the quality system now, and let citation take the evidential load later for what Annex ZA covers.
Combination does not open a fifth approach. It is how the four are used together so the system can be presented for assessment.
What the file has to show at the gate
- the AI systems in the scope of the quality system, and their intended purpose
- the regulatory requirements that were identified
- the compliance strategy, including which Article 43 procedure will be used
- how each essential requirement was shown - cited standard, common specification, other standard, or other technical specification
- where a cited standard or common specification does not cover a requirement in full, the gap and how it was closed
- the technical documentation and the documented information of the quality system
- post-market monitoring, incident handling and the record of changes
- where any provider in the chain is outside the Union, the authorised representative who can produce that file in the Union
In short
Conformity assessment is the gate for placing on the market or putting into service. The system has to be prepared for that gate, and then presented.
EN 18286 gives four approaches to that preparation for the essential requirements: a cited harmonised standard, a common specification, another standard, or another technical specification. One of them, or a combination, is used for each requirement. Only the cited harmonised standard carries presumption. The other three are allowed, and they leave more to prove in the file.
Build the quality system so those choices are visible. Select the Article 43 procedure the Act requires. Then present the file. If a supplier sits outside the Union, including in the United Kingdom, confirm that a Union authorised representative can produce the same file where the system is used.