How to Select a Conformity Assessment Route
under the EU AI Act

Regulatory Basis: Article 43 and the Two Main Routes

Article 43 requires providers of high-risk AI systems to demonstrate conformity with the essential requirements (Chapter III, Section 2) before placing the system on the market or putting it into service. The Act defines two principal conformity assessment procedures:

• Annex VI - Internal control (self-assessment): Provider internally verifies QMS and technical documentation compliance.
• Annex VII - Third-party assessment (notified body): Accredited notified body reviews QMS and/or technical documentation (quality assurance module or type-examination + production controls).

Article 43(1) establishes that Annex VI is the default route unless mandatory third-party involvement is required. The choice is not always open - it is determined by system category, applicable harmonised standards/common specifications, and (in some cases) provider preference or risk appetite.

Relevant guidance: EU AI Office 'Conformity Assessment Guidance' (2025-2026); Commission implementing acts on notified bodies; EN 18286 draft (once cited, presumption of conformity for Article 17 QMS).

When Each Route Applies - Decision Tree

The selection process follows a clear hierarchy:

1. Determine system category (Annex III / Annex I):
   • Annex III point 1 (biometric identification/verification in sensitive contexts) - Annex VII mandatory (third-party required).
   • Annex I products (medical devices, machinery, etc.) where AI is a safety component subject to third-party assessment under sectoral law - Annex VII usually mandatory (Article 43(2)).
   • Annex III points 2-8 (critical infrastructure, education, employment, essential services, law enforcement, migration, justice) - Annex VI default unless overridden.
2. Check harmonised standards / common specifications:
   • If fully applied (e.g., future EN 18286 cited) - Annex VI internal control permitted even in borderline cases.
   • If not applied (or partial application) - Annex VII may be required or strongly recommended.
3. Assess provider preference / risk appetite:
   • Even when Annex VI is allowed, providers may voluntarily choose Annex VII for higher credibility, insurance benefits, or reduced market-surveillance risk.

Practical decision tree example: A provider develops an AI system for predictive maintenance of critical infrastructure (Annex III point 2). No Annex I overlap, harmonised standards applied (future EN 18286) - Annex VI internal control is the applicable and preferred route. If the same AI is a safety component of machinery under the Machinery Regulation (Annex I) requiring third-party conformity - Annex VII becomes mandatory regardless of standards.

When There Is Effectively No Choice

In several scenarios, the provider has no meaningful choice and must use Annex VII (third-party assessment):

• Mandatory third-party categories: Annex III point 1 (certain biometric systems) and safety components of Annex I products under sectoral third-party rules (e.g., MDR Class IIb/III medical devices, certain machinery categories).
• No / partial harmonised standards: If no relevant harmonised standard is cited (or the provider does not fully apply it), and the system falls in a category requiring notified-body involvement, Annex VII is compulsory.
• Commission decision / common specifications: Future implementing acts may mandate third-party assessment for specific high-risk categories even outside point 1 / Annex I.

Edge case: A continuously learning biometric system (point 1) has no choice - Annex VII is mandatory. A provider may still prepare using EN 18286 draft for QMS alignment, but notified-body review remains unavoidable.

Practical Comparison: Annex VI vs Annex VII

Strategic Considerations and Preparation Tips

Selection strategy:

• Use Annex VI whenever permitted - fastest and cheapest for most systems.
• Choose Annex VII voluntarily for high-visibility applications, liability-sensitive uses, or when notified-body expertise adds value.
• Prepare for both routes initially - build QMS/documentation to Annex VI standard; engage notified body early if point 1 / Annex I applies.

Preparation tips:

• Document classification rationale clearly (EU AI Office tools).
• Align QMS with EN 18286 draft (even before citation) for future-proofing.
• Book notified-body capacity 12 - 18 months ahead if Annex VII likely.
• Maintain living compliance file ready for unannounced authority requests.

In summary, Article 43 and Annexes VI-VII create a tiered conformity assessment framework: Annex VI internal control is the default and preferred route for most high-risk systems (points 2-8), while Annex VII third-party assessment is mandatory for biometrics (point 1) and certain Annex I safety components - with no real choice in those cases. Preparation should focus on building a robust, EN 18286-aligned QMS that supports either route, ensuring timely, defensible market access once the 2 August 2026 deadline arrives.

Content based on the EU AI Act (Regulation (EU) 2024/1689), Articles 17 & 43, Annexes VI-VII, and EN 18286 draft status and CEN/CLC JTC 21 updates. Finalisation and citation timelines are working expectations and subject to change. Always consult the latest CEN/CENELEC communications, EU AI Office guidance, and legal/notified-body experts for current status and implementation. High-risk provisions become fully applicable on 2 August 2026.