EU AI Act Art.43: Conformity assessment

Article 43 of the EU AI Act binds the provider (conformity). It requires Providers must put each high-risk AI system through the correct conformity assessment procedure before it is placed on the market. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.

Specifics

Who does Art.43 bind?

The article binds the provider (conformity). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.

Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.

What does Art.43 require?

Providers must put each high-risk AI system through the correct conformity assessment procedure before it is placed on the market or put into service. For Annex III point 1 biometrics systems, where harmonised standards or common specifications have been applied, the provider chooses between internal control under Annex VI and assessment of the quality management system and the technical documentation with the involvement of a notified body under Annex VII; where such standards do not exist, were not applied, were applied only in part, or were published with a restriction, the Annex VII procedure must be followed. For Annex III points 2 to 8, internal control under Annex VI applies without notified body involvement. For systems covered by the Union harmonisation legislation in Section A of Annex I, the procedure required by that legislation applies and the Section 2 requirements form part of that assessment. A system already assessed must undergo a new conformity assessment on substantial modification; changes to a continuously learning system that were pre-determined by the provider at the initial assessment and recorded in the technical documentation are not a substantial modification.

This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.43 (Regulation (EU) 2024/1689 on EUR-Lex).

What evidence should we keep for Art.43?

What does a linked control mean here?

A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.

Which NIST AI RMF controls line up with Art.43?

2 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.

Which ISO/IEC 42001 controls line up with Art.43?

2 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.

What does the conformance kit add for Art.43?

The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.