What Art. 43 covers
Art. 43 AI Act sets out how providers must demonstrate that a high-risk AI system meets the requirements of Section 2 of Chapter III. The provision draws a strict distinction depending on which category of Annex III the system falls under – and whether harmonised standards (Art. 40) or common specifications (Art. 41) exist and have been applied. Getting this wrong risks an invalid conformity assessment procedure and, as a result, incorrect CE marking.
Two procedures, different triggers
For systems under Annex III point 1 (e.g. biometric systems), Art. 43(1) generally gives the provider a choice between two procedures:
- Internal control under Annex VI – the provider assesses conformity itself, without an external body.
- Assessment by a notified body under Annex VII – covers examination of the quality management system and the technical documentation.
However, this freedom of choice only applies where harmonised standards or common specifications have been applied in full. As soon as one of the following situations arises, Art. 43(1) mandatorily requires the procedure under Annex VII:
- No harmonised standard or common specification exists.
- The harmonised standard has not been applied, or only partially.
- An existing common specification has not been applied.
- A harmonised standard has been published subject to a restriction – in which case Annex VII applies at least to the restricted part.
For all other high-risk categories (Annex III points 2 to 8), Art. 43(2) consistently provides for internal control under Annex VI – without involvement of a notified body. This matters in practice: most use cases in HR, credit or education fall under these points and therefore do not require an external body, but rather a robust internal assessment.
Special case: products covered by existing harmonisation legislation
Where a high-risk AI system is also covered by legislation listed in Annex I Section A (such as machinery or medical device law), Art. 43(3) provides that the conformity assessment procedure under that legislation applies – with the requirements of Section 2 of the AI Act integrated into that assessment. Notified bodies already notified under the relevant legislation may also assess the AI Act requirements, provided they also meet the criteria set out in Art. 31(4), (5), (10) and (11). This matters for manufacturers: where product legislation allows a provider to forgo third-party assessment because harmonised standards have been applied in full, this is only permissible if those standards (or common specifications under Art. 41) also cover all requirements of Section 2 of the AI Act.
Substantial modification: assessment is not a one-off act
Art. 43(4) requires a fresh conformity assessment where a system that has already been assessed undergoes a substantial modification – regardless of whether it continues to be placed on the market or is merely still in use. An exception applies to systems that continue to learn: changes that the provider already pre-determined at the time of the initial assessment and documented in the technical documentation under Annex IV point 2(f) do not constitute a substantial modification. In practice, this means providers of learning systems must anticipate and document expected learning paths and performance changes as part of the initial assessment – otherwise, every subsequent adjustment triggers a new assessment obligation.
Common gaps in practice
Recurring weaknesses seen in advisory practice include:
- Failure to assign the correct Annex III point. Without a clear categorisation, it is impossible to determine whether Annex VI or Annex VII applies.
- Unclear standards position. Providers assume harmonised standards apply without checking whether they have actually been published and are fully applicable – not merely subject to a restriction.
- Missing advance documentation for learning systems. Without the details required under Annex IV point 2(f), the provider loses the benefit of the exception in Art. 43(4) and risks a full new assessment with every model update.
- No trigger mechanism for re-assessment. Providers often lack an internal process that automatically checks product changes against the definition of “substantial modification”.
The high-risk obligations under Annex III only take effect on 2 December 2027 — the Digital Omnibus moved them back from 2 August 2026. Even so, it is worth looking now at the appropriate conformity assessment procedure – procedures under Annex VII involving a notified body require considerably more lead time than internal control under Annex VI.
Next step
Whether your system falls under Annex III, which point applies, and which conformity assessment procedure follows from that can be clarified in a few minutes using our free risk check at /einstufung.