Reg (EU) 2024/1689Generate dossier — €249
LIVE — Fines tracker · Obligations calendar · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL and 12 official sourcesView regulatory intelligence →

AI Act conformity assessment: the Article 43 procedure for high-risk AI systems, Annex VI internal control versus Annex VII notified body.

Article 43 of Regulation (EU) 2024/1689 sets the conformity-assessment procedure that every high-risk AI provider must complete before placing the system on the market. Two paths: Annex VI internal control, where the provider self-assesses; or Annex VII, where a notified body assesses the quality management system and the technical documentation. The path depends on the Annex III category. For points 2 to 8 of Annex III, only Annex VI applies. For point 1 (biometrics), the provider chooses between Annex VI (with harmonised standards) and Annex VII (with notified body). For Art. 6(1) products covered by Annex I, the sectoral conformity procedure applies. Certificates issued by notified bodies are valid for up to 4 years for Annex III systems (5 for Annex I) under Art. 44(2).

Generate AI Act dossier — €249Free: check your AI system risk

€249 one-time payment · 12 PDF documents in ZIP · 45 minutes · 100% in your browser

Regulation (EU) 2024/1689 · Article 11 + Annex IV · 12 documents · 100% browser-side — your data never leaves your machine

The numbers

2 paths
Annex VI internal control · Annex VII assessment of QMS + technical documentation with notified body.
Points 2–8
Annex III points 2 to 8 follow Annex VI (internal control). Notified body NOT required. Art. 43(2).
4 years
Maximum validity of certificates issued by notified bodies for Annex III systems under Art. 44(2). 5 years for Annex I.

The two paths and when each applies

Article 43 distinguishes the conformity procedure by Annex III category. Most providers do not need a notified body. The 4 paths below cover every high-risk case.

1
Path A — Annex III point 1 (biometrics), with harmonised standards
Art. 43(1) first subparagraph. Where the provider has applied harmonised standards under Art. 40 or, where applicable, common specifications under Art. 41, the provider may choose: (a) Annex VI internal control; or (b) Annex VII assessment of QMS + technical documentation with notified-body involvement.
2
Path B — Annex III point 1 (biometrics), without harmonised standards
Art. 43(1) second subparagraph. Annex VII is mandatory where (a) no harmonised standards exist and no common specifications apply; (b) the provider has not applied or only partly applied a harmonised standard; (c) common specifications exist but the provider has not applied them; (d) a harmonised standard has been published with a restriction.
3
Path C — Annex III points 2 to 8 — Annex VI internal control
Art. 43(2). For high-risk AI systems in Annex III points 2 (critical infrastructure), 3 (education), 4 (employment), 5 (essential services including credit scoring), 6 (law enforcement), 7 (migration), 8 (justice), the provider follows the Annex VI internal-control procedure. No notified body involvement.
4
Path D — Art. 6(1) products covered by Annex I
Art. 43(3). For high-risk AI systems that are safety components of products covered by Section A of Annex I harmonisation legislation (machinery, toys, lifts, medical devices, etc.), the provider follows the conformity-assessment procedure under the relevant Annex I act. The AI Act Section 2 requirements are integrated into that assessment. Points 4.3, 4.4, 4.5 and the fifth paragraph of point 4.6 of Annex VII also apply.
Substantial modification → new conformity assessment
Art. 43(4) first subparagraph: high-risk AI systems that have already been subject to a conformity-assessment procedure shall undergo a new conformity assessment in the event of substantial modification, regardless of whether the modified system is intended for further distribution or continues to be used by the current deployer. Art. 43(4) second subparagraph: changes that were pre-determined by the provider at the moment of initial conformity assessment and form part of the Annex IV technical documentation (point 2(f)) do NOT constitute substantial modification — important for continuously learning systems.
Certificate validity under Art. 44
Certificates issued by notified bodies under Annex VII are valid for the period indicated, not exceeding 5 years for Annex I AI systems and 4 years for Annex III AI systems. Extendable in periods of the same duration on the basis of re-assessment under the applicable conformity-assessment procedures.

Three common mistakes

COMMON MISTAKE

"Every high-risk AI needs a notified-body audit"

False. Art. 43(2) provides that Annex III points 2 to 8 follow Annex VI internal control, with no notified-body involvement. Only Annex III point 1 (biometrics) sometimes requires Annex VII with a notified body, and Art. 6(1) systems follow the sectoral conformity procedure under the relevant Annex I act. The majority of Annex III high-risk providers self-assess under Annex VI.

COMMON MISTAKE

"Once we have a certificate, we are compliant forever"

Art. 44(2): certificates are valid for up to 4 years for Annex III systems and 5 years for Annex I systems. Re-assessment is required for extension. Additionally, Art. 43(4) requires a new conformity assessment on any substantial modification (Art. 3(23)). The certificate is a snapshot — the obligation is continuous.

COMMON MISTAKE

"Financial institutions follow their existing internal-governance regime, so no AI Act conformity assessment"

Art. 17(4) lets financial institutions reuse their existing internal-governance arrangements for points (g), (h) and (i) of the Art. 17 QMS — but only those three points, not the full QMS, and not the Art. 43 conformity-assessment procedure itself. Art. 72(4) similarly allows financial institutions to integrate the post-market monitoring obligations into their existing systems. The conformity-assessment obligation under Art. 43 stands.

Does the AI Act apply to your system?

Answer these four questions to determine your obligations.

Does your system use machine learning, logic-based, or statistical approaches?
Art. 3(1) — definition of "AI system"
Is the system placed on the EU market or does its output affect persons in the EU?
Art. 2(1) — territorial scope (extraterritorial via 2(1)(c))
Is your system used in any Annex III domain? (employment, credit, education, law enforcement, migration, justice, critical infrastructure, biometrics)
Art. 6(2) + Annex III — high-risk classification
Are you the provider (developer) or the deployer (user) of the system?
Art. 3(3) provider · Art. 3(4) deployer — different obligations

Take the full AI Act risk classification test →

What the ZIP contains

12 PDF documents generated from your inputs. Each cites the article of Regulation (EU) 2024/1689 it fulfils.

1

Risk Classification Report

Identifies whether your system is prohibited (Art. 5), high-risk (Art. 6 + Annex III) or subject to transparency obligations (Art. 50).

2

Technical Documentation

The 9 blocks of Annex IV in full: system description, training data, validation, performance metrics, risk management, human oversight. Art. 11 + Annex IV.

3

EU Declaration of Conformity

Signable document conforming to Art. 47 and Annex V.

4

Compliance Calendar

Key application dates: 2 Feb 2025, 2 Aug 2025, 2 Aug 2026, 2 Aug 2027. Art. 113.

5

Conformity Sheet

Executive summary of compliance status for authorities or commercial buyers. Art. 43 procedure.

6

Quality Management System (QMS)

QMS structure covering the 13 aspects required by Art. 17.

7

Deployer Instructions

Document for the entity deploying your system, conforming to Art. 13.

8

Evidence Checklist

Verifiable evidence list, cross-referenced to every Annex IV block.

9

Incident Report Template

Notification protocol conforming to Art. 73 (15 days general / 10 days death / 2 days widespread).

10

AI Literacy Programme

Training plan conforming to Art. 4, in force since 2 February 2025.

11

Post-Market Monitoring Plan

Plan structure required by Art. 72 and integrated into the technical documentation under Annex IV(9).

12

Fundamental Rights Impact Assessment (FRIA)

Template under Art. 27 for public bodies, private entities providing public services, and Annex III 5(b)(c) deployers.

See before you buy — Download a sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated from your inputs, in your browser. No data leaves your machine.

What you pay

🧾 AI ACT COMPLIANCE CONSULTANCY
€5,000–€15,000
3–6 months. They explain the obligations to you.
✓ AICHECK
€249
12 documents. 45 minutes. Solves the documentation.

Technical documentation and conformity assessment: two layers

● LAYER 1

Technical documentation — Annex IV

12 documents. 45 minutes. €249. The documentation your system needs before being placed on the market.

∅ LAYER 2

Conformity assessment by notified body

If your system falls under Art. 43(1) (Annex III point 1 biometrics with notified-body route, or Annex I products), you will need third-party conformity assessment. That is a separate process. AICheck does not replace it.

We do not sell audits. We do not sell consultancy. We sell the tool that structures your documentation under Annex IV.

Penalty regime

Article 99 of Regulation (EU) 2024/1689. Chapter XII (Penalties) applies from 2 August 2025.

🇪🇺
Non-compliance with prohibited practices (Art. 5)
€35M / 7%

Art. 99(3). Up to €35 million or 7% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups: whichever is lower (Art. 99(6)).

🇪🇺
Non-compliance with operator obligations (high-risk, transparency, deployer)
€15M / 3%

Art. 99(4). Includes failure to draw up technical documentation under Art. 11 + Annex IV. Covers obligations of providers (Art. 16), deployers (Art. 26), authorised representatives (Art. 22), importers (Art. 23), distributors (Art. 24), notified bodies (Art. 31, 33, 34) and transparency under Art. 50.

🇪🇺
Supply of incorrect, incomplete or misleading information
€7.5M / 1%

Art. 99(5). Applies when information provided to notified bodies or national competent authorities is wrong or misleading.

Documenting 5 or more AI systems?

If you operate multiple AI systems and need to document them all under Annex IV, contact us for volume pricing at hello@solidwaretools.com.

Request volume pricing
Reply within one business day

What AICheck guarantees, and what it does not

AICheck produces a document structured under Article 11 and Annex IV of Regulation (EU) 2024/1689 from the information you provide. The accuracy, truthfulness and completeness of that information is your responsibility as provider of the AI system.

We guarantee that the document structure follows Article 11 and Annex IV of Regulation (EU) 2024/1689 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a given case, nor by a commercial buyer in a procurement process.

AICheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions

Do I need a notified body for an Annex III high-risk AI system?
Only if your system falls under Annex III point 1 (biometrics) AND you have not applied (or only partly applied) the relevant harmonised standards or common specifications — in which case Annex VII with notified body applies. For Annex III points 2 to 8, Art. 43(2) sets Annex VI internal control as the procedure, with no notified body. For Art. 6(1) systems (Annex I products), the sectoral conformity-assessment regime governs.
Can I self-assess under Annex VI?
Yes, for Annex III points 2 to 8 under Art. 43(2). Annex VI is an internal-control procedure where the provider verifies that the quality management system under Art. 17 conforms to Section 2 requirements and that the technical documentation under Art. 11 + Annex IV has been drawn up. The provider then draws the EU Declaration of Conformity under Art. 47 and affixes the CE marking under Art. 48.
When is a new conformity assessment required?
Art. 43(4): in the event of a substantial modification (defined in Art. 3(23) — a change not foreseen in the initial conformity assessment that affects compliance with Section 2 or modifies the intended purpose). Pre-determined changes documented in point 2(f) of Annex IV — particularly for systems that continue to learn after placing on the market — are explicitly NOT substantial modifications and do not trigger a new assessment.
Is this a subscription?
No. One-time payment. The licence includes 30 days of editing and 10 regenerations. The PDF you download is yours to keep.
Can I request a refund?
Pursuant to Article 16(m) of Directive (EU) 2011/83 on consumer rights, by activating the licence you give express consent to the immediate generation of digital content, waiving the 14-day withdrawal right. Refunds are only accepted in the case of a reproducible technical failure.
What if the regulation changes?
If the regulation changes while your licence is active, you can regenerate the document with the updated version of the generator at no additional cost.
⚠️ Important notice: AICheck is a documentary self-assessment tool, not legal advice nor a third-party audit. The document under Article 11 and Annex IV of Regulation (EU) 2024/1689 is generated from the data you input. The accuracy of that data is your responsibility. AICheck does not replace a qualified professional assessment.

Don't wait for the consultancy. Generate the Annex IV documentation for your AI system in your browser in 45 minutes.

Twelve documents. Annex IV fully structured. Regulation (EU) 2024/1689. Your data does not leave your machine. The ZIP you download is yours to keep.

€249 one-time payment
12 professional documents · 45 minutes · No subscription · 100% in your browser
Generate dossier — €249
✓ Last regulatory verification: 11 May 2026 · No substantive changes detected · View history