Conformity assessment

ISO/IEC 17000 defines conformity assessment broadly: testing, inspection, certification and validation are all forms of it. Under Article 43 of the EU AI Act, providers of high-risk AI systems must complete the applicable procedure before placing the system on the market or putting it into service. For most Annex III systems this is an internal control procedure (Annex VI), in which the provider verifies its own quality management system and technical documentation. For certain biometric systems, and for AI embedded in products already subject to third-party checks, a notified body is involved, following Annex VII or the sectoral procedure.

The assessment covers the full set of requirements: risk management, data governance, documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity. Harmonized standards, once published, give a presumption of conformity. A substantial modification triggers a new assessment. Conformity assessment differs from an internal audit or a voluntary certification such as ISO/IEC 42001, although evidence from one can support the other. Auditing these processes is part of AUDAI.