AIG-037 AI Regulatory Conformity Assessment and Declaration
Description
For each AI system in a category that regulation subjects to conformity assessment, a completed assessment record exists and pre-dates the system being placed on the market or put into service. The record names the assessment route taken, the standards or specifications applied, the evidence examined against each requirement, the person who signed it off and whether a third-party body was involved and under what identification. A signed declaration of conformity exists for each such system, identifies the system it covers, states the requirements it meets and is kept available for the retention period the applicable regulation sets. Where regulation requires a conformity marking, the marking is placed where a person using the system can reach it and the placement is recorded. A substantial modification triggers a repeated assessment and a reissued declaration, unless the change was predetermined and documented in the original assessment.
Rationale
Whether a system falls into an assessed category is a determination. That determination is recorded against the system in the inventory (AIG-003). AIG-009 re-runs the internal pre-deployment controls on a substantial modification; AIG-037 is the external claim that has to be redrawn when it does, which is why the trigger is shared and the artefacts are not. AIG-036 is the quality management system a conformity assessment examines. Where the system is delivered as a service the marking route is normally a digital marking reachable from the interface the system is accessed through or through a machine-readable code, so the evidence is a fetch or a capture of that placement rather than a photograph of a label. The contents of the declaration and the procedures for each assessment route are in the implementation guidance of the source rows. Provider seat (ADR-031).
Applicability (9 profiles)
Condition: ai_risk_class in high-risk-annex-iii
Conformity assessment, the declaration and the CE marking (Art.43, 47, 48) bind providers of high-risk systems.
Condition: ai_risk_class in high-risk-annex-iii
Conformity assessment is the provider's. For a high-risk system the deployer obtains the EU declaration of conformity and confirms the CE marking before putting the system into service, recording both in the AIG-032 assessment.
A general-purpose model is not a high-risk system; the conformity duties attach to the provider seat where the organisation also places a high-risk system on the market (saas-ai-provider, high-risk-provider-eu).
The base makes this conditional on the risk class. Here the class is settled by the profile's facets, so conformity assessment is a standing duty and the only open question is the route, which turns on which limb of Art.6 the system sits under. A safety component of a product covered by an Annex I instrument is assessed under that product's own conformity assessment procedure with the Section 2 requirements folded into it (Art.43(3)), so there is no separate AI procedure and the body involved is the one that instrument names. An Annex III system runs internal control under Annex VI and for points 2 to 8 Art.43(2) makes that the whole of it, with no notified body. Art.43(1) singles out Annex III point 1 biometrics: internal control under Annex VI is available where harmonised standards or common specifications have been applied. A quality management system assessment under Annex VII with a notified body is the route where they have not. Art.43(4) repeats the assessment on a substantial modification whether or not the system is distributed further. Art.47 requires a written, machine-readable EU declaration of conformity per system, identifying the system, stating that it meets Section 2, carrying the Annex V information, translated for the competent authorities of each Member State it is placed on the market in, kept up to date and kept at their disposal for 10 years, with a single declaration where other Union harmonisation legislation also requires one. Art.48 requires the CE marking, affixed visibly, legibly and indelibly or on the packaging or accompanying documentation where the system does not allow it, in digital form for a digitally provided system only where it is reachable from the interface or through a machine-readable code, followed by the notified body's identification number where one was involved and repeated in any promotional material claiming CE conformity. AIG-009 holds the internal side of a substantial modification.
The base conditions this row on the risk class; here the class is settled by the profile's facets, so the row is required and the condition goes. Conformity assessment, the declaration under Art.47 and the marking under Art.48 stay the provider's. What this seat does is check them: the EU declaration of conformity is obtained and the CE marking confirmed before the system is put into service, both recorded in the AIG-032 assessment, which is the same check on either seat. A public body has no route to the declaration other than the tender, so the check belongs at award rather than at go-live.
Condition: ai_risk_class in high-risk-annex-iii
Conformity assessment, the declaration and the CE marking (Art.43, 47, 48) bind providers of high-risk systems.
Condition: ai_risk_class in high-risk-annex-iii
Conformity assessment, the declaration and the CE marking (Art.43, 47, 48) bind providers of high-risk systems.
Condition: ai_risk_class in high-risk-annex-iii
Conformity assessment, the declaration and the CE marking (Art.43, 47, 48) bind providers of high-risk systems.
Condition: ai_risk_class in high-risk-annex-iii
Conformity assessment, the declaration and the CE marking (Art.43, 47, 48) bind providers of high-risk systems.
Framework Mappings (7)
| EU-AI-Art.16.5 | Provider Obligations — Conformity Assessment and CE Marking | full |
| EU-AI-Art.43.1 | Conformity Assessment — Internal Control or Notified Body Assessment | full |
| EU-AI-Art.43.2 | Conformity Assessment — Internal Control for Annex III Points 2–8 | full |
| EU-AI-Art.43.3 | Conformity Assessment — Reassessment After Substantial Modification | full |
| EU-AI-Art.43.4 | Conformity Assessment — Annex I Safety Components Under the Sectoral Procedure | full |
| EU-AI-Art.47 | Conformity Assessment — EU Declaration of Conformity | full |
| EU-AI-Art.48 | Conformity Assessment — CE Marking | full |
Evidence (3)
Completed conformity assessment record for a named AI system, naming the route taken, the standards or specifications applied, the evidence examined against each requirement and the sign-off.
Example: Conformity assessment file for Claims Triage Engine v4, internal control route, signed 18 May 2026 by the Head of AI Assurance.
Test: Verify: (1) the assessment record is dated before the date the system was first made available to anyone outside the organisation, (2) it names the route taken and gives the reason that route applies, (3) every requirement in scope has a named piece of evidence against it rather than an assertion, (4) the signatory is identified and is authorised to sign under the quality management system.
Register of declarations of conformity, showing for each system the declaration version, its signature date, the assessment it rests on, the retention expiry and whether a reissue followed the last substantial modification.
Example: Declarations of conformity register, extract of 30 June 2026, covering four systems with their reissue history.
Test: Verify: (1) every system the organisation has determined to be in an assessed category has a declaration in the register, (2) each declaration identifies one system rather than a product family, (3) each retention expiry is later than the date the corresponding system was placed on the market by at least the period the applicable regulation sets, (4) for each substantial modification recorded under AIG-009 in the period, a reissued declaration exists or the change is shown to have been predetermined in the original assessment.
Live check that the conformity marking is reachable by a person using the system at the placement the record states, resolving to the declaration for the version in use.
Example: Walkthrough of the tenant console footer and the machine-readable endpoint, performed 2 July 2026.
Test: Verify: (1) the marking is reachable from the interface the system is accessed through, or through the machine-readable route the placement record names, (2) reaching it takes no privileged account and no support request, (3) the version it resolves to is the version currently served, (4) where a third-party body was involved, its identification number appears alongside the marking.
Questions (3)
Has a conformity assessment been completed for every AI system you have determined falls into an assessed category?
The determination itself is recorded against each system in the AI system inventory (AIG-003). Where you have determined that no system falls into an assessed category, answer yes and keep the determination available; the assessor tests the determination, not the absence of assessments.
Which of the following does your conformity assessment record contain?
Options follow the order in which the items are produced. Tick the evidence item only where each requirement has a named artefact against it; a summary statement that the requirements are met does not count.
Who completes and signs off the conformity assessment?
Options run from the most independent to the least. Answer for the route actually used in the last twelve months, not the route the procedure allows for.