"Will our CV-screening software need a CE mark?" If you are a software house or an SME developing AI for Annex III purposes, the answer is yes. From 2 December 2027 a high-risk AI system cannot be placed on the market or put into service without a conformity assessment, an EU declaration of conformity and the CE marking. The good news: in most cases no notified body is needed. The bad news: internal control is not a one-page self-certification.
Who must do it, and from when
The obligations fall on the provider of the high-risk system: whoever develops it and places it on the market or puts it into service under its own name, including for internal use. Under Article 25 you also become one if you put your trademark on a high-risk system, substantially modify it, or change its purpose so that it becomes high-risk.
Article 16 of Regulation (EU) 2024/1689 lists the provider's obligations. Four of them make up the "CE path":
| Step | Article | What it produces |
|---|---|---|
| Conformity assessment | Art. 43 | A documented check against the requirements |
| EU declaration of conformity | Art. 47 | A signed document in which you take responsibility |
| CE marking | Art. 48 | A physical or digital mark on the system |
| Registration | Art. 49 | You and the system entered in the EU database |
With Regulation (EU) 2026/1744 (the Digital Omnibus) the dates were postponed and made certain: 2 December 2027 for stand-alone Annex III systems, 2 August 2028 for AI embedded in already-regulated products (Annex I). It sounds far away, but technical documentation and a quality system take months.
Which procedure: internal control or notified body
Article 43 distinguishes by Annex III point:
- Points 2–8 (critical infrastructure, education, employment, essential services such as creditworthiness, law enforcement, migration, justice): internal control under Annex VI, with no notified body.
- Point 1 (biometrics): the provider chooses between internal control and the Annex VII procedure with a notified body; the latter becomes mandatory if it does not fully apply harmonised standards or common specifications.
For Annex I systems, the procedure under the relevant product legislation (machinery, medical devices, etc.) applies, integrating the AI Act requirements.
What "internal control" means
Annex VI requires the provider to verify three things:
- that the quality management system complies with Article 17;
- that the technical documentation (Article 11 and Annex IV) shows compliance with the requirements of Articles 8–15: risk management, data governance, record-keeping, transparency towards the deployer, human oversight, accuracy, robustness and cybersecurity;
- that the design and development process and the post-market monitoring (Article 72) are consistent with that documentation.
No external body signs on your behalf: that is exactly why the supervisory authority will look at that file.
EU declaration and CE marking
The EU declaration of conformity (Article 47) is drawn up for each system, in machine-readable, physical or electronically signed form, with the content of Annex V. By signing it, the provider takes responsibility for compliance. It must be translated into a language the authorities of the Member States where the system is distributed can understand, kept up to date and retained for ten years. If the product also falls under other EU legislation requiring a declaration, a single one is drawn up.
The CE marking (Article 48) is affixed visibly, legibly and indelibly or, where that is not possible, on the packaging or documentation. For software, the digital CE marking is what matters: it is allowed if easily reachable via the interface used to access the system or via a machine-readable code. If a notified body was involved, its identification number follows the mark.
Registration and life after the mark
Before placing on the market, the provider registers itself and the system in the EU database (Articles 49 and 71). Critical infrastructure systems (Annex III, point 2) are the exception, registered at national level.
The marking does not close the file:
- Substantial modification → new conformity assessment (Article 43(4)). Pre-determined continuous learning described in the technical documentation does not count.
- Post-market monitoring (Article 72) throughout the system's lifetime, based on a plan that is part of the technical documentation.
- Ten-year retention (Article 18) of the technical documentation, quality system documentation and the EU declaration.
Breaches of provider obligations can be fined up to EUR 15 million or 3% of worldwide annual turnover (Article 99(4)); for SMEs the lower of the two applies.
What changes for SMEs and small mid-caps
The Digital Omnibus extended some simplifications:
- the simplified quality management system of Article 63, previously reserved for microenterprises, is available to SMEs;
- simplified technical documentation applies to SMEs and small mid-caps, and notified bodies must accept it.
Simplified does not mean optional: the requirements of Articles 8–15 are unchanged. On technical standards, EN 18286 on the quality management system for AI Act purposes was approved by CEN-CENELEC in July 2026; the presumption of conformity (Article 40) only applies once its reference is published in the Official Journal of the EU, so check its status before relying on it.
A six-step checklist
- Confirm the classification: does the system really fall under Annex III, and under which point?
- Choose the procedure: Annex VI or, for biometrics, Annex VII.
- Set up the quality system (Article 17), using the simplified version if you are an SME.
- Build the technical file (Annex IV), including the post-market monitoring plan.
- Sign the EU declaration, affix the CE marking (digital, for software) and register the system.
- Define in advance what will count as a "substantial modification" in your release cycle.
Where to start
A conformity assessment is an exam you set yourself: it is only worth something if someone has stress-tested it before the authority does. An independent gap assessment checks your system and documentation against Articles 8–17 and Annex IV, and tells you how far you are from CE marking — with the time left until 2 December 2027.