EU AI Act conformity assessment cost and process

Which EU AI Act conformity assessment route applies to our high-risk system?

Before a high-risk AI system reaches EU customers, the provider must complete the relevant conformity assessment, as Article 16(f) requires. For most Annex III systems in points 2 to 8, including employment, credit scoring, education and essential services, the provider follows internal control under Annex VI and no notified body is involved. The route is set by three questions: which Annex III category or Annex I product the system falls under, whether it is a biometric system under Annex III point 1, and whether harmonised standards or common specifications were fully applied. Biometric systems can use internal control or a notified body only where those standards were fully applied, and otherwise need a notified body assessment under Annex VII. Annex I product AI follows the sectoral procedure for that product, which must also cover the AI Act requirements.

The organization owns the assessment and carries the legal responsibility for the outcome. A partner such as DeployOpen can prepare the quality management system, technical documentation and test evidence that the chosen route will examine, but it cannot issue the conclusion. Under internal control, the provider signs the EU declaration of conformity itself. Under the notified body routes, an independent notified body assesses the quality management system and documentation and keeps the system under surveillance. Confirm early which notified bodies are designated for your category, since some Annex I bodies must still apply for AI Act designation, and ask any notified body for its written scope and fee basis before work starts. If you are unsure which route applies, record that analysis in your technical file and confirm it with counsel or the relevant market surveillance authority.

Decide the route before you build the evidence pack, because the documents a notified body samples and the ones an internal control check verifies overlap but are not identical. A substantial modification triggers a new conformity assessment, so plan change control around the route you chose at launch. Also confirm whether your system is biometric and whether any law enforcement, immigration or asylum use applies, since the market surveillance authority acts as the notified body in those cases. Once the route is fixed, map each step to a named owner, a dated artifact and a sign-off from someone outside the engineering team.

Internal control, notified body or sectoral route: which fits

Most high-risk systems fall under Annex III points 2 to 8, which cover areas such as employment, credit scoring, education and access to essential services. For these systems the provider does not involve a notified body. Article 43(2) directs the provider to follow the internal control procedure in Annex VI, under which the provider runs the assessment itself and keeps the evidence.

Quality management check: The provider verifies that its quality management system meets Article 17.
Technical documentation review: The provider examines its technical documentation against the high-risk requirements.
Consistency check: The provider confirms that design, development and post-market monitoring match what the documentation describes.
Declaration and marking: After the assessment, the provider signs the EU declaration of conformity, affixes CE marking and registers the system in the EU database.
Reassessment on change: A substantial modification requires a new conformity assessment.

Before relying on this route, confirm with your legal team that the system's use case falls within points 2 to 8 and not within another route that would require a notified body.

What the provider checks under Annex VI internal control

Under Annex VI internal control, the provider runs three checks itself, and no notified body takes part. First, it verifies that its quality management system meets the requirements of Article 17. Second, it examines the technical documentation against the requirements for the high-risk system. Third, it checks that the system's design, its development and its post-market monitoring actually match what the documentation describes. Only when all three checks pass may the provider sign the EU declaration of conformity, affix the CE marking and, for Annex III systems, register the system in the EU database. The provider must complete this assessment before the system is placed on the market or put into service (Article 16(f)). Before starting, confirm with your legal team which Annex III point your system falls under, because that point decides whether internal control applies at all.

A substantial modification triggers a new conformity assessment (Article 43(4)). A change to the system's intended purpose, its performance or its risk profile, or any change that alters what the original documentation describes, should be assessed against that test before release. The exception covers pre-determined changes made by a continuously learning system, but only where those changes were documented in the initial assessment. Build the change log and the pre-determined change plan into the assessment file from day one, so that the provider can show which updates were planned and which required a fresh assessment. Ask your team to define in writing, before launch, what counts as a substantial modification for each system.

No assessor's report is produced for internal control. The provider's own records are the evidence, and an independent auditor or a market surveillance authority may examine them later. Keep the QMS records, the technical documentation, the assessment results, the declaration of conformity and the change history together and retrievable. The declaration of conformity must be kept for 10 years after the system is placed on the market (Articles 47 to 49). Organizations that bring in outside help can have an implementation partner prepare these records and test the file for gaps, but the provider remains responsible for the declaration and for the conclusions it contains.

What drives the cost and time of a conformity assessment

The effort behind a conformity assessment depends less on the regulation itself than on the state of the system, its documentation and the organization's existing management controls. The cards below cover the decisions and checks that move cost and time up or down, and each one names the control that keeps the work contained.

Number and versions of systems

Each high-risk system needs its own technical documentation and assessment record, and a substantial modification triggers a new conformity assessment under Article 43(4). A portfolio of near-identical models on shared code may be scoped as one system family, but only if the assessor agrees the boundary in advance. Control: maintain a versioned register of every system and release, and record which changes count as substantial before any assessment starts. Ask the notified body or auditor how it prices each system and each version.

Documentation maturity

The provider must examine its technical documentation against the requirements of the Act, and a notified body reviews that documentation for each system under Annex VII. Gaps found late in the review often cost more than the documentation itself. Control: build the technical file as the system is developed, not after release, and run a internal check against the requirements before submission. Ask how many review rounds the quote assumes.

Notified body involvement

Most Annex III systems use internal control under Annex VI, so no notified body fee applies. A notified body is needed for some biometric systems and for Annex I products, and it reviews the quality management system and technical documentation of each system. The Commission's 2021 impact assessment estimated a documentation review at one to two and a half days, or EUR 3,000 to 7,500. Control: confirm the route under Article 43 before buying any external review.

QMS maturity and existing management systems

Article 17 requires a documented quality management system, and under Annex VI the provider must verify it. Organizations that already run a management system for information security or AI governance can reuse documented processes, roles and audit records, which shortens the first assessment. The 2021 impact assessment estimated an initial QMS audit at EUR 1,000 to 2,000 per day, with yearly re-audits. Control: map existing procedures to Article 17 headings and identify the gaps before engaging an assessor.

Third-party components and models

A high-risk system that embeds a third-party model, dataset or software library inherits the documentation burden for those parts. The provider needs supplier evidence on training data, performance and known limitations, and contract clauses that secure access to it. Missing supplier information is a common reason documentation stalls. Control: inventory every third-party component, obtain the supplier documentation in writing, and check whether any upstream provider has already published documentation for the AI Act duties. Confirm which obligations the supplier takes on in the contract.

SME status and fee relief

Article 62(2) requires that conformity assessment fees take the needs of SME providers into account and are reduced in proportion to their size and market. Small providers should not assume a fixed fee, and should ask each notified body how it applies this reduction. Control: document headcount and turnover status early, and request a written fee basis that shows any reduction applied to the scope.

Who is paid for what in a conformity assessment

This table compares the parties who carry cost in a high-risk AI conformity assessment and whether each cost is one-time or recurring. The EUR figures come from the Commission's 2021 impact assessment and are estimates, not current quotes, so ask any notified body for a written scope before budgeting.

Party and cost	Who is paid and for what	One-time or recurring, and what drives it
Provider internal staff	Own engineers, quality, legal and product staff build the QMS, write technical documentation and sign the EU declaration of conformity	One-time for initial build, recurring for upkeep. Driven by number of systems, change frequency and how mature existing ISO or quality processes are
Implementation partner	Paid by the provider for evidence preparation, technical documentation support and gap work; does not issue assessment outcomes	Mostly one-time per system scope, with optional retainers for updates. Driven by documentation gaps, number of Annex III or Annex I systems and the agreed written scope
Notified body documentation review	Paid directly by the provider. The Commission's 2021 impact assessment estimated one to two and a half days, or EUR 3,000 to 7,500, per review	One-time per system or substantial modification. Driven by documentation volume and how many systems share a QMS
Notified body QMS audit	Paid directly by the provider. The 2021 impact assessment estimated EUR 1,000 to 2,000 per audit day for the initial QMS audit	One-time initial audit. Driven by audit days needed, site count and QMS scope
Notified body surveillance and re-audits	Paid directly by the provider. The 2021 impact assessment assumed yearly re-audits	Recurring every year while the certificate is valid. Driven by QMS changes and the number of systems under the certificate
Tooling and logging infrastructure	Paid by the provider to its own cloud, data centre or vendor for logging, version control, evidence storage and monitoring	Mostly recurring hosting and licences, plus one-time setup. Driven by log volume, retention periods and how much evidence is automated
Legal and regulatory advice	Paid by the provider to counsel for role classification, Article 6 scope questions and contract terms along the value chain	One-time for classification and contracts, occasional for reassessment. Driven by number of systems, roles held and cross-border reach
Substantial modification and reassessment	Provider pays again for a new conformity assessment when a change is substantial, except pre-determined changes documented in the initial assessment	Triggered event, not a fixed cycle. Driven by how much a system's behaviour or purpose changes and how well changes are pre-planned

How the assessment runs from scoping to market placement

The sequence turns a high-risk AI system into one that can lawfully reach the EU market, with each step producing a record that a market surveillance authority or notified body can check. The provider owns every step, and the route it takes depends on the system's Annex category.

Scope the system and its Annex category
The provider defines the system's intended purpose, its components and the decision it supports, then matches it to an Annex III category or an Annex I product route. This is done by the provider's product, legal and compliance owners, who should record the reasoning behind any Article 6(3) exemption they rely on. The output is a classification record that names the Annex point, the risk tier and the date that applies. Confirm the current application dates against the consolidated text as amended by Regulation (EU) 2026/1744 before fixing the project plan.
Confirm the conformity assessment route
Using the classification record, the provider determines whether internal control under Annex VI applies or whether a notified body must be involved. Most Annex III systems in points 2 to 8 follow internal control with no notified body. Biometric systems under point 1 depend on whether harmonised standards or common specifications were fully applied, and Annex I products follow their sectoral procedure. The output is a written route decision, signed off by the accountable executive, that names any notified body and the procedure it will apply.
Build or verify the quality management system
The provider establishes a quality management system covering the elements listed in Article 17, including design and development controls, data governance, risk management, post-market monitoring and incident handling. Where the organization already runs a quality or management system, it checks which elements can be extended. The output is a documented QMS with named owners, procedures and records. Teams should confirm how EN 18286:2026 on quality management, cited in the Official Journal, maps to their existing processes.
Prepare the technical documentation
The provider compiles the technical documentation that describes the system, its design, development, data, performance, risk controls and human oversight measures. Engineers and data scientists supply most of the content, while compliance staff check it against the Article 11 and Article 13 requirements. The output is a versioned technical file linked to the exact model and release being assessed. Any later substantial modification will need this file updated and reviewed again.
Run the internal check or the notified body review
Under Annex VI, the provider verifies its QMS against Article 17, examines the technical documentation against the requirements, and checks that design, development and post-market monitoring match what the documentation says. Where a notified body is required, under Annex VII it assesses the QMS and the technical documentation of each system and keeps the QMS under surveillance. The provider pays the notified body directly. The output is an internal assessment record or a notified body certificate, which lasts up to four years for Annex III systems and five years for Annex I systems.
Resolve findings and retest the affected evidence
The provider logs every gap found during the internal check or by the notified body, assigns an owner and fixes the cause rather than only the symptom. Each fix is retested, and the evidence is updated in the QMS and technical file. The output is a closed findings register with dated evidence for each resolution. Where a change alters the system in a way that counts as substantial, the provider must repeat the relevant conformity assessment before continuing.
Sign the EU declaration of conformity
Once the assessment is complete, the provider's authorized signatory signs an EU declaration of conformity for the system. The provider keeps this declaration for 10 years after the system is placed on the market or put into service. The output is a signed declaration that cites the assessment route and the technical file version it relies on.
Affix CE marking and register the system
The provider affixes the CE marking to the system, or to its documentation or packaging where the Act allows, in a physical or digital form. For Annex III systems, the provider then registers the system in the EU database before placing it on the market or putting it into service. The output is a CE-marked system and a database entry that a regulator can cross-check against the declaration.

How long a notified body certificate lasts and when it must be redone

A notified body certificate for a high-risk AI system is not permanent. Under Annex VII, the notified body assesses the provider's quality management system (QMS) and the technical documentation for each system, then keeps the QMS under surveillance for the life of the certificate. Under Article 44(2), a certificate lasts up to four years for Annex III systems and up to five years for Annex I systems. The provider should plan its renewal date from the day the certificate is issued, not from the day the system launches, because the surveillance audits and the renewal assessment both draw on the same QMS records and must find them current.

Two triggers force a new conformity assessment before the certificate would otherwise expire. The first is a substantial modification to the system, which under Article 43(4) requires a fresh assessment. The second is the exception for a continuously learning system: changes that were predetermined and documented in the initial assessment do not trigger reassessment. Providers should therefore write a change control procedure that classifies every model update, retraining run and feature change against the documented predeterminations, and should ask their notified body in writing how it will treat changes that fall outside those predeterminations. Changes that look minor to engineering may still be substantial under the Act, so the classification decision needs a named owner and a record.

The first harmonised standard, EN 18286:2026 on quality management, was cited in the Official Journal on 14 October 2026. A harmonised standard cited there gives a presumption of conformity for the elements it covers once the provider has applied it, so a QMS built to EN 18286:2026 can support the Article 17 requirements that a notified body reviews at each surveillance and renewal stage. The presumption covers only the QMS elements the standard addresses, not the technical documentation or the system's performance, and the reader should confirm with the notified body which parts of the standard it accepts as evidence before building the QMS around it.

What must be in place before the assessor arrives

An assessor, whether an internal control reviewer or a notified body, tests evidence, not intentions. The cards below set out what the provider should hold and verify internally before any outside party is engaged, because gaps found during assessment extend timelines and add cost.

Documented quality management system

Article 17 requires a documented quality management system covering the provider's strategy for regulatory compliance, design and development controls, testing and validation, data management, risk management, post-market monitoring, incident reporting, communication with authorities, record keeping and resource management. Under the Annex VI internal control route, the provider verifies this system itself. Check that each element has a named procedure, an owner and dated records showing it runs in practice, not only that it exists on paper.

Technical documentation for each system

Each high-risk system needs its own technical documentation that an assessor can examine against the Act's requirements. Confirm that the file covers the intended purpose, the design and development process, data governance, performance metrics, risk management outputs and the instructions for use. Test it by asking a team member outside the project to trace one requirement from the documentation to the running system.

Current inventory of high-risk systems

Assessors begin by confirming scope, so the provider needs a current register of every AI system it places on the EU market or puts into service, with its Annex and risk classification, version history and the date of each release. Reconcile the inventory against production deployments and procurement records. A system missing from the register is a scope finding, and an undocumented version change may trigger a new assessment after a substantial modification.

Logging and post-market monitoring records

Post-market monitoring and automatic logging must produce records that show how the system behaves after release, including performance drift, incidents and corrective actions. Check that logs are retained, tamper-resistant and linked to specific system versions, and that the monitoring plan defines what triggers review. Ask whether the records can answer an assessor's question about a specific period without manual reconstruction.

Named accountable owner

The provider should name one person with authority over conformity for each high-risk system, along with the people who own the quality management system, technical documentation and monitoring. Verify that this owner can sign the EU declaration of conformity, which the provider must keep for 10 years, and that the role is documented in the governance policy. Without a clear owner, evidence gathered by different teams rarely reconciles at the point of assessment.

Harmonised standards applied in full

Presumption of conformity under Article 40 applies only where a harmonised standard has been fully applied. Map each requirement of the Act to the standard you intend to rely on, record any clause you did not apply, and document the alternative solution with its justification. The first harmonised standard, EN 18286:2026 on quality management, was cited in the Official Journal on 14 October 2026, so confirm which standards are cited for your system before relying on them.

Who owns each part of the assessment

Your organization is the provider for a high-risk AI system it places on the EU market or puts into service, and the legal duty to complete the conformity assessment sits with you. Your team decides the intended purpose, owns the quality management system (QMS) that Article 17 requires, writes and maintains the technical documentation, and signs the EU declaration of conformity. No outside party can take those decisions off your desk.

Accountable owner: A named executive or function holds responsibility for the QMS and for the conformity decision.
QMS and policies: Your team defines the processes for design, data governance, testing, post-market monitoring and incident handling.
Technical documentation: Your team writes and keeps current the documentation that an assessor will examine, including changes after release.
Declaration and marking: Your team signs the EU declaration of conformity, affixes the CE marking and registers Annex III systems in the EU database.
Internal control work: For most Annex III systems, your team runs the Annex VI checks itself, so it needs people who can verify its own QMS against the documentation.

Ask your internal owner which decisions are documented as management decisions and which are delegated to a partner or assessor.

How to choose a notified body or implementation partner

Notified bodies issue certificates and implementation partners prepare your evidence, and the two roles must stay separate. The cards below set out the checks that keep both relationships clean, from designation status to fee terms and the scope of work you pay for.

Confirm AI Act designation for your category

Ask the body which AI Act categories it is designated for before discussing price. Biometric systems and Annex I product systems follow different routes, and a body that is accredited for one sectoral procedure may not yet be designated under the AI Act. For Annex I bodies, the designation deadline is 28 January 2028, so a body may not yet hold AI Act designation for the work you need. Ask for the designation reference in writing and check it against the official records before you contract.

Check independence from your consultant

The body that assesses your system must not be the firm that designed the QMS or wrote the technical documentation. Ask the notified body whether it has advised you on the same system, and ask your consultant whether it has any commercial tie to the body you selected. A clear separation protects the assessment's validity and avoids a finding that the evidence was not independently tested.

Get scope and fee basis in writing

Ask for a written statement of which systems, versions and documents the quote covers, and whether re-audits and surveillance are included. The Commission's 2021 impact assessment estimated documentation review at one to two and a half days, or EUR 3,000 to 7,500, and initial QMS audits at EUR 1,000 to 2,000 per day with yearly re-audits. Those figures are old and are a starting point, so request a quote that states days, rates and the number of systems covered.

Ask about SME fee relief

Article 62(2) requires conformity assessment fees to take account of SME providers' needs and to be reduced in proportion to their size and market. Ask the body how it applies this in practice, what documents it needs to confirm your size, and whether the reduction is reflected in the written quote. Do not assume relief applies until the fee schedule shows it.

Ask for the evidence they will request

Request the document list before the engagement starts: the QMS records under Article 17, the technical documentation, logs, risk management records and post-market monitoring plan. Ask how the body samples evidence, how it handles requests for additional information, and what happens if a finding requires a change to the system. A clear evidence list shows how much internal work the assessment will need.

Confirm the partner prepares, not certifies

An implementation partner can build the QMS, assemble technical documentation and prepare evidence, but only an independent notified body or, for internal control, the provider's own declaration under Annex VI can complete conformity. Get written confirmation that the partner does not issue certificates, attestations or declarations on the provider's behalf. The provider owns the declaration of conformity and the CE marking, and must keep the declaration for 10 years.

Questions buyers ask about EU AI Act conformity assessment

Do we need a notified body for our high-risk AI system?

Usually not. For most Annex III high-risk systems, including those used in employment, credit scoring, education and essential services, the provider follows internal control under Annex VI and no notified body is involved (Article 43(2)). A notified body is required for most biometric systems under Annex III point 1 unless the provider fully applied harmonised standards or common specifications, and for AI in Annex I Section A products that follow a sectoral procedure. Confirm your route by matching your system to its Annex III point or Annex I product law before you plan the budget, because the route determines who must review your documentation and quality management system.

What does an AI Act conformity assessment cost?

The cost depends on the route and the size of your evidence set. Under internal control, the largest costs are your own staff time, the work to build and test the quality management system and technical documentation, and any outside help you buy for readiness. Where a notified body is involved, it charges you directly. The Commission's 2021 impact assessment (SWD(2021) 84) estimated a notified body documentation review at one to two and a half days, or EUR 3,000 to 7,500, and an initial quality management system audit at EUR 1,000 to 2,000 per day, with yearly re-audits. Those figures are from 2021 and predate the 2026 amendments, so request a current written quote that separates review days, audit days, surveillance and re-audit fees.

How long does a conformity assessment take?

No supplied source gives a fixed duration for an AI Act assessment, so treat any timeline as an estimate you must confirm. The schedule is driven by how complete your quality management system and technical documentation already are, how many systems share one quality system, and how quickly a notified body can schedule its review. Notified body timelines also depend on designation status, and the Act requires notified bodies for some Annex I routes to apply for AI Act designation by 28 January 2028 (Article 43(3) as amended). Ask each notified body for its scheduling lead time and a written list of the documents it will review before you commit to a launch date.

Can we run the conformity assessment ourselves?

For most Annex III systems, yes. Under Annex VI the provider verifies its own quality management system against Article 17, examines its technical documentation against the requirements, and checks that design, development and post-market monitoring match that documentation. Your organization owns the declaration of conformity and the CE marking, and the obligation stays with you even if an outside party helps. Internal control still needs documented evidence, trained reviewers independent enough to test the work, and a clear record of each step. An implementation partner can prepare that evidence, but it cannot issue the conformity decision or the EU declaration.

What happens after a substantial change to our AI system?

A substantial modification triggers a new conformity assessment (Article 43(4)). The exception is a pre-determined change to a continuously learning system, provided it was documented in the initial assessment. Before you ship a change, decide whether it alters compliance with the requirements or the intended purpose, and record that decision. If the change is substantial, you repeat the assessment route that applied originally, and a notified body that holds a certificate must review the change. Build a change control step into your quality management system so engineers flag candidate changes early.

Does a consultant issue the AI Act certificate?

No. A consultant or implementation partner can prepare systems, documentation and evidence, but only a notified body issues certificates under the Act, and the provider signs the EU declaration of conformity. Where a notified body is required, its certificate is valid for up to four years for Annex III systems and five years for Annex I systems (Article 44(2)), and the notified body keeps the quality management system under surveillance. Before you hire anyone, confirm in writing which party signs each document, which evidence you own, and who answers questions from the notified body or market surveillance authority.

Which parts of the assessment can we outsource?

Outsourcing works best for preparation work that you can check yourself: gap analysis against Article 17 and the technical documentation requirements, drafting the quality management system procedures, building the evidence repository, and running internal audits before the formal review. Keep the decisions that the Act assigns to you, including the risk classification, the intended purpose, sign-off on the declaration, and the CE marking. Ask any outside party for a written scope with deliverables, named roles and an agreed handover, so the assessment file can be defended without them in the room.

Do fees differ for small and medium-sized providers?

Yes, in principle. Article 62(2) requires that conformity assessment fees take SME providers' needs into account and are reduced in proportion to their size and market. Before you budget, ask the notified body how it applies that rule, what documentation it needs to verify SME status, and whether any reduction applies to your system count. The Act does not set a fixed discount, so the difference is something you must negotiate and confirm in the written quote.

How DeployOpen prepares your system and evidence for assessment

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems and evidence behind a high-risk AI system are ready for the conformity route that applies to it. We prepare systems and evidence only. Your organization owns its controls, and an independent notified body or internal assessment process reaches the conformity decision.

How we scope

Written scope fixes which AI system, Annex category and conformity route the engagement covers before work starts.
Scope lists the quality management system elements, technical documentation sections and logging components to be prepared.
Engagements are fixed-scope, with deliverables and timelines agreed in writing and a quote following from that scope.

How we build

We deploy and harden the open-source platforms that host the AI system, its logging, access controls and monitoring within your environment.
We configure record-keeping and post-market monitoring so the evidence an assessor examines is generated during operation.
We test the system and its controls against the documented requirements and record the results for the assessment file.

How we hand over

You receive technical documentation, configuration records, test results and the QMS artifacts mapped to the assessment route.
We walk your team and your assessor through the evidence set so your staff can explain and maintain it after handover.
Declaration of conformity, CE marking and EU database registration are decided and executed by your organization, not by DeployOpen.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
Retainers can cover re-testing after a substantial modification, which triggers a new conformity assessment under the Act.
Ask us to confirm in writing which assessment activities remain with your organization, your notified body or your internal process.