Which conformity assessment route does your high-risk AI system follow?
For most high-risk AI systems, the provider picks the route and carries the assessment itself. Article 43 sets three possible routes: internal control under Annex VI, notified body assessment under Annex VII, or the sectoral procedure that applies to AI embedded in regulated products listed in Annex I. Most systems listed in Annex III, points 2 to 8, follow internal control, so no notified body is involved. Biometric systems under Annex III, point 1 are the main exception, and the choice there depends on whether the provider has applied the harmonised standards or common specifications. Only an independent notified body issues certificates where one is required, so the route decision determines whether outside certification is part of your plan at all.
Article 43 exists because a self-declared claim of compliance is not enough for systems that can affect people's health, safety or fundamental rights. The article forces each high-risk system through a documented assessment before it reaches the market, and it defines who checks the evidence. The hard part is the route choice itself, because it depends on the Annex III point, whether a harmonised standard was fully applied, and whether the system is a safety component of a product covered by other EU legislation. Write that reasoning down with the Annex and point number before you commit budget or sign a contract with any body. Confirm the classification with your legal team, because a wrong route means redoing the assessment.
Under internal control, your organization verifies its quality management system against Article 17, examines the technical documentation against the Section 2 requirements, and checks that design, development and post-market monitoring match that documentation. Under the notified body route, an accredited body performs the examination you would otherwise run yourself, and it may ask for access to source code and training data. Under the sectoral route, the AI Act requirements are assessed within the product legislation's own procedure. Whichever route applies, you own the assessment, the declaration and the records. Ask any implementation partner to prepare the evidence and gap analysis, and ask any notified body to confirm in writing which Annex it will apply and when it can start.
Which systems take which route
Article 43 does not give every high-risk system the same assessment. Five scoping decisions decide whether a provider works through internal control, brings in a notified body, or follows a sectoral procedure, and each one changes the evidence and the schedule. Check them in order before you plan the work.
Biometric systems in Annex III point 1
Annex III point 1 covers remote biometric identification, biometric categorisation and emotion recognition. For these systems Article 43(1) gives the provider a choice: internal control under Annex VI, or assessment by a notified body under Annex VII. The choice only exists if harmonised standards or common specifications were applied. Confirm that before you commit to internal control, because the choice depends on it.
Annex III points 2 to 8
Most Annex III high-risk systems, including those in employment, credit, education and public services, fall under Article 43(2). That route requires internal control under Annex VI and involves no notified body. The provider verifies its quality management system, examines the technical documentation and checks that design and post-market monitoring match what is documented. The work stays in-house, but the evidence must still be complete and dated.
Harmonised standards fully applied
Whether the provider applied harmonised standards or common specifications in full is the input that decides the biometric route. Partial application counts as no application under Article 43(1), which pushes the system to a notified body. Map each requirement to the standard clause that covers it and record gaps. A partial mapping is a finding an assessor will ask about.
Annex I Section A products
When the AI system is a safety component of, or is itself, a product covered by the Union harmonisation legislation listed in Annex I Section A, Article 43(3) applies the sectoral procedure. That procedure covers the AI Act requirements together with a quality management system assessment, and the sectoral legislation sets its own steps. Ask the sectoral conformity body early which AI Act evidence it will review.
Substantial modification
Article 43(4) requires a new conformity assessment after a substantial modification. The exception is a pre-determined change to a continuously learning system, but only where that change was documented in the initial technical documentation. Any change to intended purpose, model or behaviour should be assessed against that test before release. Record each decision, because the answer determines whether the route must be run again.
Deployers who become providers
A deployer that modifies a high-risk system's intended purpose, or puts its own name or trademark on it, can become its provider. The new provider then inherits the assessment duty and must follow the route that applies to the system, not the one the original vendor used. Check contracts and product changes against Article 25 before the system goes live under your name.
How an assessor tests the chosen route
This table compares what an assessor examines under each conformity route, from the quality management system to the technical file and the assessment file. Read it by first confirming which route applies to your system, then checking the evidence the assessor will ask for under that route.
| Check | Internal control (Annex VI) | Notified body (Annex VII) |
|---|---|---|
| Route selection | Confirm the system falls under Annex III points 2 to 8, or under biometric point 1 with full harmonised standard application | Confirm the system is biometric under point 1 without full standard application, or is an Annex I product requiring a notified body under its sectoral law |
| Quality management system | Assessor verifies the QMS against Article 17 using your documented procedures and records | Notified body audits the QMS against Article 17 on site and reviews records of how it operates in practice |
| Technical documentation | Provider examines the file against the Section 2 requirements of Chapter III | Notified body reviews the technical documentation against the same Section 2 requirements and may request clarifications |
| Design and development match | Verify that the design, development and post-market monitoring match what the documentation describes | Notified body samples the running development and monitoring activity and compares it with the filed documentation |
| Harmonised standard records | Dated records showing which harmonised standards or common specifications were applied, and where partial application was used | Same records, plus a reasoned explanation of any standard not applied, since partial application may trigger Annex VII |
| Substantial modification records | Change log tying each modification to a documented assessment and a new conformity assessment where required | Notified body reviews the modification history and confirms whether a new assessment was needed |
| Common findings | Wrong route chosen, missing standards application records, undocumented substantial modifications, documentation that lags the deployed system | Incomplete assessment file, unclear scope of the notified body application, changes made without notice, and gaps between audit samples and records |
| Certificate status | No certificate issued, but the declaration of conformity and file must remain available to authorities | Certificate valid for up to five years (Annex I) or four years (Annex III), subject to reassessment, confirm with the notified body |
How to run the assessment in sequence
The sequence turns Article 43 from a legal question into a dated set of outputs: a confirmed route, mapped standards, a working QMS and technical file, a verified or notified-body-reviewed assessment, a recorded decision and a reassessment trigger. Each step closes with something the provider can hold and show an authority.
Confirm the system and its Annex route
Start by fixing the exact system under assessment: its intended purpose, its Annex III point or Annex I product legislation, and whether it is a biometric system under Annex III point 1. Legal or compliance leads own this decision, with product owners supplying the facts. The route follows from it: Annex VI internal control for most Annex III systems under Article 43(2), the Annex VI or Annex VII choice for biometric systems under Article 43(1), and the sectoral procedure for Annex I products under Article 43(3). You hold a one-page route memo signed by the accountable owner, naming the system version, the article relied on and the reasons for any choice of procedure.
Map the applicable harmonised standards
List every harmonised standard or common specification that applies to the system and record how far your implementation follows each one. This matters for biometric systems, where Article 43(1) turns on whether harmonised standards or common specifications were applied, and partial application can push the route toward notified body assessment. Confirm current citation status in the Official Journal and in the Commission's implementing decision on harmonised standards, since the first standard on quality management was cited in October 2026. You hold a standards register showing each standard, its status and any gaps, reviewed by compliance and engineering.
Build the quality management system
Document the QMS that Article 17 requires and put it into operation across design, development, testing, data management, risk management, post-market monitoring and incident handling. Engineering and quality owners write the procedures, and records must show the procedures are used, not only written. The output is an approved QMS manual, procedure set and a first cycle of records such as design reviews, test reports and change approvals. Ask whether your organization's existing ISO-based management system can be extended, but confirm with your assessor that it covers every Article 17 aspect.
Compile the technical documentation
Assemble the technical documentation that examines the system against the Section 2 requirements of Chapter III, covering the general description, design and development, data governance, monitoring, performance, risk management and change history. Product, data science and security teams each supply sections, and a single owner checks cross-references. Version control matters here because the documentation must match what is deployed. The output is a versioned technical file with a traceability index that links each requirement to the evidence that satisfies it.
Perform the internal control verification or prepare the notified body file
For internal control, the provider verifies the QMS against Article 17, examines the technical documentation against Section 2, and checks that design, development and post-market monitoring match that documentation, as Annex VI describes. Compliance staff who did not build the system should run this review so the check is independent. For notified body routes, prepare a complete application file and select a body designated for the relevant scope, then answer its questions through the review. The output is a signed internal verification report with findings closed, or a notified body application with its review record.
Record the decision and the declaration inputs
Record the assessment outcome in a decision record approved by an accountable executive: the route followed, the evidence reviewed, open findings and their closure, and the approver and date. This record feeds the EU declaration of conformity and CE marking steps covered on sibling pages, and it must match the technical file version. Where a notified body issued a certificate, the record should hold the certificate and its validity dates. The output is a signed decision record that a regulator can trace back to the exact documentation and route chosen.
Set reassessment triggers for changes
Define in writing which changes require a new conformity assessment. Article 43(4) requires one after a substantial modification, and the only exception covers pre-determined changes of a continuously learning system that are documented in the initial technical documentation. Engineering and compliance should agree the criteria in advance, route every change request through them, and log the decision for each change. The output is a change-control rule set and a register showing, for each release, whether reassessment was needed and why. For notified body certificates, also track the validity period set under Article 44 and the renewal date.
How long a notified body certificate lasts and when to reassess
Under Article 44(2), a notified body certificate for a high-risk AI system is valid for at most five years for systems covered by Annex I and at most four years for systems covered by Annex III, and it can be renewed after a reassessment. Note that the validity period is a ceiling set by the regulation, not a term the notified body must grant in full. The notified body sets the actual expiry in the certificate, so check the date printed on it rather than assuming the maximum. Calendar the renewal well before expiry, because reassessment requires your technical documentation, quality management system records and post-market monitoring evidence to be current.
Article 43(4) requires a new conformity assessment after a substantial modification to a high-risk system. The regulation's exception covers pre-determined changes to a continuously learning system, but only where those changes were documented in the initial technical documentation and assessed at that time. Practically, this means defining the allowed changes in advance: what may change, within what limits, how performance will be re-verified and who approves each update. Any change outside that documented envelope should be treated as presumptively substantial until counsel or the notified body confirms otherwise.
For every change, record a written substantiality decision before release. Capture the change description, the affected components of the system, whether it alters the intended purpose or the risk profile, the test results compared with the assessed baseline, the reviewer and the date. Keep that record with your quality management system documentation so an authority or notified body can trace the reasoning. Confirm the test and its boundaries with qualified legal counsel and, where practical, with your notified body, because the threshold for a substantial modification depends on the facts of your system and the current guidance, which should be verified against the consolidated text of the Regulation.
Evidence that passes a conformity assessment
A conformity assessment, whether internal control under Annex VI or a notified body review under Annex VII, comes down to documents the provider can produce on request and show are current. The cards below cover each artifact an assessor is likely to ask for, and how to keep it accurate between assessments rather than rebuilding it at audit time.
Quality management system records
Under Annex VI, the provider verifies its quality management system against Article 17, so the QMS documentation itself is the first thing an assessor reads. Keep the policies, procedures and the verification records that show each procedure was actually run, such as design reviews, test sign-offs and change approvals. Check that every procedure names an owner and that the records carry dates, so the file shows the QMS operating, not just described.
Technical documentation set
The examination of technical documentation against the Section 2 requirements is the core of an internal control assessment. The set should map each requirement to the document and the test result that supports it, and cover the system's intended purpose, design choices, data and training, and performance limits. Confirm that the version in the file matches the version actually deployed.
Harmonised standards applied record
Article 43(1) turns on whether the provider applied harmonised standards or common specifications, so a dated record of which ones were applied, to which parts of the system, and where any part was applied only partially is decisive. Partial application pushes biometric systems toward notified body assessment. Ask the provider's standards owner to keep this record current as standards are cited and revised.
Internal control assessment record
For Annex III points 2 to 8, and for biometric systems where the provider chose internal control, the assessment record documents the three verifications in Annex VI: the QMS check, the technical documentation review, and confirmation that design, development and post-market monitoring match the documentation. Sign and date it, and record who performed each check. Without this record, the declaration of conformity has nothing to point to.
Notified body reports and certificates
Where Annex VII applies, the notified body's assessment reports, decisions and certificates become core evidence, and the certificate has a fixed validity period. Calendar the expiry date and the reassessment window, and keep the notified body's correspondence with the technical file. Confirm with the notified body what it needs from you before each reassessment, since the review scope and fees are set in its own agreement.
Modification assessments and declaration link
Each substantial modification requires a new conformity assessment, so keep a dated change log that records whether each change was substantial and, if so, the reassessment that followed. Link every assessment record to the EU declaration of conformity it supports, and confirm the declaration is reissued when the basis for it changes. Pre-determined changes to a continuously learning system must be documented in the initial technical documentation to fall outside a new assessment.
What a conformity assessment costs in money and effort
This table breaks down the cost components of an Article 43 conformity assessment, marking which are one-time and which recur, and what drives each one up or down. Read it as a checklist of what to ask for in a quote. The main takeaway is that the route you follow sets whether a notified body fee applies at all, while documentation maturity and change frequency drive most of the effort.
| Cost component | Who is paid or who does the work | One-time or recurring | What drives it |
|---|---|---|---|
| Internal engineering and compliance time for the QMS and technical documentation | Your own staff, or an implementation partner preparing systems and evidence | One-time, then recurring upkeep | Number of systems in scope, how mature your existing ISO or sectoral QMS is, and how much evidence is already generated automatically |
| Legal review of scope and substantial modifications | Internal legal or external counsel | Recurring, at each significant change | How often the system is retrained, updated or repurposed, and whether changes are pre-determined and documented in the initial technical documentation |
| Notified body fees (where the route requires them) | Notified body, paid by the provider | One-time assessment, then periodic reassessment | Whether the system is a biometric system under Annex III point 1 without applied harmonised standards, or an Annex I product; ask for the fee basis in writing |
| Auditor or assessor time for internal-control routes | Internal staff or an independent assessor you engage for readiness review | Optional, usually one-time before the declaration | Documentation maturity and the number of gaps found in a readiness review; independent auditors and certification bodies, not DeployOpen, issue reports or certificates |
| Certificate reassessment and renewal | Notified body | Recurring, every five years for Annex I and four years for Annex III under Article 44(2) | Certificate validity period and any changes made since the last assessment; confirm the renewal scope with the notified body |
| Change assessment after substantial modification | Internal team and, where the route requires it, the notified body | Recurring, event-driven under Article 43(4) | Frequency of model or system changes; pre-determined changes of a continuously learning system documented up front may avoid a new assessment |
| SME fee relief | Notified body fee schedule | Applies to the fee lines above | SME status. Article 62(2) requires fees to take account of SME needs and reduce them in proportion to size and market, so ask for the reduced fee calculation |
| Open-source tooling and licence spend | Software vendor or open-source community; hosting in your own infrastructure | Recurring hosting and support, one-time setup | Self-hosted tools such as CISO Assistant (AGPL-3.0-only), XWiki (LGPL-2.1-or-later) and BookStack (MIT) can replace some paid GRC and documentation licences; confirm each tool's fit with your evidence needs |
Who owns the assessment, who prepares it, and who certifies it
The organization that places a high-risk system on the EU market, or puts it into service under its own name, is the provider and owns the conformity assessment decision. Under Annex VI the provider carries out the internal control procedure itself. Under Annex VII the provider still lodges the application and remains responsible for the system, the quality management system and the technical documentation. Your team decides which route applies, signs the EU declaration of conformity and supplies the inputs for CE marking.
- Route decision: record in writing which Article 43 route applies to each system, based on its Annex III point, whether harmonised standards or common specifications were fully applied for biometric systems, and whether it is an Annex I product.
- Accountable owner: name a person with authority to approve the quality management system, the technical documentation and the declaration.
- Declaration and marking: sign the EU declaration of conformity and decide the CE marking inputs, including any notified body number.
- Reassessment triggers: own the change process that flags substantial modifications, because Article 43(4) requires a new assessment after one.
Check that you can name the owner of each route decision and produce the decision record for an assessor on request.
An implementation partner such as DeployOpen prepares systems, controls and evidence inside your environment. It can configure the records the assessment will sample, organize the technical documentation and assemble the file package a notified body needs. The partner does not issue assessments, certificates or the declaration of conformity. Those remain with your organization and with the independent body.
- Quality management evidence: draft procedures, records and version histories that show the Article 17 quality management system is operating, with a named owner for each document.
- Technical documentation: assemble the evidence for the Section 2 requirements and check that it matches the system as deployed.
- Internal control records: set up test results, review minutes and monitoring outputs that an Annex VI verification will sample.
- Notified body file package: organize documents, source artifacts and a change log for Annex VII review.
- Evidence tooling: configure self-hosted tools such as CISO Assistant to track control assessments, and wiki or documentation platforms to hold controlled documents with version history.
Ask for a written scope that lists each artifact the partner prepares and each one your staff keeps, and confirm whether the chosen tools cover the AI Act requirements you need.
Independent assessment comes from a notified body. Under Article 43, notified bodies are involved for certain biometric systems where Annex VII applies, and for Annex I products under the sectoral procedure. Systems under Annex III points 2 to 8 follow internal control under Annex VI and do not involve a notified body. Market surveillance authorities supervise all high-risk systems and can request documentation later, whatever route was used. Only the notified body issues certificates.
- Scope of review: under Annex VII the notified body assesses the quality management system and the technical documentation, so confirm in advance what it will sample and how.
- Certificate validity: under Article 44, certificates last at most five years for Annex I systems and four years for Annex III systems, and are renewable after reassessment.
- Designation status: as amended, notified bodies under sectoral legislation must apply for AI Act designation by 28 January 2028, so verify the designation scope before engaging any body.
- Fees: Article 62(2) requires the specific needs of SME providers to be considered, with fees reduced in proportion to size and market, so ask how the body applies this.
- Authority access: expect market surveillance authorities to be able to review the file, including for systems assessed internally.
Before signing an engagement, confirm that the body's designation covers your system and ask for its written assessment plan.
Where conformity assessments usually fail
Most Article 43 problems are not technical. They come from routing decisions made early, records that were never kept, and documentation that drifts away from the system in production. The cards below cover the failure points we see most often, each with the check that closes it before an assessor finds it.
Internal control chosen for a notified body system
Article 43(1) lets a provider of an Annex III point 1 biometric system choose internal control only if it applied the relevant harmonised standards or common specifications in full. Partial application, or no application, pushes the system into Annex VII notified body assessment. Teams often pick Annex VI first and document the routing decision afterward. Check the route against the Article 43 text before any technical file work begins, and record the reason in writing.
Harmonised standards applied but not tracked
A presumption of conformity depends on which harmonised standards or common specifications were actually applied, and to which clauses. Teams that do not keep a mapping between each requirement and the standard clause that satisfied it cannot show an assessor how they got there. Build a register that lists each standard, its version, the clauses applied, and any gaps left open. Update it whenever a standard is cited or revised.
Model updates treated as non-substantial
Article 43(4) requires a new conformity assessment after a substantial modification. The exception for pre-determined changes applies only to a continuously learning system whose planned changes are documented in the initial technical documentation. A retrained model, a new data source or a changed intended purpose can each cross that line. Keep a written change assessment for every release that records why the change was or was not substantial, and who signed off.
Certificate expiry missed
Under Article 44(2), notified body certificates are valid for at most five years for Annex I systems and four years for Annex III systems, and they can be renewed only after reassessment. Renewal work takes time, and a lapsed certificate can leave a system without a valid basis for its market presence. Put the expiry date in the compliance calendar with reminders that start well before it, and confirm the notified body's reassessment schedule early.
Documentation that does not match production
Under Annex VI, the provider must verify that design, development and post-market monitoring match the technical documentation. Assessors test this by comparing the documents against the running system, its logs and its release history. Drift appears when models are redeployed, thresholds are tuned or data pipelines change without a document update. Version the technical file alongside the code and model artefacts, and run a periodic reconciliation between the two.
Conformity assessment questions buyers ask
Can we run the internal control conformity assessment ourselves?
Yes, for most Annex III systems your organization can run the assessment itself. Article 43(2) requires the internal control procedure in Annex VI for Annex III points 2 to 8, and that procedure involves no notified body. Point 4 covers employment, workers management and access to self-employment, so recruitment, promotion and task allocation tools usually fall here. As the provider, you must verify your quality management system against Article 17, examine the technical documentation against the Section 2 requirements, and confirm that design, development and post-market monitoring match that documentation. You still own the outcome and sign the declaration. An implementation partner can prepare systems and evidence, and independent help is optional. Confirm the Annex III point your system falls under before you start, because biometric systems under point 1 follow a different route.
What does a conformity assessment need from our engineering and compliance teams?
The work needs named owners, a documented quality management system and technical documentation that stays current. In practice, that means four things:
- A quality management system that covers the Article 17 aspects, with records that show it operates.
- Technical documentation that addresses each Section 2 requirement for the specific system.
- Evidence that design, development and post-market monitoring match what the documentation says, such as test results and change records.
- Sign-off from people who can answer questions from market surveillance authorities.
The effort depends mostly on how much of this already exists. Version-controlled wikis such as XWiki keep a record of what changed, when and by whom, which helps with the change trail. Access roles in tools such as BookStack help control who can edit approved documents. Ask your team to inventory existing documents before estimating effort, and confirm whether your chosen compliance tooling includes an AI Act framework in the version you plan to run.
How long is a conformity certificate valid for a high-risk AI system?
Notified body certificates are valid for at most five years for Annex I systems and at most four years for Annex III systems, and they can be renewed after reassessment, under Article 44(2). The notified body sets the actual period within that limit, so confirm it in the certificate. Internal control under Annex VI does not produce a notified body certificate, so there is no expiry date to track for most Annex III systems. Instead, the obligation is to keep the EU declaration of conformity and the technical documentation current and available to authorities. Article 18 sets the retention period for these records, and you should check its current wording before setting your retention schedule. Any substantial modification restarts the assessment question, which is covered in the next answer.
When does a model change trigger a new conformity assessment?
A new conformity assessment is required after a substantial modification, under Article 43(4). The main exception covers pre-determined changes to a continuously learning system, provided those changes were documented in the initial technical documentation. A retrained model is not automatically a substantial modification, so the test is whether the change affects compliance with the Section 2 requirements or alters the system's intended purpose. Check the definition of substantial modification in Article 3 and record your decision for each change. Keep a dated change log that links each model version to its test results and documentation updates. If a change falls outside the pre-determined changes, plan for a fresh assessment before the modified system is placed on the market or put into service.
Do we need a notified body for an Annex III point 4 system?
No. Annex III point 4 covers employment and workers management, and Article 43(2) assigns those systems to the internal control procedure in Annex VI, which involves no notified body. Notified body assessment applies in other cases. Biometric systems under Annex III point 1 need one where harmonised standards or common specifications were not applied, or were only partly applied, and Annex I products follow the sectoral procedure. Check two things before you rely on this answer: whether the same system is also a product covered by Annex I, and whether another EU law that applies to your product requires third-party involvement. Under the 2026 amendment, the high-risk rules for Annex III systems apply from 2 December 2027, so plan your evidence work against that date.
How much does an AI Act conformity assessment cost?
No price can be stated from the supplied facts, so the reliable answer is to understand the cost drivers and ask for a written scope. For an internal control route, most spend goes to staff time, documentation, testing and any external support. A notified body route adds the body's assessment fees, which are separate from implementation work. Article 62(2) requires that the specific needs of SME providers be taken into account in conformity assessment fees, reducing them in proportion to size and market. Costs that recur include reassessment after substantial modification, documentation upkeep and post-market monitoring. Drivers include the number of systems, how mature your documentation is and the scope of the assessment. DeployOpen does not publish a price list. Most engagements are fixed-scope, and a quote follows from the written scope, which should list deliverables, roles, what your team keeps, exclusions and any retainer terms. DeployOpen prepares systems and evidence; it does not issue assessment reports or certificates.
How DeployOpen prepares conformity assessment evidence
DeployOpen does not issue audit reports, attestations or certifications, and it does not decide which conformity assessment route applies to your system. The provider owns that decision and the resulting obligations. DeployOpen's role starts with a fixed-scope engagement agreed in writing before work begins. The written scope names the AI system, the Annex route the provider has determined (internal control under Annex VI, notified body assessment under Annex VII, or the sectoral procedure for Annex I products), the harmonised standards or common specifications the provider intends to rely on, and the deliverables. Before signing, confirm with your legal and compliance team which route applies, because a biometric system under Article 43(1) can take either path depending on whether harmonised standards were applied in full.
Once the route is fixed, DeployOpen maps each Article 43 requirement to the evidence your organization must hold and to the systems that produce it. For an internal control route, that means a quality management system checked against Article 17, technical documentation checked against the Section 2 requirements, and records showing that design, development and post-market monitoring match the documentation. The work is performed inside your own cloud accounts, data centers or air-gapped networks, using self-hosted tools such as CISO Assistant for assessment tracking and a wiki or knowledge base with version history for controlled documents. Your staff keep ownership of the approvals, the sign-off and the access rights to each tool. Ask any partner to confirm in writing which tools your team will administer after handover.
The output is a prepared evidence file that your chosen independent assessor or notified body can review, along with a list of open gaps and the decisions that remain with you. Ask for the file index, the version history of each controlled document and a record of who approved what. Plan for reassessment as well: a substantial modification triggers a new conformity assessment under Article 43(4), so the written scope should state how change records and the documentation baseline will be kept current after handover. The independent assessor decides whether the evidence supports conformity, and that decision, not DeployOpen's preparation, is what a customer or regulator will rely on.
