What the EU declaration of conformity and CE marking prove about a high-risk AI system
A signed declaration of conformity is the provider's own written claim that a high-risk system meets the Section 2 requirements. Before a high-risk AI system is placed on the EU market, someone at the provider must sign that claim under Article 47, and the system must carry the CE marking under Article 48. The declaration must be written, either machine-readable or physically or electronically signed, kept for 10 years, and produced for authorities on request. One declaration can cover every applicable Union law, so the provider does not write a separate statement for each piece of legislation. Article 48 applies the CE marking principles of Article 30 of Regulation (EC) No 765/2008. For a system provided digitally, the digital CE marking must be easily reachable through the interface or a machine-readable code.
The risk is a claim that the provider cannot support. A false or unsupported declaration misleads buyers who rely on the mark, deployers who build their own duties on it, and market surveillance authorities who may act on it. Where a notified body was involved, the CE marking must be followed by that body's identification number, and the same number must appear in promotional material that claims CE compliance. Confirm with counsel which conformity route applies to your system before you draft anything, because the route determines whether a notified body number is needed at all.
The declaration is only as strong as the technical file behind it. Every statement in the declaration, including the Annex V information and the claim of Section 2 compliance, must trace to evidence on the risk management, data governance, logs, quality management and documentation that already exists and has been checked. Assign a named signatory with authority to bind the provider, and set a release gate in which the declaration is not signed until the evidence has been reviewed. Keep the declaration, its version history and the evidence set it cites under the same retention plan, since the 10-year period applies to the declaration and must outlast any product release.
Which systems and roles the declaration and CE marking apply to
The declaration and CE marking apply only once a system is high-risk and a party has taken on the provider role. Four scoping questions decide who signs, which route applies and when the work falls due, so settle them before building the file.
Who signs as provider
The declaration is issued by the provider, the party that develops a system or has it developed and places it on the market or puts it into service under its own name. Under Article 25, a deployer, importer, distributor or other party that changes the intended purpose of a system or substantially modifies it can become the provider, and then inherits the declaration and CE marking duties. Check early whether your customisation or rebranding crosses that line, because the original provider's paperwork will not cover it.
Annex III or Annex I route
Annex III systems, such as those used in employment, credit or education, are high-risk through their use case, while Annex I systems are product-safety components or products covered by Union harmonisation law. The routes differ in who assesses conformity and in timing. Establish which route applies to each system, because a single product can fall under both.
Application dates set the timing
As amended in 2026, the high-risk rules in Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems. Those dates set when a declaration must exist before the system is placed on the market. Confirm the dates against the consolidated text, and plan the declaration as a release gate for each system rather than a one-off project near launch.
Digitally provided systems
For systems provided digitally, Article 48 requires a digital CE marking that is easily accessible through the interface or a machine-readable code. This means the marking must be built into the product's user interface, documentation or API metadata, not only printed on packaging. Ask engineering to define where the marking appears and how a user or authority can reach the declaration from it.
Internal control or notified body
Most Annex III systems follow internal control under Annex VI, where the provider assesses its own system and issues the declaration. Article 43 requires a notified body for some biometric systems and for certain Annex I products, and the notified body's identification number then appears after the CE marking. Confirm the route with the national market surveillance authority or a qualified adviser before committing budget, because choosing the wrong route can invalidate the declaration.
Ownership of the declaration file
The provider must keep the declaration for 10 years after the system is placed on the market or put into service, and produce it to authorities on request. Decide who in your organisation holds the signed original, the version history and the link to the technical documentation. An implementation partner can prepare the evidence, but only the provider signs, and the signed record must remain accessible for the full retention period.
How an assessor tests the declaration and CE marking
A notified body reviews the declaration as part of the conformity assessment for systems that require one, and it checks that the declaration matches the assessment it relies on. The reviewer reads the declaration against the Annex V content list, confirms that the system name, version and provider details match the technical file, and traces each statement that the system meets the Section 2 requirements back to the evidence behind it. Where a notified body was involved, the reviewer also checks that its identification number appears with the CE marking.
- Content match: Each Annex V element is present, and the system identifier, version and intended purpose agree with the technical documentation.
- Signature and date: The declaration is signed by an authorised person, dated, and tied to the version of the system assessed.
- Trace to the technical file: Each claim points to a section of the technical file, a test report or a quality management record.
- Notified body number: The identifier is shown after the CE marking and repeated in any promotional material that claims CE compliance.
- Retention: The provider can show the declaration is kept for 10 years and can be produced on request.
Confirm with the notified body which version of the declaration it reviewed, and keep that version under change control so a later edit does not silently break the link to the assessment.
A market surveillance authority asks for the declaration when it checks a system on the market, and it does so without a prior notified body review. The authority reads the declaration as a standalone statement of responsibility, so it looks for completeness and internal consistency. It tests whether the provider can produce the declaration promptly, whether it covers all Union law that applies to the product, and whether the CE marking and digital marking are placed where a user can find them.
- Completeness: The declaration names every applicable Union law, not only the AI Act, so a missing law is a common finding.
- Signature and version: An unsigned, undated or unversioned declaration is treated as no declaration.
- Production on request: The provider can supply the declaration and its supporting file within the time the authority sets.
- Digital marking: For a system provided through an interface, the CE marking is easy to reach from that interface or through a machine-readable code.
- Consistency: The declaration, instructions for use and marketing claims describe the same system and the same conformity route.
Ask counsel to confirm the national authority's expectations for production timing and format before the first request arrives.
Providers using the internal-control route under Annex VI prepare the declaration themselves, so an internal reviewer, often in quality or compliance, acts as the first line of assessment. The review is a pre-release gate: it confirms the declaration can be signed on the basis of records that already exist, and it blocks release if the declaration describes evidence that has not been produced. Internal reviewers should test the declaration as an outside assessor would, starting from the claims and working back to the records.
- Claim-by-claim trace: Each statement in the declaration links to a named record in the technical file or quality management system.
- Scope check: The reviewer confirms that every applicable Union law is listed and that no product variant is missing from the declaration.
- Version lock: The declaration is tied to a specific build or release, and a substantial change triggers a new review.
- Marking check: The CE mark is present on the product or interface, and no notified body number is shown unless a notified body was involved.
- Retention test: A sample request retrieves the signed declaration and its records from the retention store within a short, agreed time.
Keep the review record itself as evidence, since assessors often ask who checked the declaration and when.
Steps to produce a compliant declaration and CE marking
The sequence below takes a high-risk system from a confirmed conformity route to a signed, stored EU declaration of conformity with the CE marking applied. Each step names the output that lets the next one begin, so gaps surface before signature rather than during an authority request.
Confirm the conformity assessment route
Before anything is signed, the provider confirms which conformity assessment route applies to the system: internal control under Annex VI, notified body assessment under Annex VII, or the sectoral procedure for Annex I products. Legal or compliance staff make this call with the product owner and document the reasoning. The output is a short classification record that names the route and the Annex or Article relied on. If a notified body is required, the record also names the body and the assessment it has completed, because the declaration and CE marking depend on that outcome.
Map Section 2 requirements to evidence
The provider takes each requirement in Chapter III Section 2 that applies to the system and links it to the evidence that shows it is met, such as risk management records, data governance documents, technical documentation, logging design, accuracy and robustness test results, and human oversight measures. Engineering owns the technical evidence and compliance owns the register. The output is a traceability matrix in which every requirement points to a named, versioned artefact. Any requirement without evidence is a blocking gap that must be closed or escalated before the declaration is drafted.
Draft the declaration against Annex V
The provider drafts the EU declaration of conformity using the content listed in Annex V: the system identification, the provider and any authorised representative, a statement that the declaration is issued under the provider's sole responsibility, the statement that the system meets the Section 2 requirements, references to the harmonised standards, common specifications or other documents applied, and the notified body details where one was involved. Compliance drafts the text and checks each Annex V element against the matrix from the previous step. The output is a draft that a reviewer can tick line by line against the Annex.
Obtain internal sign-off and signature
Accountable executives review the draft, the traceability matrix and the conformity route record, then approve the declaration. The declaration may be signed physically or electronically, and it must be written and machine-readable. The provider records who signed, the date, and the version of the system it covers. The output is a signed declaration held in the controlled document repository with its approval trail. Where one declaration covers several Union acts, the sign-off record should show that every applicable act was checked before signature.
Translate the declaration where needed
The provider confirms the languages the declaration must be provided in for each Member State where the system is placed on the market or put into service, and produces the translations from the approved English or source text. Legal review checks that the translated versions keep the same meaning as the signed original. The output is a set of language versions, each linked to the signed source version and dated, so that an authority asking for a specific language receives a document that matches the original.
Affix the CE marking to the system or interface
The provider applies the CE marking under the principles of Article 30 of Regulation (EC) No 765/2008, either physically on the system or its packaging or, for digitally provided systems, as a digital CE marking that is easily accessible through the interface or a machine-readable code. Product and engineering teams test that the marking is visible and reachable in the shipped build or the live interface. The output is a dated test record with screenshots or the code location, plus the labeling specification that will be reused for future releases.
Add the notified body number where applicable
If a notified body took part in the conformity assessment, the provider places that body's identification number directly after the CE marking. The same number must appear in promotional material that claims CE compliance. Marketing and sales teams check their collateral against a list of approved claims before publication. The output is a verified number on the marking and an approved list of materials where it appears. If no notified body was involved, this step closes with a documented confirmation that no number applies.
Store the declaration and set a review trigger
The provider stores the signed declaration, all language versions, the traceability matrix and the marking evidence together with the technical file, and keeps them for 10 years after the system is placed on the market or put into service. Records must be available to authorities on request. The provider also sets a review trigger for substantial modification, so that any change to the system reopens the Section 2 mapping, the declaration and, where relevant, the CE marking. The output is a retention record with a retrieval test and a named owner for the review trigger.
Evidence that proves the declaration is true and kept
The declaration is only as credible as the records behind it. Each card below is an artifact an authority can ask for on request, and together they show that the statement was true when signed and remains traceable for the full retention period. Keep them in one controlled repository so that every version of the declaration points to the exact system state it describes.
Signed and versioned declaration
Article 47 requires a written declaration, either machine-readable or physically or electronically signed, for each high-risk system. Keep every issued version, with the signatory, signing date, and the system version it covers. A declaration that cannot be tied to a specific release is hard to defend. Confirm with counsel whether a signature scheme in your document system meets the electronic signature expectations in your jurisdiction.
Annex V content map
Annex V lists the information a declaration must contain. Build a map that pairs each Annex V item with the document, section or record that supplies it. This lets a reviewer verify the declaration line by line rather than trusting a summary. Review the map whenever Annex V wording is updated or a new element of the system is added to scope.
Technical file index
The declaration points to a technical file that shows how the system meets the Section 2 requirements. Maintain an index with each document's identifier, owner, version and date of last review. A current index lets you answer an authority request without searching. Check that every file the declaration relies on is present in the index and that superseded documents are archived, not deleted.
Conformity route record
Record which conformity assessment route applied: internal control, or a notified body assessment with its certificate. For internal control, keep the internal assessment report and its sign-off. For notified body routes, keep the certificate, its validity dates and any reassessment decisions. The route determines what the declaration must reference, so confirm it before signing.
CE marking location and captures
Record where the CE marking appears: on the product, its packaging or accompanying documents, or, for digitally provided systems, in an easily accessible digital location or a machine-readable code. Keep dated screenshots or exports of each version. Test that the marking is reachable from the interface after each release, because a broken link is a visible gap during an inspection.
Notified body number and translations
Where a notified body was involved, keep a register of its identification number and confirm that the number follows the CE marking and appears in any promotional material claiming CE compliance. Keep the translated declaration and language versions in the same register, linked to the source version and its change log. Note which translations were checked by a qualified reviewer and when.
What meeting Articles 47 and 48 costs in money and effort
This table lists each cost component of producing the EU declaration of conformity and CE marking, who is paid for it, whether it is one-time or recurring, and what drives it up. Read it as a checklist for building a quote, and note that no fee figures are given because none are supplied for this topic.
| Cost component | Who is paid | One-time or recurring | Drivers and how to keep it down |
|---|---|---|---|
| Drafting the declaration and Annex V content | Internal legal and compliance staff, or an advisor preparing the text | One-time per system, then updated on each change | Number of high-risk systems and applicable Union laws. Keep one template and reuse the Annex V content from the technical file. |
| Legal review of the declaration | Internal counsel or external lawyers | One-time, plus review after substantial modification | Scope of the declaration and how many product lines it covers. Agree the review scope in writing before work starts. |
| Engineering work for the digital CE marking | Internal platform engineers or an implementation partner | One-time build, then recurring maintenance | Whether the system is delivered through a user interface or a machine-readable code. Confirm the placement needed with your deployment design early. |
| Notified body fees, where a certificate route applies | The notified body, which sets its own fees | Recurring through assessment cycles and reassessment | Route under Article 43, system type and scope. Request a written quote from each notified body and do not assume a fee. |
| Translation of the declaration | Certified translators or the provider's language staff | One-time per language, then per update | Number of languages required by the markets where the system is placed. Confirm language requirements with the relevant authorities. |
| Retention storage for 10 years | Cloud or data center provider, or internal storage team | Recurring for the full retention period | Volume of records and storage tier. Self-hosted repositories with version control can reduce license spend, but storage and backup still carry running costs. |
| Reassessment after substantial modification | Internal teams, notified body where involved, and advisors | Recurring on each substantial change | Frequency of model or system changes. Track change control tightly so reassessment is triggered deliberately, not by surprise. |
| Document management tooling | Software vendor or self-hosted open-source platform | Recurring license for commercial tools, one-time setup for open source | Self-hosted tools such as wiki or documentation platforms can remove per-seat license spend. Confirm hosting, backup and access control costs in your own environment. |
Who signs, who prepares and who checks the declaration
The provider owns the EU declaration of conformity. Under Article 47, the declaration is a written, machine-readable, physically or electronically signed statement that the high-risk system meets the Section 2 requirements, and by issuing it the provider takes responsibility for compliance. No partner, consultant or assessor can take that responsibility on your behalf, so a named signatory inside your organization must be accountable for the content and for the decision to sign.
- Accountable signatory: Name a person with authority to bind the organization, usually an executive or a senior officer in product, legal or compliance, and record that appointment.
- Decision record: Keep a dated internal approval showing the evidence reviewed before signature, including any open findings and why they were accepted.
- Version control: Sign the version of the declaration that matches the released system and its technical documentation, and re-issue it after a substantial modification.
- Retention owner: Assign someone to keep the signed declaration for 10 years and produce it to authorities on request.
- Translation: Decide who checks that the declaration is translated into the language the competent authority requires.
Before signing, confirm that your signatory can point to the evidence behind each statement in the declaration without relying on a consultant's summary.
An implementation partner such as DeployOpen prepares the systems and evidence that the declaration relies on. Partner work is usually fixed-scope and written down before it starts, and it typically covers building the content map that links each Annex V item to a source document, organizing the technical file, configuring the systems that hold records, and setting up retention. The partner does not issue or sign conformity documents, and the declaration must not be drafted in a way that suggests the partner vouches for the system.
- Content map: Draft a table that traces each Annex V element and each Section 2 requirement to the document, log or test result that supports it.
- Evidence repositories: Configure self-hosted tools so each record has an owner, a date and a change history, for example with the version control in XWiki.
- Access controls: Set role-based permissions on evidence so only approved staff can edit or replace signed material.
- Retention setup: Configure storage and export so the 10-year retention period can be met, and test that records can be produced on request.
- Gap reports: Identify missing or inconsistent evidence before the signatory is asked to sign.
Ask the partner to state in writing which tasks it performs and which it explicitly does not perform, including signing, certifying and issuing any opinion on conformity.
Independent assessors check conformity, and certification bodies issue certificates where a route requires one. Most Annex III high-risk systems follow internal control under Annex VI, so the provider performs the assessment and no external body issues a certificate. Notified bodies become involved for some biometric systems and for Annex I products under Article 43, and their identification number must follow the CE marking where they were involved. Their role is separate from both your signatory and your implementation partner, which is what keeps the assessment independent.
- Route check: Confirm with the competent authority or the sectoral rules which conformity route applies to your system before planning the work.
- Notified body scope: If a notified body is required, agree its scope, its fees and its timeline in writing, and expect it to review the evidence independently.
- Independence: Do not allow the partner that built the evidence to perform the independent review, and do not let the assessor design the controls it will later test.
- Certificate validity: Track certificate expiry and the need for reassessment after substantial modification.
- Opinions and reports: Request the assessor's written findings and keep them with the technical file.
Before you engage an assessor, confirm its accreditation or designation status for the relevant route and its independence from your organization and your partner.
Where providers usually fall short on the declaration and CE mark
Most gaps in this area are not missing documents. They are declarations written after the fact, content that drifts from Annex V, and marking that disappears in digital channels or marketing. Each card below names one gap, why it matters under Articles 47 and 48, and the action that closes it.
Declarations written after the fact
A declaration drafted only when an authority or customer asks for it cannot show what was true at placing on the market. Auditors and market surveillance authorities look for dated versions that match the technical documentation at each point in time. Keep the declaration under version control from its first draft, recording who changed what and when, so every released version can be compared and tied to a specific system build.
Annex V content left out
Article 47 ties the declaration to the information listed in Annex V, and a declaration that states conformity without that content is incomplete on its face. Map each Annex V element to the document or record that holds it, then check the declaration against that map before every signature. Ask your assessor to confirm which Annex V items apply to your system category.
CE marking missing from the digital interface
For digitally provided systems, Article 48 expects the digital CE marking to be easily accessible through the interface or through a machine-readable code. A marking buried in documentation or a help center fails that test in practice. Review the user interface, login screens, download pages and any API documentation, and confirm the marking is reachable in as few steps as the product's main functions.
Notified body number left off promotional material
Where a notified body was involved, Article 48 requires its identification number to follow the CE marking and to appear in promotional material that claims CE compliance. Sales decks, landing pages, tender responses and press releases are common gaps because marketing is produced outside the compliance team. Add a release check that scans external claims for the CE claim and the number together.
No retention plan for ten years
Article 47 requires the declaration to be kept for 10 years and made available to authorities on request, which outlasts most product versions, staff and vendor contracts. Without a named owner, a storage location and an export format, the record can be lost during a reorganization or when the provider stops trading. Write a retention procedure that names the repository, the custodian, backup copies and the handover steps if the business changes hands.
Declarations not updated after substantial modification
A declaration describes a system as it was assessed. When the system changes substantially, the statement that it meets the requirements may no longer be true, even if the version number has not changed. Define in your change process what counts as a substantial modification, trigger a review of the declaration and the conformity assessment route at each such change, and record the outcome in the version history.
Questions buyers ask about the declaration and CE marking
Can a provider sign its own EU declaration of conformity for a high-risk AI system?
Yes. For most Annex III systems that follow internal control, the provider writes and signs the declaration itself, because it is the provider's statement that the system meets the Section 2 requirements. Article 47 requires a written, machine-readable declaration that is either physically or electronically signed, and it makes the provider responsible for compliance under the applicable Union law. Signing does not need an outside party's approval, but it does depend on the work the declaration describes being finished. Confirm who inside your organization holds signing authority and record that mandate in writing, because a signature from someone without a documented role is hard to defend during an authority request. If a notified body took part in the assessment, the declaration must reflect that route, so confirm the assessment route before drafting anything.
What does my team need to prepare a declaration of conformity?
Most of the work is collecting evidence that already exists, then checking that it matches the declaration's content. A compliance or legal owner checks the statements and the Annex V information. A product owner confirms the intended purpose and the classification that puts the system in scope. An engineering lead maps each Section 2 requirement to documented evidence, and a quality lead confirms the quality management records are current. An executive with signing authority reviews and signs. The declaration must identify the exact system version it covers, so the team also needs a way to tell which version is in production and to reissue the declaration when a change is significant. Translations, where required, are often the step teams underestimate, so add a reviewer for each language early.
How long does it take to prepare the declaration for a high-risk system?
No fixed duration applies to every organization, and the driver is scope. Writing the declaration is short. The time goes into evidence gathering, which grows with the number of high-risk systems, the number of conformity routes involved, how mature the technical documentation and quality management system already are, the number of languages needed, and how many system versions must be covered. The high-risk rules in Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, so plan backwards from those dates. Ask any provider for a written scope that lists deliverables, timelines and the decisions that stay with your organization before work starts. Fixed-scope engagements are agreed in writing in this way.
Does every high-risk AI system need a notified body for CE marking?
No. Most Annex III high-risk systems use internal control under Annex VI, so the provider does not need a notified body to issue the declaration and affix the CE marking. Notified bodies are involved for some biometric systems and for Annex I products under Article 43. Where a notified body was involved, Article 48 requires its identification number to follow the CE marking, and that number must also appear in promotional material that claims CE compliance. For digitally provided systems, the digital CE marking must be easily accessible through the interface or a machine-readable code. Check the assessment route in Article 43 first, because it determines whether a number appears at all and who must be engaged before the declaration can be signed. The EUR-Lex text of Article 48 sets out the marking rules.
What does keeping an EU declaration of conformity for 10 years involve?
Article 47 requires the provider to keep the declaration for 10 years and to give it to the authorities on request, so retention is an operational duty, not a one-time filing. In practice, each signed version should be stored with its date, the system version it covers, and a link to the technical documentation for that same version. The repository needs access control, a complete change history, and a way to retrieve the document in a readable format years later. Self-hosted wiki platforms can help here. XWiki keeps every change under version control, recording what changed, when and by whom, and lets users compare versions and roll back. BookStack assigns abilities through roles and lets you override permissions per shelf, book, chapter or page. These tools hold records but do not make them legally sufficient, so confirm the retention approach with your legal team.
Can an implementation partner help with the declaration without issuing a certificate?
Yes, and that split is the correct one. An implementation partner prepares systems, controls and evidence for an assessment. It can gap-check the declaration content against Annex V, map requirements to evidence, set up version control and document roles, and support the internal review before signature. DeployOpen works this way: it prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Independent auditors and certification bodies issue those. The declaration itself remains the provider's signed statement, so the partner does not sign it for you. Ask for a written scope that separates what the partner delivers from what your organization owns, and what a notified body will decide if one is involved.
How DeployOpen prepares the declaration evidence for your system
DeployOpen prepares the evidence behind your EU declaration of conformity. It does not issue declarations, attestations or certificates, and it does not sign on the provider's behalf. The declaration remains the provider's own statement, signed by a person the provider authorizes. Engagements start with a written scope that names the high-risk system, the Section 2 requirements and the Annex V content to be covered, the self-hosted environment where the evidence lives, and the deliverables. Before work begins, confirm with your legal or compliance lead which applicable Union law the declaration must cover, since one declaration covers all of it.
Next, DeployOpen maps each Section 2 requirement and each Annex V item to the artifact that proves it in your environment, such as design records, data governance documentation, test results, logging configuration, quality management records and instructions for use. Gaps are listed in the scope document with an owner for each. Where a control has no evidence yet, DeployOpen can build the missing record, but the provider must decide whether the system actually meets the requirement. Ask for the mapping in a spreadsheet or document register that your team can read without the consultant present.
Storage and retention come last. DeployOpen can configure version-controlled wiki or documentation tools, such as XWiki, so each change to a declaration or supporting record is traceable by time and author, and earlier versions can be restored. Access roles can be set so that only named reviewers can approve or edit the signed version. Article 47 requires the declaration to be kept for 10 years and given to authorities on request, so confirm with your records team where the signed copy will be held, how backups are handled and who answers an authority request. Finally, DeployOpen prepares the package for review by your notified body or auditor, where one applies, but the independent assessor makes its own determination.
