Process Owner: Regulatory compliance lead Once per AI system

Conformity assessment, declaration and registration

Takes a regulated system through the applicable pre-market assessment, produces the signed declaration or certificate and completes any registration with authorities before the system is placed on the market.

Verified against the official source 26 Sep 2026 · reviewed by Bhaskar Bhatt

What this label means

Verified: — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
Pending review: — linked to the official source and in the queue for a reviewer to confirm.
Source-linked: — linked to the official source, not yet confirmed by a reviewer.

Download: JSON · Markdown

On this page 6 sections

Duties satisfied: 1; done properly, does the work
Duties supported: 3; contributes; the duty needs more
Jurisdictions: 1
Evidence items: 3

In brief

Conformity assessment, declaration and registration is a process, owned by the regulatory compliance lead and carried out for each AI system. 4 recorded duties in 1 jurisdiction rely on it, and it satisfies 1 of them outright. It produces 3 kinds of evidence an auditor can ask for.

How is it implemented?

Early in the project the compliance lead determines which assessment route applies, whether an outside body must be involved and what registrations follow, and books notified-body capacity if needed. A conformity checklist maps each legal requirement to the evidence in the technical file, and a gap review is completed before the assessment is formally started. On a successful outcome the declaration is signed by an authorised person, markings are applied, registrations are filed and the records are retained for the required period. A re-assessment trigger list defines which changes require the exercise to be repeated.

Which legal duties does it serve?

Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.

European Union 4 duties

satisfies Legal requirement confidence high
Complete conformity assessment, CE marking and EU database registration
EU AI Act · Articles 43, 47, 48 and 49; Annex VIII · applies from 2 Dec 2027

Covers route selection, declaration, marking and database registration.
supports Legal requirement confidence low
Verify conformity before importing or distributing high-risk AI
EU AI Act · Articles 23 and 24 · applies from 2 Dec 2027

Knowledge of the assessment route needed to verify it.
supports Legal requirement
Non-EU providers must appoint an EU authorised representative for high-risk AI
EU AI Act · Article 22 · applies from 2 Dec 2027

Items the representative must verify.
supports Legal requirement confidence high
Providers must document and register a conclusion that an Annex III system is not high-risk
EU AI Act · Article 6(4); Article 49(2) · applies from 2 Dec 2027

Registration under Article 49(2).

What evidence shows it is operating?

Evidence this control produces
Evidence	Type	What it shows
Declaration of conformity or certificate	Conformity declaration or certificate
Registration record in the relevant database	Regulatory filing or notification
Conformity evidence pack	Technical documentation file	Requirement-to-evidence map with the supporting documents.

Owner: Regulatory compliance lead. Frequency: once per ai system.

Which risks does it address?

Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.

6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries
7.3 Lack of capability or robustness AI system safety, failures, & limitations305 incidents · 126 risk entries

Which standards clauses does it correspond to?

Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.

Framework references
Framework	Reference	Note	Confidence
ISO/IEC 42001	Clause 9.2; Annex A.6.2.7		medium
NIST AI RMF	GOVERN 1.1; MAP 4.1		low

Cite this record

AIPolicyTracker (2026). “Conformity assessment, declaration and registration” [AIPT-CTL-0010, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-CTL-0010 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-CTL-0010: it never changes or gets reused, and its address keeps working if this page moves.

BibTeX

@misc{aipolicytracker2026_conformityassessmentdecl,
  author       = {{AIPolicyTracker}},
  title        = {{Conformity assessment, declaration and registration}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/controls/conformity-assessment-and-registration}},
  url          = {https://aipolicytracker.org/controls/conformity-assessment-and-registration},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.

Governance card

Kind: Process
Owner: Regulatory compliance lead
Frequency: Once per AI system
Binding duties: 4 of 4
Review status: Verified against primary source

Confirm which of the duties above reach you (applicability check).
Assign the owner and the frequency.
Operate the control and keep the evidence listed.
Re-check when a duty changes (change log).

Related controls

Accuracy, robustness, fairness and security testing Technical measure
Model release and change-management gate Process
Quality management system for AI development and supply Policy
Technical documentation, model cards and instructions for use Process

Report a correction How we verify

Frequently asked questions

Which legal duties does "Conformity assessment, declaration and registration" satisfy?

It is recorded as satisfying 1 and supporting 3 duties across European Union. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.

What evidence shows this control is operating?

Declaration of conformity or certificate, Registration record in the relevant database and Conformity evidence pack. Owner: Regulatory compliance lead. Frequency: once per ai system.