Harmonised-standard presumption

Article 40(1): conformity gives a presumption only where the standard reference is published in the Official Journal and only to the extent the standard covers the relevant requirements or obligations.

Article 43(2): providers shall follow Annex VI internal control; it does not provide for notified-body involvement.

Article 44(2): five years for Annex I systems; four years for Annex III systems.

The marking governed by Article 48 and the general principles in Article 30 of Regulation (EC) No 765/2008.

The database referred to in Article 71, used for the registrations specified in Article 49.

What is notified body?

A body involved in the Annex VII assessment route where Article 43 requires or permits that route, subject to the provisions in the source text.

Proving Conformity and Entering the Union Market — The EU Artificial Intelligence Act: A Section-by-Section Deep Dive into Regulation (EU) 2024/1689

Q: A market-surveillance authority authorises a specific high-risk AI system under Article 46(1) and informs the Commission and other Member States. What follows if no Member State or Commission objection is raised within 15 calendar days of receipt of the Article 46(3) information?

The authorisation is deemed justified.. Article 46(4) provides that where no objection is raised within the specified 15-calendar-day window, the authorisation is deemed justified. It does not create a certificate, remove Article 47 duties, or state Union-wide automatic authorisation.

The Route from Technical Rules to Market Access

A connected compliance route

Articles 40-49 turn Section 2 requirements into a route to market: technical benchmarks, assessment, evidence, declaration, CE marking, and registration.

The bridge

Visualise a bridge: standards or specifications lead to conformity assessment; assessment supports the declaration and CE marking; registration completes specified pre-market or pre-use obligations.

Different systems, different routes

Article 43 does not impose one route on all systems. It distinguishes Annex III point 1, Annex III points 2-8, and Annex I Section A product-related systems.

Reading discipline

Keep each Article's trigger attached to its rule. For example, Article 49 registration applies only to the listed actors and system categories, at the specified time.

Article 40: Harmonised Standards and Standardisation Deliverables

When does the presumption arise?

Article 40(1) requires conformity with a harmonised standard, or part of one, whose reference has been published in the Official Journal under Regulation (EU) No 1025/2012.

Its limited scope

The system or model "shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter or, as applicable, with the obligations set out in of Chapter V, Sections 2 and 3" only to the extent covered.

Commission requests

Article 40(2) says the Commission shall issue standardisation requests without undue delay, after consulting the Board and relevant stakeholders, including the advisory forum.

Resource-performance deliverables

Requests must seek "deliverables on reporting and documentation processes to improve AI systems’ resource performance", including lifecycle resource reduction and energy-efficient model development.

Article 41: Common Specifications as a Backstop

A conditional backstop

Common specifications are available only after a Commission standardisation request and only where one listed failure or inadequacy exists plus no relevant Official Journal reference is published or expected within a reasonable period.

Four standardisation problems

The request may be unaccepted; standards may miss the deadline; standards may insufficiently address fundamental-rights concerns; or standards may fail to comply with the request.

Effect and replacement

Covered conformity creates a presumption. Once an overlapping harmonised standard is published in the Official Journal, the Commission shall repeal the overlapping common specification or part.

Equivalent alternatives

A provider that does not comply with common specifications must not merely assert equivalence: "they shall duly justify that they have adopted technical solutions that meet the requirements referred to in Section 2 of this Chapter" at least equivalently.

Articles 42-43: Selecting the Assessment Route

Article 42 is targeted

Training and testing on data reflecting the intended geographical, behavioural, contextual, or functional setting creates a presumption only for the relevant Article 10(4) requirements.

Cybersecurity route

A qualifying cybersecurity certificate or statement under Regulation (EU) 2019/881 supports a presumption only where Official Journal publication and actual coverage conditions are both met.

Annex III point 1

If applicable standards or common specifications have been applied, the provider shall choose Annex VI internal control or Annex VII assessment involving a notified body.

Annex III points 2-8

For these systems, "providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI". Article 43(2) says that route does not involve a notified body.

Article 43: Product Legislation, Modifications, and External Currency Notes

Annex I Section A systems

Article 43(3) uses the relevant sectoral conformity-assessment procedure, while Section 2 requirements become part of that assessment and specified Annex VII points also apply.

New assessment after change

A previously assessed system "shall undergo a new conformity assessment procedure in the event of a substantial modification", even where the current deployer continues using it.

Learning systems

Predetermined changes and performance changes are not a substantial modification if they were set at the initial assessment and included in Annex IV point 2(f) technical documentation.

External currency note

The July 8, 2026 Digital Omnibus is signed and pending publication, not in force. Its Annex I and Article 43 changes therefore do not displace this source text's rule today.

Articles 44-45: Certificates and Notified-Body Information

Language and duration

Annex VII certificates must be understandable to relevant authorities where the notified body is established. Their stated validity is capped at five years for Annex I and four years for Annex III.

Extension and supplements

Extensions require reassessment and have the same maximum periods. A supplement remains valid only while the certificate it supplements remains valid.

Non-compliance consequences

Where Section 2 compliance is no longer met, the notified body shall suspend, withdraw, or restrict the certificate unless timely appropriate corrective action ensures compliance.

Information network

Article 45 requires information to the notifying authority and specified sharing among notified bodies, while Article 78 confidentiality still applies.

Article 46: Exceptional Derogation Does Not Remove Compliance

A narrow exception

Article 46 permits a limited-period authorisation only on a duly justified request and only for the listed exceptional public-security, life-and-health, environmental, or key-asset reasons.

Compliance still matters

The market-surveillance authority may issue the authorisation only if it concludes that the system complies with Section 2. Necessary assessment procedures must be completed without undue delay.

Urgent use example

Law-enforcement or civil-protection authorities may use a system first only in the specified urgent circumstances, then request authorisation without undue delay. Refusal means immediate cessation and discarding outputs.

Fifteen calendar days

No objection "within 15 calendar days of receipt of the information referred to in paragraph 3" means the authorisation is deemed justified. An objection leads to Commission consultation and decision.

Articles 47-48: Declaration of Conformity and CE Marking

The 10-year record

For each high-risk AI system, the provider must create the declaration and "keep it at the disposal of the national competent authorities for 10 years after the high-risk AI system has been placed on the market or put into service".

One declaration where laws overlap

Where other Union harmonisation legislation also requires an EU declaration, a single declaration shall cover all applicable Union law and identify the legislation to which it relates.

Responsibility

"By drawing up the EU declaration of conformity, the provider shall assume responsibility for compliance with the requirements set out in Section 2." The provider shall keep the declaration up to date as appropriate.

Digital and physical CE marking

"For high-risk AI systems provided digitally, a digital CE marking shall be used" if easily accessible. Otherwise CE marking must be visible, legible, and indelible, subject to the packaging-documentation alternative.

Article 49: Register Before the Relevant Event

Provider registration

Before market placement or putting into service an Annex III system, except point 2, the provider or authorised representative shall register themselves and their system in the Article 71 EU database.

A non-high-risk conclusion

A provider that concludes under Article 6(3) that a system is not high-risk must still register itself and the system before placing it on the market or putting it into service.

Public-sector deployers

Specified public authorities and Union bodies, and persons acting on their behalf, must register themselves, select the system, and register its use before use or putting it into service.

Restricted section and point 2

Sensitive Annex III points 1, 6, and 7 registrations use a non-public section with limited data fields. Annex III point 2 systems shall be registered at national level.

Route-Mapping Exercise

Map the correct compliance path

A provider plans to place an Annex III point 1 high-risk AI system on the market. A relevant harmonised standard exists and has been published in the Official Journal. The provider applies the standard fully.

Your task: Write the route in order before checking the model answer.

Which Article gives a presumption, and what is its limit?
Which two Article 43 procedures may the provider choose between?
Which documents and market-entry signals follow assessment?
Does Article 49 require provider registration for this system before market placement?

Model answer

Article 40(1) supplies a presumption only to the extent the harmonised standard covers the Section 2 requirements.
Under Article 43(1), because the provider applied the relevant standards, it shall opt for Annex VI internal control or Annex VII assessment involving a notified body.
The provider draws up and retains the Article 47 EU declaration of conformity, then uses Article 48 CE marking as applicable.
Yes. Because this is an Annex III system other than point 2, Article 49(1) requires pre-market or pre-service registration of the provider or authorised representative and the system.

Now change one fact: the provider applies only part of the harmonised standard. Article 43(1), second subparagraph, requires the Annex VII procedure.

Flashcards: Market-Entry Vocabulary

Flip each card and recall both the rule and its trigger.

Harmonised-standard presumption: Article 40(1): conformity gives a presumption only where the standard reference is published in the Official Journal and only to the extent the standard covers the relevant requirements or obligations.
Common specifications: Article 41: Commission implementing acts available only when the listed standardisation and Official Journal conditions are fulfilled.
Annex III points 2-8: Article 43(2): providers shall follow Annex VI internal control; it does not provide for notified-body involvement.
Substantial modification: Article 43(4): a previously assessed system shall undergo a new conformity assessment procedure in the event of a substantial modification.
Certificate maximum: Article 44(2): five years for Annex I systems; four years for Annex III systems.
EU declaration retention: Article 47(1): keep it available to national competent authorities for 10 years after market placement or putting into service.
Digital CE marking: Article 48(2): required for digitally provided high-risk AI systems only if easily accessible through the interface, a machine-readable code, or other electronic means.
Restricted database access: Article 49(4): only the Commission and Article 74(8) national authorities may access the respective restricted sections.

Quiz 1: Assessment Route

Select the answer that most precisely states Article 43's rule for Annex III points 2-8.

Which procedure does Article 43(2) require for high-risk AI systems in Annex III points 2-8?

The Annex VI internal-control procedure, without notified-body involvement.
The Annex VII procedure involving a notified body in every case.
Any procedure selected by the deployer after registration.
No assessment procedure where the provider uses common specifications.

Show Answer

Answer: A) The Annex VI internal-control procedure, without notified-body involvement.

Article 43(2) states that providers shall follow the Annex VI internal-control procedure for points 2-8, and expressly says that procedure does not provide for involvement of a notified body.

Quiz 2: Emergency Derogation and Registration

Test whether you can keep the Article 46 and Article 49 conditions separate.

A market-surveillance authority authorises a specific high-risk AI system under Article 46(1) and informs the Commission and other Member States. What follows if no Member State or Commission objection is raised within 15 calendar days of receipt of the Article 46(3) information?

The authorisation is deemed justified.
The system automatically receives a five-year certificate.
The provider is excused from drawing up an EU declaration of conformity.
The authorisation automatically applies throughout the Union without further conditions.