High-risk duties
Conformity assessment, CE marking & registration
Before a high-risk system reaches the market, it must pass a conformity assessment, carry the CE marking, and be registered in the EU database. How each step works.
Updated 3 July 2026 · Reference material, not legal advice
Once a high-risk system meets the seven requirements, three formal steps stand between it and the market: conformity assessment, CE marking and registration.
Conformity assessment (Article 43)
This is the procedure by which the system is shown to meet the requirements. Which route applies depends on the system:
- Annex III, point 1 (biometrics): if the provider applies the relevant harmonised standards, it may choose between internal control (Annex VI, no notified body) or an assessment involving a notified body (Annex VII). If the standards are not applied, the notified-body route is required.
- Annex III, points 2–8: internal control (Annex VI) only — no notified body.
- Annex I products: the conformity-assessment procedure of the relevant sectoral legislation applies, with the Act’s requirements folded in.
A substantial modification triggers a new conformity assessment. Changes pre-determined and documented at the initial assessment do not.
EU declaration of conformity & CE marking (Articles 47–48)
After a successful assessment, the provider draws up an EU declaration of conformity and affixes the CE marking — visibly, or digitally for systems provided digitally — followed by the identification number of the notified body where one was involved. The CE marking signals that the system may lawfully circulate in the Union.
Registration in the EU database (Article 49)
Before placing an Annex III high-risk system on the market, the provider registers itself and the system in the EU database maintained by the Commission (Article 71). Notably:
- a provider relying on the Article 6(3) filter (concluding a system is not high-risk) must still register it;
- public-authority deployers register their use of high-risk systems;
- for sensitive domains — law enforcement, migration, asylum, border control — registration goes into a secure, non-public section;
- critical-infrastructure systems (Annex III, point 2) are registered at national level.
What this means in practice
These steps convert internal readiness into a market-facing record. Euridium tracks where each system sits in the assessment, declaration, CE and registration sequence, so the path to launch is explicit rather than assumed.
Run a guided assessment and get the obligations that apply to your role.
This guide is a plain-language summary for orientation. The authoritative text is Regulation (EU) 2024/1689 as published in the Official Journal of the European Union (12 July 2024). It does not constitute legal advice.