When Annex VI applies
- Yes: Annex III §2 critical infrastructure, §3 education, §4 employment, §5 essential services / creditworthiness / insurance, §6 law-enforcement, §7 migration, §8 justice — all default to Annex VI.
- No: Annex III §1 biometric identification — must use Annex VII (notified-body) route under Article 43(1).
- Integrated, not Annex VI: Annex I products — the sectoral conformity procedure absorbs the AI Act check under Article 43(3).
Step 1 — Quality management system
Confirm the Article 17 QMS covers the AI system. The QMS must include:
- Strategy for regulatory compliance, including conformity-assessment and post-market surveillance procedures.
- Techniques and procedures for design and development.
- Examination, test, and validation procedures.
- Technical specifications and applicable harmonised standards.
- Systems and procedures for data management.
- Risk management system per Article 9.
- Post-market monitoring system per Article 72.
- Incident-reporting procedures per Article 73.
- Communication with authorities and notified bodies (where applicable).
- Record-keeping and resource management.
- Accountability framework defining management and staff responsibilities.
Many providers already have ISO 9001, ISO/IEC 42001, or sectoral QMS — the QMS does not have to be net-new but must be documented to cover the AI Act elements.
Step 2 — Technical documentation review
Compile the technical documentation under Annex IV and review it against Articles 9–15. Annex IV requires:
- General description of the system, intended purpose, version, hardware/software requirements.
- Detailed description of design, development, and operation: methodologies, training and test data, computational resources, validation procedures.
- Information about the data — provenance, scope, characteristics, governance procedures.
- Description of monitoring, functioning, and control measures — including known limitations.
- Description of changes during the lifecycle and version control.
- Standards applied and any reference to them.
- Copy of the EU declaration of conformity (drawn up at end of Step 3).
- Detailed description of the post-market monitoring system.
Step 3 — Design and development verification
Verify that the design and development of the system actually corresponds to the QMS and the technical documentation. This is internal — no notified body — but must be documented. The verification covers:
- That the development followed the documented methodology.
- That the data-governance procedures (Article 10) were applied to the actual training, validation, and test data.
- That the risk-management system (Article 9) ran across the lifecycle.
- That the system meets the accuracy, robustness, and cybersecurity targets in Article 15.
- That logging (Article 12) and human-oversight measures (Article 14) are implemented as documented.
- That instructions for use (Article 13) are produced and tested with representative deployer audiences.
Closing the procedure
- Draw up the EU declaration of conformity (Article 47) — single declaration, multiple Union acts where applicable.
- Affix the CE marking (Article 48) on the system or its documentation.
- Register the system in the EU AI Database (Article 49) before placing on the market.
- Notify the AI Office of any change in the QMS that affects the system (Article 17).
What auditors actually look for
Market surveillance authorities have signalled they will focus on:
- Data governance evidence — whether bias testing was actually run, on what data, with what results.
- The link between Article 9 risk management and Article 15 robustness — are residual risks documented and mitigated?
- Whether instructions for use are realistic — can a representative deployer actually operate the system safely from them?
- Logging coverage — whether automatically generated logs (Article 12) actually capture the events Article 26 deployers need.
- Post-market monitoring — whether the plan exists on paper but does not run in practice.