Does the EU AI Act require a third-party assessor? AramGRC co-founder Anand explains conformity assessment in plain English — self-assessment vs a notified body, and exactly when high-risk AI providers need an independent assessor.
Two founders asked me the same week about the EU AI Act, and they were wrong in opposite directions. One was sure he could tick a box and “self-certify” his hiring tool with no outside involvement. The other had frozen a product launch because she believed every AI system now needs an external auditor and a CE mark. The truth sits between them — and getting it wrong costs either a failed audit or months of unnecessary delay.
I’m Anand, one of the co-founders of AramGRC. Here’s a plain-English guide to what an EU AI Act conformity assessment actually is, the difference between self-assessment and a third-party (notified body) assessment, and — the question everyone actually has — when you genuinely need an external assessor.
A quick note: this is general information to help you scope the problem, not legal advice. For your specific system, confirm the current requirements with qualified counsel — the rules and deadlines are still settling.
A conformity assessment is the process of demonstrating, before your AI goes on the EU market, that a high-risk AI system meets the EU AI Act’s requirements — things like risk management, data governance, technical documentation, transparency, human oversight, accuracy and robustness. If it passes, you draw up an EU declaration of conformity, affix the CE marking, and register the system in the EU database. It’s the AI equivalent of the safety conformity process that already exists for many regulated products.
Key takeaway
Conformity assessment applies to high-risk AI systems. The first real question is not “who assesses us?” — it’s “are we high-risk at all?”
Most of the Act’s heaviest obligations, including conformity assessment, apply to high-risk AI systems. Broadly, a system is high-risk if it’s a safety component of a regulated product, or if it falls into the Act’s listed high-risk use cases (Annex III) — for example AI used in biometrics, critical infrastructure, education, employment and hiring, access to essential services and credit, law enforcement, migration, or the administration of justice. Plenty of AI — chatbots, productivity tools, most content generation — is not high-risk, and instead has lighter transparency obligations. So the first job is an honest classification: minimal, limited, high-risk, or prohibited. Get this right and the rest of the path becomes clear.
For high-risk systems, the Act provides two conformity-assessment procedures:
| Self-assessment (internal control) | Third-party assessment (notified body) | |
|---|---|---|
| What it is | The provider assesses its own conformity against the requirements (Annex VI) | An accredited independent body (a “notified body”) assesses the system (Annex VII) |
| Who relies on it | Many Annex III high-risk systems can currently use this route | Required for certain cases (see below) |
| Effort | You build the evidence and declare conformity | External assessment of your quality management system and technical documentation |
| Output | EU declaration of conformity + CE marking + registration | Notified-body certificate, then declaration + CE marking + registration |
A notified body is an independent organisation officially designated (accredited) to assess conformity on the regulator’s behalf. Think of it as the AI counterpart to the labs that certify other CE-marked products.
This is the part everyone gets wrong. Under the current framework:
In short: a lot of high-risk AI can self-assess today, but a meaningful slice must use a notified body — and the boundary can shift as standards and guidance evolve. Assume nothing; classify carefully.
Key takeaway
Even where the law lets you self-assess, your enterprise customers increasingly won’t. “Independent assessment” is becoming a procurement requirement, not just a legal one.
Whichever route applies, you need to have built and be able to evidence:
This is exactly where independent testing earns its place: a red-team and robustness assessment is some of the strongest evidence you can put behind the “accuracy, robustness and cybersecurity” and “risk management” requirements — whether or not a notified body is formally involved.
The Act’s obligations are phasing in, with the high-risk requirements landing across 2026 and into 2027 depending on the category, and some prohibitions and transparency duties already in force. Because the exact dates depend on your system’s classification and are still being clarified, treat any specific deadline you read (including here) as something to verify against the current official timeline before you plan around it.
We help AI product companies — in India and the US selling into Europe, as well as EU providers — get ready for EU AI Act conformity: classifying systems, mapping the requirements, and producing the independent red-teaming and assurance evidence that stands behind the robustness, security and risk-management obligations. We’re not a notified body, and we’ll always tell you honestly when you need one; what we do is get you to the point where the assessment — self or third-party — actually passes.
Not sure if the EU AI Act makes you high-risk — or who has to assess you?
We’ll help you classify your AI, map the conformity path, and build the evidence to pass. For AI companies in India, the US and the EU.
It’s the process of demonstrating that a high-risk AI system meets the EU AI Act’s requirements before it goes on the EU market — covering risk management, data governance, technical documentation, transparency, human oversight, accuracy and robustness — after which you draw up an EU declaration of conformity, affix the CE marking, and register the system.
Not for every high-risk system. Many Annex III high-risk systems can use self-assessment (internal control), but certain cases — notably some biometric systems, and where harmonised standards haven’t been applied — require assessment by an independent notified body. Classification determines which route applies.
A notified body is an independent organisation officially accredited to assess conformity on the regulator’s behalf — the AI equivalent of the labs that certify other CE-marked products. It issues a certificate that supports your declaration of conformity.
In many cases yes — a large share of Annex III high-risk systems can currently go through self-assessment, provided you properly apply the relevant harmonised standards and can evidence conformity. Some categories still require a notified body, and enterprise buyers may demand independent assessment regardless.
Yes — high-risk AI systems that pass conformity assessment must carry the CE marking, accompanied by an EU declaration of conformity and registration in the EU database, before being placed on the EU market.
The high-risk obligations are phasing in through 2026 and into 2027 depending on the system category, with some prohibitions and transparency duties already in effect. Confirm the exact timeline for your classification against the current official guidance.
How do you build trust in AI at enterprise scale? AramGRC co-founder Anand shares a practical third-party AI assurance framework — inventory, governance, conformance, red teaming and independent reporting — built for the US and India.
What is an AI audit — and why does "AI audit" mean five different things to five different people? AramGRC co-founder Anand breaks down the types of AI audit, what a good one covers, and exactly what a strong audit report should include.
How do Indian AI companies win global trust? AramGRC co-founder Anand explains AI assurance for India — the DPDP Act, MeitY's AI guidelines, and what US and EU buyers actually expect from Indian AI vendors.