Article 43 Limits Notified Body Audits to Biometrics, Leaving Most High-Risk AI to Internal Self-Assessment

Regulators and industry leaders argue that requiring an independent audit for every high-risk AI system would paralyze the European tech sector, creating a bottleneck at certification bodies that do not yet exist at scale. They maintain that corporate self-assessment, backed by strict documentation rules, is the only practical way to govern a rapidly moving technology.[5][6]

Civil society groups and safety advocates look at the exact same framework and see a structural loophole that defeats the purpose of regulation. They argue that allowing companies to grade their own homework on algorithms that determine hiring, credit, and welfare access strips the law of its enforcement teeth before it even takes effect.[6]

This tension is codified in Article 43 of the European Union’s Artificial Intelligence Act, the mechanism that dictates how a high-risk system proves it is safe enough to enter the market. The text establishes two distinct pathways for conformity assessment, but they are not distributed equally across the AI landscape.[1][2]

The AI Act classifies systems into risk tiers, with high-risk systems subject to the most stringent requirements under Chapter III. These requirements include establishing a risk management system, ensuring data quality, maintaining technical documentation, and guaranteeing human oversight.[1][4]

The Mechanics of Article 43

Before a high-risk system can be deployed or sold in the EU, its provider must complete a conformity assessment to prove these requirements have been met. Article 43 outlines how this proof is generated, dividing the responsibility between internal corporate teams and external third-party auditors known as Notified Bodies.[2][5]

For the vast majority of high-risk AI systems, Article 43(2) mandates the internal control procedure outlined in Annex VI. This means the company building the AI is solely responsible for verifying its own compliance, compiling the necessary paperwork, and signing an EU declaration of conformity.[1][2]

Under this internal control route, no independent auditor examines the model, reviews the training data, or tests the system's robustness before it reaches the public. The provider simply affixes the CE marking and registers the system in a public database, legally certifying that the internal checks were completed.[2][6]

To understand the scale of the self-assessment route, one must look at the specific use cases defined in Annex III of the Act. This list encompasses the AI applications that most directly impact daily civilian life and economic opportunity.[1][3]

Mapping the High-Risk Landscape

Point 4 covers AI used in employment, including automated resume screeners, interview analysis tools, and worker productivity monitors. Point 5 covers access to essential services, capturing the algorithms used to evaluate creditworthiness or determine eligibility for public housing and welfare benefits.[1][2]

Point 3 includes AI used to determine access to educational institutions or evaluate student performance. Point 2 covers AI systems acting as safety components in the management of critical digital infrastructure, road traffic, and utility grids supplying water and electricity.[1][2]

Under Article 43(2), every single one of these systems—from the algorithm deciding who gets a mortgage to the software managing a municipal power grid—is cleared for the European market through the provider's own internal control procedure.[2][6]

The statutory text carves out a narrow, specific exception for biometric systems. Under Article 43(1), high-risk AI systems listed in Annex III point 1—which covers biometric identification and categorization—are pushed onto a different track.[1][2]

The Biometrics Exception

For these biometric systems, providers cannot rely solely on internal control unless they have fully applied harmonised European standards. Because those standards do not currently exist for most biometric applications, these systems default to the more rigorous Annex VII procedure.[2][5]

The Annex VII route requires the involvement of a Notified Body, which is an independent, state-designated auditing organization. This external auditor must review the provider's quality management system and technical documentation to independently verify that the biometric AI meets the law's safety and fundamental rights requirements.[2][4]

This creates a bifurcated regulatory landscape. A facial recognition system used for building access faces a mandatory independent audit, while an algorithmic resume screener or a medical triage AI is cleared for market through the provider's own internal sign-off.[2][6]

The balance between internal control and external audit is heavily mediated by harmonised standards. These are technical specifications developed by European standardization organizations, translating the Act's broad legal requirements into specific engineering metrics.[1][5]

When a provider fully applies a harmonised standard to their AI system, they earn a presumption of conformity. This legal mechanism assumes the system meets the Act's requirements for the aspects covered by the standard, significantly lowering the compliance friction.[2][5]

The Role of Harmonised Standards

For biometric systems, the existence and application of these standards is the exact trigger that determines the assessment route. If a biometric AI provider applies a recognized harmonised standard, they can use the internal control route, but if they do not, they must hire a Notified Body.[2][6]

Because comprehensive standards for biometric accuracy, bias, and robustness are still being drafted, early biometric systems will almost universally default to the Notified Body route. This creates a temporary, stringent checkpoint for surveillance technologies while the technical standards catch up to the law.[5][6]

The decision to limit third-party audits primarily to biometrics was driven by structural capacity limits rather than a pure assessment of risk. The European Union currently lacks a sufficient network of Notified Bodies equipped with the technical expertise to audit complex machine learning models.[4][6]

If the law had required independent audits for all high-risk categories, the resulting queue would have effectively halted AI deployment in Europe. The internal control mechanism acts as a pressure release valve for the regulatory system, ensuring that innovation is not strangled by administrative backlogs.[5][6]

The Capacity Bottleneck

By restricting the Notified Body requirement to biometrics and legacy hardware products already subject to third-party checks, the European Commission narrowed the funnel. This ensures the limited auditing capacity is focused on the technologies deemed most immediately sensitive to fundamental rights.[1][5]

While self-assessment bypasses the pre-market auditor, it does not erase the compliance burden. Providers using the internal control route must still build and maintain a comprehensive Quality Management System that documents every phase of the AI lifecycle, from data collection to post-market monitoring.[1][2]

This technical documentation must be exhaustive and kept available for national market surveillance authorities for ten years. If a self-assessed AI system causes harm or violates fundamental rights after deployment, regulators will demand the internal control paperwork to determine liability.[1][3]

The internal control procedure effectively shifts the regulatory mechanism from pre-market permission to post-market enforcement. Companies are trusted to mark their own homework, but they face severe financial penalties—up to €15 million or 3 percent of global turnover—if authorities later discover the homework was faked.[1][6]

The Burden of Proof

The conformity assessment is not a one-time hurdle. Article 43(4) requires a completely new assessment whenever a high-risk system undergoes a substantial modification, defined as a change that affects its compliance with the safety requirements or alters its intended purpose.[1][2]

This requirement poses a unique challenge for machine learning models designed to continuously adapt after deployment. If an AI system updates its weights based on new real-world data, it could theoretically trigger a new conformity assessment every day.[4][6]

To solve this, the Act allows providers to pre-determine and document a range of expected changes during the initial assessment. As long as the system's continuous learning remains within those pre-defined boundaries, the updates do not count as substantial modifications.[1][2]

Critics argue that post-market enforcement is insufficient for high-risk systems that can systematically deny people jobs, loans, or public benefits. By the time a market surveillance authority investigates a biased credit algorithm, thousands of individuals may have already been financially harmed.[6]

The Transparency Gap

The reliance on internal control also limits public transparency. Because the technical documentation and risk assessments remain internal corporate records, independent researchers and civil society groups cannot scrutinize the safety claims made by AI providers unless a formal regulatory investigation is launched.[4][6]

Ultimately, Article 43 represents a calculated legislative gamble. The European Union has wagered that the threat of massive post-market fines will force AI companies to conduct internal self-assessments with the same rigor as an independent auditor, trading pre-market certainty for market speed.[5][6]