Conformity assessment of high-risk AI: internal control or notified body

A high-risk artificial intelligence system cannot be placed on the market without first showing that it meets the requirements of the European Regulation. That process is the conformity assessment, and Guide 3 of the Spanish regulatory sandbox pilot explains it step by step.

The guide, in its version 2.0 of 17 July 2026, adapted to the Digital Omnibus, is credited to the Ministry for Digital Transformation and the Civil Service. Like the rest of the series, it is not binding.

What the conformity assessment is

According to the guide, Article 3.20 of Regulation (EU) 2024/1689 defines it as the process of showing whether the requirements applicable to high-risk systems are met. Article 43 sets which procedure applies to each system.

The two procedures

When each applies

According to the guide:

• Annex III, points 2 to 8, which include, among others, employment, essential services, law enforcement, migration and justice: internal control by the provider, with no notified body.
• Annex III, point 1 (biometrics): the provider may choose between internal control and a notified body if it has applied harmonised standards or common specifications. If it has not applied them, or only in part, it must follow the Annex VII procedure.
• Annex I, section A (products regulated by harmonisation legislation, such as medical devices): the procedure of the sectoral legislation is followed, which incorporates the Regulation's requirements.

What it means for justice

The point is relevant to the legal profession: according to the guide, high-risk systems in the field of justice are assessed by the provider's internal control. They do not go through an independent body before being placed on the market. That reinforces the importance of technical documentation and transparency, which can be decisive for anyone wanting to learn about or challenge the use of one of these systems. The safeguards that the Spanish Administration of Justice has given itself in its own AI use policy carry, in this context, even more weight.

Internal control, step by step

According to the guide, the Annex VI procedure consists of:

1. Verifying that the quality management system complies with Article 17.
2. Examining the technical documentation against the requirements of Articles 8 to 15.
3. Checking that the design, development and post-market monitoring are consistent with that documentation.

After the assessment

• The provider draws up the EU declaration of conformity (Article 47) and affixes the CE marking (Article 48).
• According to the guide, it must keep the declaration for ten years.
• If the system undergoes a substantial modification, the assessment must be repeated (Article 43.4). Changes pre-determined in the technical documentation of systems that keep learning are not considered a substantial modification.

The guide's recommendations

• Check from the start whether applicable harmonisation legislation exists and plan the assessment at the design stage.
• Document every step, including tests.
• Bear in mind that SMEs and start-ups may submit technical documentation in a simplified form, according to the guide.
• Allow realistic timeframes. The guide says that, in medical devices, the assessment has taken between six and twelve months.

Usefulness for lawyers

For those advising a provider, the guide is a map of the process. For those advising a client buying a high-risk system, the declaration of conformity and the CE marking are documents worth demanding. And for those defending an affected person, knowing which procedure was followed helps know what documentation should exist. It completes the guides on cybersecurity and transparency that we have already summarised.

More analysis in Legal AI.