Conformity assessment is the formal process of demonstrating that a product, system or service meets the requirements of the law that applies to it before it is placed on the market or put into service. In tech regulation, especially in the European Union, it is the gateway that radio equipment, machinery, medical devices, connected products under the Cyber Resilience Act and high-risk AI systems under the AI Act must pass before they can legally be sold or used.
The process ends with documentary proof: a technical file, an EU declaration of conformity signed by the manufacturer and, for most product laws, the CE marking. Depending on the risk level, the manufacturer either assesses conformity itself or must involve an independent notified body.
How conformity assessment works under EU product law
EU product legislation follows the New Legislative Framework, which separates two layers. The law sets essential requirements, such as safety, cybersecurity or accuracy, while technical details are left to harmonized standards. A product that complies with the relevant harmonized standards benefits from a presumption of conformity with the requirements they cover.
The manufacturer identifies the applicable laws, analyzes risks, applies standards or other technical solutions, tests the product and compiles the evidence into a reviewable record. The steps below form the typical sequence.
| Step | Main task | Result |
|---|---|---|
| Scoping | Identify all applicable acts and classes | List of requirements |
| Risk analysis | Assess hazards and intended use | Risk assessment record |
| Applying standards | Use harmonized standards or own solutions | Design and test evidence |
| Module selection | Choose the procedure the law allows | Self-assessment or third party |
| Technical documentation | Compile design, tests and risk files | Technical file kept for authorities |
| Declaration and marking | Sign declaration, affix CE marking | Product may enter the market |
Assessment modules and the role of notified bodies
EU law describes conformity assessment through standardized modules labeled with letters. Each act specifies which modules are allowed for which product category, so higher-risk products require more independent scrutiny.
| Module | Procedure | Third-party involvement |
|---|---|---|
| Module A | Internal production control | None, manufacturer self-assesses |
| Module B | EU-type examination of a design | Notified body examines the type |
| Modules C to F | Conformity to type in production | Varies from none to product checks |
| Module H | Full quality assurance | Notified body approves the quality system |
A notified body is a testing or certification organization that a member state designates and notifies to the European Commission for a specific act. It must be independent, technically competent and insured, and it is subject to ongoing monitoring. Capacity is limited in some sectors, which can make notified body lead times a bottleneck for product launches.
Conformity assessment in digital regulation
Newer digital laws reuse the same framework for software-intensive products. The level of assurance again depends on risk classification, and many digital products can be self-assessed if harmonized standards exist and are applied in full.
| Act | Products covered | Typical route |
|---|---|---|
| AI Act | High-risk AI systems | Mostly internal control; notified body for some biometrics |
| Cyber Resilience Act | Products with digital elements | Self-assessment for default class, third party for critical classes |
| Radio Equipment Directive | Wireless devices, including cybersecurity | Self-assessment with standards, otherwise notified body |
| Medical Device Regulation | Medical software and devices | Notified body for most classes |
| Machinery Regulation | Machines, including AI safety functions | Third party for listed high-risk machinery |
Under the AI Act, conformity assessment covers requirements such as risk management, data governance, logging, human oversight and accuracy. A substantial modification of the system after placement on the market triggers a new assessment, which matters for models that are retrained or updated frequently.
Related concepts and how they differ
Conformity assessment is often confused with neighboring regulatory instruments. Each of the following serves a different stage or purpose in the compliance cycle.
- Certification is a third-party attestation, often voluntary; conformity assessment may or may not include it.
- Market surveillance is the authorities’ checking of products after they are on the market, including requests for the technical file.
- Impact assessment in EU lawmaking evaluates the effects of a proposed law, not of a product.
- A fundamental rights impact assessment under the AI Act is a deployer duty, separate from the provider’s conformity assessment.
Common mistakes and practical pitfalls
Many failures come not from technical defects but from incomplete documentation or overlooked laws. Authorities can request the technical file for ten years after the last product is placed on the market under many acts, and a missing file is itself a breach.
- Overlooking that several acts apply at once, for example radio, cybersecurity and AI rules for the same device.
- Relying on standards that are not yet cited in the Official Journal, which gives no presumption of conformity.
- Treating CE marking as a quality label rather than a legal declaration by the manufacturer.
- Updating software without checking whether the change is substantial and requires reassessment.
- Booking a notified body too late, delaying the launch by months.
Responsibility also shifts along the supply chain. An importer or distributor that sells a product under its own name, or modifies it substantially, takes on the manufacturer’s obligations, including a fresh conformity assessment. Importers must in any case verify that the procedure was carried out and that the documentation exists, so a missing declaration from a foreign supplier is a compliance problem for the importer as well.
In plain words
Before many products can be sold in Europe, the maker must prove they follow the rules. Conformity assessment is that proof: tests, risk checks and paperwork showing the product is safe and does what the law demands.
For simple products, the maker can check itself and sign a declaration. For riskier ones, an independent inspector must look as well. Only then may the product carry the CE mark and go on sale.
A real-world example
A company develops a smart door lock with a mobile app and plans to sell it across the European Union. Its compliance team identifies three relevant acts: the radio equipment rules, the Cyber Resilience Act and general product safety law. Because the lock falls in a higher-risk product class under the cybersecurity rules, self-assessment is not sufficient without full application of harmonized standards.
Since the available standards cover only part of the requirements, the company applies them, runs penetration tests, documents its vulnerability handling process and engages a notified body six months before launch. After the body issues its certificate, the company signs the declaration of conformity, affixes the CE marking and archives the technical file for ten years. When a national authority later requests documentation, the company responds within days.