CE Marking (AI) — EU Market Access Conformity Mark

Definition

CE marking is the conformity mark that indicates a product or system has been assessed against the applicable EU legislation and may move freely within the European Economic Area. Under the EU AI Act, the marking is subject to the general principles set out in Article 30 of Regulation (EC) No 765/2008. For AI, Article 48 of Regulation (EU) 2024/1689 sets out the obligation.

CE marking is not a quality mark and not a certificate issued by a testing body. The provider declares that the system meets the requirements of applicable Union legislation. Where a notified body was involved, its identification number accompanies the mark. In most cases under the AI Act, no notified body is involved.

The declaration carries liability. Market surveillance authorities may require corrective action, withdrawal, or recall where a system carrying the marking is found non-compliant after placement on the market.

Which route applies

The AI Act splits high-risk AI systems into two routes, and they behave differently.

Stand-alone high-risk systems (Annex III). The provider completes the conformity assessment under Article 43, issues the EU declaration of conformity under Article 47, registers the system under Article 49, and affixes the CE marking under Article 48. For systems listed in point 1 of Annex III, which covers biometrics, a provider that has applied harmonized standards or common specifications may choose between the two available conformity assessment procedures. For the remaining categories in points 2 to 8, assessment is by internal control under Annex VI. No notified body is involved.

AI as a safety component of an Annex I product. The sectoral legislation’s conformity assessment procedure applies, supplemented by the requirements of the AI Act. The product’s CE marking covers the AI component. There is no separate AI marking. Since the Digital Omnibus, AI embedded in products covered by the Machinery Regulation is exempted from direct Annex I classification under the AI Act, with AI-specific health and safety requirements available to the Commission through delegated acts under that Regulation instead.

When the obligation applies

CE marking obligations are not yet in force for either route.

2 December 2027. Conformity assessment, EU declaration of conformity, registration and CE marking apply to stand-alone Annex III high-risk systems. The original date was 2 August 2026, deferred by Regulation (EU) 2026/1744.

2 August 2028. The same obligations apply to high-risk AI embedded in Annex I products.

The deferral moved the declaration deadline. It did not move when the evidence behind that declaration must exist, because that evidence accumulates across the development lifecycle, not at the end.

How the marking is applied

For high-risk AI systems provided digitally, a digital CE marking is used, but only where it can be accessed easily through the interface from which the system is accessed, or through a machine-readable code or other electronic means. Otherwise, the marking is affixed visibly, legibly, and indelibly, or, where the nature of the system does not permit this, on the packaging or accompanying documentation.

Where a notified body was involved, its identification number follows the marking and must also appear in any promotional material stating that the system meets CE marking requirements. This is a detail most providers discover late: the marketing team inherits a compliance obligation.

Where a high-risk AI system falls under other Union law that also requires CE marking, the marking indicates conformity with that law as well.

Common misreadings

“We need someone to certify us for CE marking.” For Annex III categories other than biometrics, no third party is involved. The provider assesses, declares,ares and marks. Buying a certificate does not discharge the obligation, and no certificate substitutes for the declaration.

“Self-assessment means low risk.” The opposite. Self-declaration concentrates liability in the provider. When a market surveillance authority opens a file, no notified body stands between the provider and the finding.

“ISO 42001 gives us presumption of conformity.” It does not. Presumption of conformity under Article 42 flows from harmonized standards and common specifications. ISO/IEC 42001 is neither. It is strong evidence of the governance and management system controls the assessment requires, and it is not a shortcut through the assessment itself.

“The deferral buys us time on this.” It buys time on the declaration. Technical documentation, risk management records, data governance evidene,, and post-market monitorindesign mustto be generated while the system is being built. They cannot be reconstructed in November 2027.

Regulatory framework

Provision	What it governs
EU AI Act, Article 43	Conformity assessment procedure. Internal control under Annex VI for Annex III points 2 to 8; choice of Annex VI or Annex VII for biometrics under point 1
EU AI Act, Article 47	EU declaration of conformity. Drawn up by the provider, kept for ten years, provided to authorities on request
EU AI Act, Article 48	CE marking. Physical, digital and packaging rules; notified body identification number; interaction with other Union law requiring CE marking
EU AI Act, Article 49	Registration in the EU database before placing on the market
Annex I	Sectoral conformity assessment applies; product CE marking covers the AI component.
Regulation (EC) No 765/2008, Article 30	General principles governing use of the CE marking
Regulation (EU) 2026/1744	Defers application to 2 December 2027 (Annex III) and 2 August 2028 (Annex I)

Why it matters

CE marking is the access credential for the EU market. Without it, a covered system cannot lawfully be placed on the market or put into service.

The operational point sits underneath that. Because most Annex III categories are assessed internally, the question a provider faces is not who will certify the system. It is whether the evidence behind the declaration would hold if a market surveillance authority asked to see it.

A substantial modification triggers a new conformity assessment. However, changes the provider planned at the time of the initial assessment and documented in the technical file do not count as substantial. For systems that continue to learn after deployment, that distinction separates a change log from a re-assessment. It must be designed into the technical documentation from the start, not argued afterward.

That is the structural shift CE marking introduces for AI providers. Conformity stops being a gate at the end of development and becomes a property of the development process itself.

How Zertia assesses it

Zertia’s High-Risk AI Systems Audit evaluates whether the conformity assessment evidence, technical documentation, and governance controls would support the declaration the provider will have to sign. We test the technical file against Annex IV, examine the risk management and data governance records, and identify where the evidence chain breaks before an authority does.

ISO/IEC 42001 certification supplies independent assurance on the management system layer of that evidence. It does not confer a presumption of conformity, and we do not present it as though it did.

→ High-Risk AI Systems Audit · ISO 42001 Certification

CE marking is a declaration you sign, not a certificate you receive. Zertia’s audit tests whether the evidence behind it holds.

Contact · Schedule a call