CE marking is the visible endpoint of the EU AI Act compliance process for high-risk AI systems. Once your conformity assessment is complete and your Declaration of Conformity is signed, affixing the CE mark is the final formal act before your high-risk AI system can legally be placed on the EU market. This guide explains what CE marking means for AI, when it applies, what the process is, and what comes next.
- CE marking for high-risk AI systems is required under Articles 47–48 of the EU AI Act, and must be affixed before market placement.
- CE marking signals that you have completed the conformity assessment, prepared a Declaration of Conformity, and accept full responsibility for the system’s compliance.
- For standalone AI software, the CE mark appears on packaging and documentation. For AI embedded in physical products, a single CE mark covers the entire product including the AI component.
- For most Annex III systems, CE marking follows self-conformity assessment — no third-party Notified Body is required. Exceptions apply for biometric AI and Annex I products.
- What is CE marking and why does it apply to AI?
- When is CE marking required for AI systems?
- Step 1: Complete the conformity assessment
- Step 2: Prepare the Declaration of Conformity
- Step 3: Affix the CE marking
- Step 4: Register in the EU AI database
- When do you need a Notified Body?
- After CE marking: ongoing obligations
- FAQ
1. What Is CE Marking and Why Does It Apply to AI?
The CE mark (from the French Conformité Européenne) is a mandatory conformity marking for certain products sold within the European Economic Area. It indicates that the manufacturer declares the product meets all applicable EU legislative requirements — including safety, health, and environmental requirements. CE marking has existed since the early 1990s and applies to a wide range of physical products: medical devices, machinery, toys, electrical equipment, personal protective equipment, and more.
The EU AI Act extends CE marking to high-risk AI systems. Article 48 requires that high-risk AI systems bear the CE marking before they are placed on the EU market or put into service. This aligns AI regulation with the broader EU product safety framework — treating high-risk AI systems with the same rigor applied to physical products that pose safety risks.
2. When Is CE Marking Required for AI Systems?
| AI System Type | CE Marking Required? | How It Is Applied |
|---|---|---|
| Standalone high-risk AI software (Annex III) | Yes | On packaging, in the software interface, or in accompanying documentation |
| High-risk AI embedded in a regulated product (Annex I) | Yes — combined marking | A single CE mark on the overall product covers both the physical product and its AI component, provided both assessments are completed |
| Limited risk AI (chatbots, deepfakes — Article 50) | No | Transparency disclosure obligations apply, but no conformity assessment or CE marking |
| Minimal risk AI | No | No mandatory obligations |
| GPAI models (Chapter V) | No — different regime | GPAI models are subject to Chapter V obligations, not the CE marking and conformity assessment regime. If a GPAI model is integrated into a high-risk AI system, the combined system requires CE marking. |
The Four-Step CE Marking Process for AI
Before affixing the CE mark, you must complete a conformity assessment demonstrating that your high-risk AI system meets all requirements of Articles 8–15. The conformity assessment is a systematic, documented review of your system against each of these requirements.
For most Annex III systems: Self-assessment is permitted. This means the provider conducts the assessment internally based on their own Annex IV technical documentation, without requiring an external auditor or Notified Body. The assessment must be documented with evidence for each Article 8–15 requirement.
What the self-assessment covers: A systematic review of risk management documentation (Art. 9), data governance practices (Art. 10), technical documentation completeness (Art. 11), logging implementation (Art. 12), transparency and instructions (Art. 13), human oversight mechanisms (Art. 14), and accuracy and cybersecurity testing (Art. 15). Each requirement must be addressed with documented evidence — not just assertions.
Once the conformity assessment is complete, the provider must prepare an EU Declaration of Conformity (DoC). Annex V of the Act specifies what the DoC must contain:
| DoC Element | What to Include |
|---|---|
| Provider identity | Full legal name, registered address, and — for non-EU providers — the name and address of the Authorised Representative |
| AI system identification | System name, version, and a clear description of its intended purpose and Annex III classification |
| Conformity statement | Statement that the AI system conforms to the EU AI Act and any other relevant EU legislation applied to the system |
| Standards and specifications applied | Reference to harmonised standards applied, or common specifications used, during development and testing |
| Notified Body involvement (if any) | Name and identification number of any Notified Body that conducted or reviewed the conformity assessment; reference to the Notified Body certificate issued |
| Place and date | Where and when the DoC was drawn up |
| Authorised signature | Signed (wet or electronic) by a named, authorised senior person at the provider — typically CTO, Chief Compliance Officer, or equivalent |
Key obligation: The DoC must be kept up to date. If the AI system changes in a way that affects compliance, the DoC must be revised and re-signed. The DoC must be retained for the 10-year period required by Article 18.
With the conformity assessment complete and the DoC signed, you may affix the CE marking. Article 48 specifies the rules for how the CE mark is applied:
Concurrent with CE marking, Annex III high-risk AI systems must be registered in the EU AI database managed by the EU AI Office. This is a separate step from CE marking — you cannot substitute one for the other.
Registration information includes: Provider’s name and contact details; EU Authorised Representative details (non-EU providers); AI system name, version, and intended purpose; Annex III category; geographic scope of deployment; summary of the conformity assessment; the DoC reference number; and the unique identification number assigned by the EU AI database.
Timing: Registration must be completed before the system is placed on the EU market — the same deadline as CE marking. In practice, registration and CE marking happen in the same compliance sprint: once the DoC is signed, both steps can be executed within days.
3. When Do You Need a Notified Body?
For most high-risk AI systems under Annex III, the EU AI Act permits self-assessment — the provider conducts and documents the conformity assessment internally. However, third-party assessment by an accredited Notified Body is mandatory in two circumstances:
Finding and Engaging a Notified Body
Notified Bodies for the EU AI Act are accredited by national accreditation bodies in each member state and listed in the NANDO (New Approach Notified and Designated Organisations) database maintained by the European Commission. When selecting a Notified Body:
- Verify accreditation specifically for EU AI Act conformity assessment (not just ISO or MDR accreditation)
- Confirm relevant sector expertise — a Notified Body with medical device experience is better placed to assess healthcare AI than one with only machinery expertise
- Engage at least 6 months before your target CE marking date — Notified Bodies have limited capacity and significant lead times in 2026
- Budget appropriately — Notified Body assessments for AI systems typically cost €15,000–€50,000 depending on system complexity and the Body’s fees
- Gather evidence and compile Annex IV: 3–6 months
- Internal review and sign-off: 4–8 weeks
- Prepare and sign DoC: 1–2 weeks
- Affix CE mark and register: 1 week
- Total: ~4–8 months from start
- Identify and engage Notified Body: 4–8 weeks
- Prepare Annex IV documentation: 3–6 months
- Notified Body assessment: 2–4 months
- Respond to queries, revisions: 4–8 weeks
- Total: ~9–14 months from start
4. After CE Marking: Ongoing Obligations
CE marking is not the end of compliance — it is the beginning of ongoing obligations. The CE mark declares that your system was compliant at the point of market placement; maintaining that declaration requires active post-market management.
