EU AI Act Article 43 conformity assessment cost (2026)

For a single Annex III non-biometric high-risk system on the internal-controls route (Annex VI), typical year-one cost is $45K-$150K covering Annex IV technical documentation, EU counsel review, and Article 71 database registration. For an Annex III biometric system requiring third-party assessment (Annex VII) with no harmonized standard applied, add $40K-$120K in notified-body fees.

Annex VI is the internal-controls route: the provider self-attests conformity based on their quality-management system and technical documentation. Annex VII requires a third-party notified body to review the technical documentation and quality-management system. Most Annex III high-risk systems use Annex VI. Annex VII is mandatory for Annex III(1) biometric systems where the provider has not applied harmonized standards, and for products already covered by Annex I sectoral safety legislation.

Yes, materially. Once ISO/IEC 42001 is formally harmonized under EU AI Act Article 40 (in progress in 2026), certified providers get a presumption of conformity with Articles 9-15 covering risk management, data governance, transparency, human oversight, and accuracy. This calculator applies a 45% discount on documentation labor when ISO 42001 is certified.

Annex IV requires 8 sections: (a) general description of the system, (b) detailed description of elements and development process, (c) monitoring and control information, (d) risk-management-system description, (e) changes made through system lifecycle, (f) list of harmonized standards applied, (g) EU declaration of conformity, (h) description of the post-market monitoring plan. Building this from scratch typically runs $25K-$130K depending on system class.

Yes. Fees from Italy (ACCREDIA), Germany (DAkkS), Ireland (INAB), and the Netherlands (RvA / BSI-NL) are broadly comparable but not identical. Notified bodies also charge differently by AI-Act module. Fee ranges in this calculator triangulate MDR/IVDR (medical devices) fee cards because AI-Act notified-body designations are still consolidating in 2026.

Not always. Skipping the notified-body fee saves $30K-$120K, but the provider still bears the full Annex IV documentation burden and the legal liability if the self-attestation is later challenged. For high-visibility deployments, some providers voluntarily use Annex VII even when Annex VI is available.

Post-market monitoring is a mandatory ongoing obligation for all high-risk system providers. It requires a documented monitoring plan, active collection of performance data and serious-incident reports, corrective action tracking, and an annual review. Typical cost is $15K-$45K per year for a single system, scaling with deployment count.

GPAI providers do not undergo Article 43 conformity assessment. Instead they must maintain technical documentation (Annex XI), publish a training-data summary, follow copyright compliance policies, and (for systemic-risk models above 10^25 FLOPs) conduct model evaluations, systemic-risk assessments, cybersecurity protections, and serious-incident reporting. Costs are lower per system but higher per model due to evaluation burden.

The provider bears the conformity assessment burden. Deployers under Article 26 have separate obligations: assign human oversight, monitor for anomalies, inform affected persons, and (for public authorities and financial-services deployers) conduct a Fundamental Rights Impact Assessment. Deployer cost is materially lower — typically $10K-$50K per year of ongoing labor.

The EU AI Act is being phased in. Prohibited-practice bans (Article 5) applied from February 2, 2025. GPAI obligations (Articles 51-55) applied from August 2, 2025. Full Article 43 conformity-assessment enforcement for Annex III high-risk systems applies from August 2, 2026. Annex I products get until August 2, 2027.