CECheck The reference for CE marking

The AI Act and CE marking

Last reviewed: October 2026 · Sources listed at the end of this page.

Regulation (EU) 2024/1689 — the AI Act — is often described as if it were a self-contained body of technology law. For manufacturers, the more useful description is this: for high-risk AI systems, the AI Act is a piece of Union harmonisation legislation built on the New Legislative Framework, and it ends the same way the Machinery Regulation or the Medical Devices Regulation ends: with a conformity assessment, an EU declaration of conformity, and CE marking. Article 48 of the AI Act states it directly — high-risk AI systems bear the CE marking, applied in accordance with the general principles of Article 30 of Regulation (EC) No 765/2008.

The consequence is that everything this site describes for physical products — assessment modules, technical documentation, declarations of conformity, notified bodies, harmonised standards, market surveillance — has an AI Act counterpart. This page maps the correspondence and the points where the AI Act departs from the familiar pattern.

At a glance. The AI Act (EU) 2024/1689 is in force and generally applies, but its high-risk and CE marking rules were deferred by Regulation (EU) 2026/1744: Annex III systems from 2 December 2027, Annex I products from 2 August 2028. A Notified Body is needed for some biometric systems and, for Annex I products, through the sectoral procedure. Machinery follows a separate route through the Machinery Regulation.

Which AI systems are high-risk: the two routes

Only high-risk AI systems enter the CE system. The AI Act's other tiers — prohibited practices, transparency obligations for certain systems such as chatbots and deepfakes, and the separate regime for general-purpose AI models — involve no conformity assessment and no marking. Article 6 defines high-risk through two independent routes.

Route 1: Annex I — AI inside regulated products

An AI system is high-risk under Article 6(1) when both of the following hold:

Annex I Section A lists the core New Legislative Framework acts: toys, recreational craft, lifts, ATEX equipment, radio equipment, pressure equipment, cableways, personal protective equipment, gas appliances, medical devices, and in vitro diagnostics. Section B lists old-approach sectors — aviation, motor vehicles, marine equipment, rail — where the AI Act's requirements feed into the sectoral type-approval systems rather than applying directly. Since 27 July 2026, Section B also includes the Machinery Regulation, moved there from Section A by the Digital Omnibus on AI, Regulation (EU) 2026/1744 (see below).

The third-party condition matters. An AI-driven feature in a product self-certified under internal production control (Module A) does not become high-risk by this route. A machine-learning-based safety component in a medical device assessed by a notified body does.

Route 2: Annex III — standalone use cases

Article 6(2) designates as high-risk the AI systems listed in Annex III by use case, independent of any product context: biometric identification and categorisation, AI as a safety component in critical infrastructure management, education and vocational training, employment and worker management, access to essential private and public services (including credit scoring and insurance pricing), law enforcement, migration and border control, and administration of justice and democratic processes. A derogation lets providers document that a listed system nonetheless poses no significant risk of harm in its specific role, subject to conditions and registration.

What conformity is assessed against

High-risk AI systems must meet the requirements of Chapter III, Section 2 of the AI Act (Articles 8 to 15): a risk management system operated across the lifecycle (Article 9 — the AI counterpart of a product risk assessment, but continuous rather than one-off), data and data governance for training, validation and test sets (Article 10), technical documentation per Annex IV (Article 11), automatic event logging (Article 12), transparency and instructions for deployers (Article 13), human oversight (Article 14), and accuracy, robustness and cybersecurity (Article 15). Providers must also operate a quality management system and post-market monitoring, and report serious incidents — the architecture will be recognisable to anyone who has worked under the MDR.

Conformity assessment and CE marking

Article 43 sets the assessment routes:

After assessment, the provider draws up an EU declaration of conformity (Article 47) and affixes CE marking under Article 48. For AI systems provided only digitally, the CE marking may itself be digital, on the interface or accompanying documentation, rather than a physical graphic. Where a notified body was involved, its identification number accompanies the mark, exactly as described in affixing the CE mark. A single declaration may cover both the AI Act and the sectoral legislation; for products under acts such as the MDR, the intention throughout is one assessment, one declaration, one mark.

One procedure, not two. A manufacturer of an Annex I product embedding high-risk AI should not plan for a second, parallel certification. The AI Act was drafted so that the existing notified body — where designated for the AI Act's requirements — checks Articles 8 to 15 as part of the sectoral assessment, and the technical documentation may be integrated into the existing technical file (a single set of documentation covering both acts). The planning burden is real, but it lands inside the existing procedure: extended documentation, extended audit scope, extended assessment cost — not a separate CE regime.

Timeline

The AI Act entered into force on 1 August 2024 and applies in stages. Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July 2026, changed the later ones.

DateWhat applies
2 Feb 2025Prohibited practices; AI literacy
2 Aug 2025General-purpose AI models, governance, notified bodies
2 Aug 2026General application, including transparency obligations
2 Dec 2026New prohibitions added by the omnibus; Article 50(2) marking for generative systems placed on the market before 2 August 2026
2 Aug 2027Commission deadline for delegated acts under Article 2(13), limiting certain requirements for Annex I Section A products; national sandboxes operational
2 Dec 2027High-risk requirements for Annex III systems
2 Aug 2028High-risk requirements for Article 6(1) and Annex I products
2 Aug 2030High-risk systems used by public authorities (Article 111(2))

The 2028 date is the one most product manufacturers should plan against. Transitional provisions ease the position of high-risk systems already placed on the market before the relevant dates, broadly tying new obligations to significant design changes; the details are in Article 111 and are worth reading in the original for any legacy system.

Notified bodies for AI

The AI Act establishes its own notification regime: Member States designate notifying authorities, and conformity assessment bodies are notified against the AI Act's competence requirements, appearing in NANDO like any other notified body. For Annex I products the practically important cohort is existing sectoral notified bodies extending their designation to cover the AI Act — an MDR notified body adding AI Act scope can then run the combined assessment. Check NANDO for current designations. Providers who will need Annex VII assessments should engage bodies early, as the MDR experience taught the medical device sector.

Harmonised standards: the open flank

As with every NLF act, presumption of conformity comes from harmonised standards cited in the Official Journal. CEN and CENELEC's joint technical committee JTC 21 is developing the programme. The first citation came in October 2026: Implementing Decision (EU) 2026/2274 references the standard on quality management systems, EN 18286, which supports Article 17. It does not cover Articles 8 to 15. No harmonised standard had been reported as cited for those requirements at this review, so providers should verify the current list before relying on a presumption of conformity. The Commission may adopt common specifications where standards are delayed. Until coverage is complete, the Annex III biometrics route effectively requires notified-body involvement, and internal-control assessments must be argued requirement by requirement.

Overlap with the Machinery Regulation

The Machinery Regulation (EU) 2023/1230, applying from 20 January 2027, contains its own AI-adjacent provisions: essential requirements addressing safety functions with self-evolving behaviour, software integrity, and protection against corruption, and third-party assessment for certain machinery embedding machine-learning safety components. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the Machinery Regulation from Section A to Section B of Annex I of the AI Act. AI systems in machinery are therefore not assessed under the AI Act's high-risk procedure. Instead, new paragraphs in Article 8 of the Machinery Regulation require the Commission to adopt delegated acts adding AI health and safety requirements to Annex III of that Regulation, reflecting the AI Act's high-risk requirements. Those acts "shall apply by 2 August 2028". The text sets no separate adoption deadline; the 2 August 2027 date elsewhere in the omnibus concerns Article 2(13) of the AI Act, which covers Section A products. The power to adopt the acts runs for five years from 27 July 2026 (Article 47(2)), and until harmonised standards exist under the Machinery Regulation, high-risk AI systems meeting AI Act standards or common specifications are presumed to conform with the Annex III requirements (Article 20(10)). Manufacturers of AI-enabled machinery should follow that pipeline alongside the Machinery Regulation's existing AI-related requirements. For radio equipment, which remains in Section A, the AI Act's Annex I route still sits alongside the RED, including its cybersecurity requirements applying since August 2025.

Who holds the obligations

The AI Act's "provider" corresponds to the manufacturer role in product law, with equivalents of the full economic-operator chain: authorised representatives for non-EU providers, importers, and distributors, with obligations closely modelled on the NLF template described in manufacturer obligations. A deployer, importer or distributor that puts its name on a high-risk system, or substantially modifies one, becomes the provider — the same re-qualification rule familiar from Decision 768/2008/EC. Penalties are set in the AI Act itself, scaled to global turnover; see penalties for non-compliance for how these compare with sectoral regimes.

Frequently asked questions

Does AI software need CE marking?

Only if it is a high-risk AI system. Annex III systems and AI in Annex I products bear CE marking under Article 48. Other AI systems do not, even where transparency duties apply.

When must high-risk AI carry CE marking?

From 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products, following Regulation (EU) 2026/1744. Legacy systems are treated under Article 111.

Does AI in machinery follow the AI Act procedure?

No. Machinery is in Annex I Section B since 27 July 2026. AI requirements will reach machinery through delegated acts under Article 8 of the Machinery Regulation, which must apply by 2 August 2028.

Is a second CE assessment needed for AI in a medical device?

No. For Annex I Section A products, the AI requirements are checked within the sectoral conformity assessment, by a notified body designated accordingly, and one CE marking covers both acts.

Sources

Related on CECheck