What goes in the EU declaration of conformity under Article 47 of the EU AI Act?

The provider of a high-risk AI system draws up one EU declaration of conformity per system, stating that it meets the requirements of Chapter III, Section 2 and carrying the eight items Annex V lists (Article 47(1) and (2)). Article 47 has applied since 2 August 2026 (Article 113, second paragraph); the duty to draw it up, Article 16, point (g), applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Article 47 and Annex V were not amended.

What must the declaration contain?

Besides the statement that the system meets the Section 2 requirements, it must contain "all of the following information" (Article 47(2) and Annex V):

1. "AI system name and type and any additional unambiguous reference allowing the identification and traceability of the AI system";
2. "The name and address of the provider or, where applicable, of their authorised representative";
3. "A statement that the EU declaration of conformity referred to in Article 47 is issued under the sole responsibility of the provider";
4. "A statement that the AI system is in conformity with this Regulation and, if applicable, with any other relevant Union law that provides for the issuing of the EU declaration of conformity referred to in Article 47";
5. "Where an AI system involves the processing of personal data, a statement that that AI system complies with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680";
6. "References to any relevant harmonised standards used or any other common specification in relation to which conformity is declared";
7. "Where applicable, the name and identification number of the notified body, a description of the conformity assessment procedure performed, and identification of the certificate issued";
8. "The place and date of issue of the declaration, the name and function of the person who signed it, as well as an indication for, or on behalf of whom, that person signed, a signature".

Point 7 ties the declaration to the conformity assessment under Article 43. For a system in points 2 to 8 of Annex III, Article 43(2) prescribes internal control under Annex VI, with no notified body, so there is no notified body or certificate to name, unless the system is also covered by legislation in Section A of Annex I, whose procedure then applies (Article 43(3), as replaced). Annex V does not say whether "where applicable" also lifts the description of the procedure, so describe the internal control performed.

How must it be drawn up and kept?

Article 47(1) calls for "a written machine readable, physical or electronically signed" declaration that identifies the system it was drawn up for, kept at the disposal of the national competent authorities for 10 years after the system has been placed on the market or put into service; a copy is submitted to the relevant ones upon request.

By drawing it up, the provider assumes responsibility for compliance with the Section 2 requirements, and keeps it up-to-date as appropriate (Article 47(4)). The Commission may update Annex V by delegated act to introduce elements that become necessary in light of technical progress (Article 47(5)), so read the annex on the day you sign.

Where does the declaration sit among the provider's duties?

Article 16 places it between the conformity assessment (point (f)) and the CE marking (point (h)). The technical documentation holds a copy (point 8 of Annex IV), and the Annex IV checklist walks all nine points. Registration of an Annex III system, other than one in point 2, under Article 49(1) submits one (point 11 of Section A of Annex VIII), except in the secure non-public section Article 49(4) sets for points 1, 6 and 7 of Annex III in the areas of law enforcement, migration, asylum and border control management, which takes no copy.

An importer and a distributor each verify, among other things, that the declaration accompanies the system before placing it on the market or making it available (Article 23(1), point (c) and Article 24(1)). A third-country provider's authorised representative is mandated to verify that the declaration has been drawn up and to keep a copy for 10 years (Article 22(3)).

When does Article 47 apply?

Article 47 sits in Chapter III, Section 5 (Articles 40 to 49), which Article 113, third paragraph, point (c), as replaced, does not defer: it has applied since 2 August 2026 (Article 113, second paragraph). What the declaration rests on applies later: the Section 1 rules that decide whether a system is high-risk (Article 6(5) excepted), the Section 2 requirements it declares and the Section 3 duty to draw it up apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those under Article 6(1) and Annex I.

That is an open question, and we do not resolve it: the amending regulation does not say how Section 5 operates while the classification rules are not yet in application.

High-risk systems placed on the market or put into service before the Chapter III date have their own rule in Article 111(2), as replaced: the legacy-systems guide walks it and the open question of its date.

What does Complipath do here, and what does it not?

Complipath's status table says Not supported for the declaration of conformity (Article 47). The Annex IV documentation asks for a copy of the declaration and you upload it; the plan says to issue it when the system is ready. The declaration itself is not drafted. The table says the same for conformity assessment (Article 43): we found no support for this in what we have built.

What Complipath does: the AI inventory records each system with its classification and the article behind it, and each duty that follows carries an owner, a status and a date. Evidence is linked with the passage and its page. The Annex IV documentation is drafted from the register and says which limbs it could not answer. The full table is on what Complipath is.

What this means for you

If you're a provider: settle the conformity assessment first, because point 7 describes it. Write one declaration per system, with a reference that identifies and traces it (point 1 of Annex V), the standards and common specifications you used (point 6) and the data protection statement whenever the system processes personal data (point 5).

If you're a deployer: Article 47 puts nothing on you, and Article 26 does not mention the declaration. Ask the provider for a copy anyway; point 1 of Annex V names the system it covers. Article 25(1) makes you the provider, and the declaration yours, if you put your name or trademark on a high-risk system already placed on the market or put into service, modify one substantially so that it remains high-risk or change a system's intended purpose so that it becomes high-risk. When a deployer becomes a provider walks the three, including the contract caveat on the first.

FAQ

Does a SaaS system need a CE marking as well? Yes, if it is high-risk: Article 16, point (h) requires the CE marking. For a system provided digitally, Article 48(2) requires a digital one, used only if it can easily be accessed via the interface from which the system is accessed or via an easily accessible machine-readable code or other electronic means.

Can one declaration cover several AI systems? No. Article 47(1) asks for a declaration for each high-risk AI system, and each must identify the system it was drawn up for. Conversely, where other Union harmonisation legislation also requires an EU declaration of conformity for the same system, Article 47(3) requires a single declaration covering all Union law applicable to it and identifying that legislation.

Do we need a new declaration after an update? Article 47(4) has the provider keep it up-to-date as appropriate. A substantial modification sends the system through a new conformity assessment, distributed further or not (Article 43(4)), which point 7 of Annex V describes; for a system that continues to learn, changes pre-determined at the initial assessment and recorded under point 2(f) of Annex IV are not one.

What happens if the declaration is missing or wrong? A market surveillance authority that finds it missing or incorrectly drawn up requires the provider to end the non-compliance within a period it may prescribe (Article 83(1), points (c) and (d)). Failing that, the authority takes appropriate and proportionate measures to restrict or prohibit making the system available, or to have it recalled or withdrawn without delay (Article 83(2)).

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 6, Article 16, Article 22(3), Article 23(1), Article 24(1), Article 25(1), Article 26, Article 43(2) to (4), Article 47, Article 48(2), Article 49(1) and (4), Article 83, Article 97, Article 111(2), Article 113, Annex I, Annex III, Annex IV, Annex V, Annex VI and Annex VIII; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 43(3), Article 97(2), (3) and (6), Article 111(2) and Article 113, third paragraph, point (c), inserted Article 6(1a) to (1c) and amended Annex I. Article 16, Article 47, Article 48 and Annex V were not amended, and Article 97(2), (3) and (6) as replaced still list Article 47(5).

Where this question meets the product: AI Act technical documentation software. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire.