Article 43 is the fork in the road. Read it well and your biometric facility-access program books a notified-body Module H audit slot in Q2 2027 and clears CE marking before the Dec 2, 2027 deadline with budget to spare. Read it badly and your program shows up in Q3 2027 looking for an audit slot that no longer exists, because the ten or so designated notified bodies for AI Act biometric ID are fully booked. The Article 43 decision is binary in form, Annex VI internal control or Annex VII notified-body assessment, but it cascades into a multi-quarter scheduling problem, a six-figure-plus budget line, and a regulator-facing relationship that will outlast the certificate. This lesson is the slow walk through the routing logic, the Module H sequence, the notified-body capacity constraint, and the worked example for a representative Annex III §1 facility biometric-ID system.

Article 43 Routing - Internal Control or Notified-Body Module H

Article 43 sets the conformity-assessment routing for high-risk AI systems under the EU AI Act. The two routes are:

• Annex VI internal control: The provider self-assesses conformity with all high-risk requirements (Articles 8-15), maintains the Annex IV technical documentation, signs the Article 47 EU declaration of conformity, registers under Article 71, and affixes the CE mark. No third party touches the file before market placement. The market-surveillance authority can inspect at any time after placement.
• Annex VII notified-body assessment (Module H), An independent notified body designated under Article 31 audits the provider's quality management system under Article 17 AND reviews the Annex IV technical documentation against the high-risk requirements. The notified body issues an EU technical-documentation assessment certificate. Surveillance audits continue during the certificate validity period. Re-certification is required on substantial modification.

The routing rule under Article 43(1) is category-driven, not system-driven. The Annex III category determines the route, with the principal split:

• Annex III §1 biometric ID systems, Annex VII Module H notified-body assessment is generally required for the remote-biometric-identification sub-category and for biometric categorization/emotion-recognition where the system is in scope of §1. The Commission has issued interpretive guidance that some specific §1 use cases may sit on Annex VI internal control where the system meets harmonized standards in full; for the planning baseline, programs should assume Module H for §1 and confirm in the tier memo.
• Annex III §2 critical infrastructure, Annex VI internal control. (Annex I overlap applies separately where the AI safety component is integrated into a CE-marked harmonized product, that integration drives a different conformity machinery under the harmonized-product law.)
• Annex III §3 education, Annex VI internal control.
• Annex III §4 employment, Annex VI internal control.
• Annex III §5(a)-(e) essential services, Annex VI internal control. (§5(b) creditworthiness and §5(c) life/health insurance carry Article 27 FRIA acceleration to Aug 2, 2026, but the conformity-assessment route remains Annex VI.)
• Annex III §6 law enforcement, Annex VI internal control (with national-implementing-law overlay that may add Member-State-specific oversight requirements).
• Annex III §7 migration, asylum, border control, Annex VI internal control.
• Annex III §8 justice and democratic processes, Annex VI internal control.

The practical read: seven of the eight Annex III categories sit on internal control. Only §1 biometric ID typically requires notified-body Module H. That single exception generates the bulk of the notified-body engagement work in the AI Act conformity-assessment ecosystem, and the principal capacity constraint that this lesson addresses.

Annex VII Module H - What the Notified Body Actually Does

Annex VII Module H is the full quality-management-system + technical-documentation conformity-assessment procedure. It is borrowed from the New Legislative Framework (NLF) that governs CE marking across harmonized EU product legislation: the same Module H used in MDR (medical devices), Machinery Directive, RED (radio equipment), and other CE-marking regimes. The AI Act adopts Module H with AI-specific adaptations.

The notified body assesses three core artifacts:

• Quality management system (QMS) under Article 17: Documented procedures covering compliance strategy, design-and-development controls, quality control of the AI system, post-market monitoring procedures, incident-reporting procedures (Article 73), record-keeping (Article 18), data governance procedures (Article 10), human-oversight procedures (Article 14), risk-management procedures (Article 9), accuracy / robustness / cybersecurity procedures (Article 15), and integration with the broader organizational management system. The QMS audit verifies that the provider operates a documented, repeatable conformity system, not just for the single system under assessment, but for the provider's AI-system production capability generally.
• Annex IV technical documentation, The 9-section technical file covering: §1 general description; §2 detailed system description; §3 monitoring/functioning/control; §4 detailed performance description; §5 risk-management system; §6 changes through the lifecycle; §7 harmonized-standards conformity; §8 EU declaration of conformity; §9 post-market monitoring plan. The notified body reviews the technical documentation against the Article 8-15 high-risk requirements and verifies that the documentation substantiates conformity claims.
• Surveillance audits: During the certificate validity period (typically up to five years, with the AI Act specifying notified-body assessment validity in Article 44), the notified body conducts periodic surveillance to verify continued conformity. Surveillance audits look at the QMS, post-market monitoring outputs, incident reports, changes to the system, and corrective actions.

The notified body does not certify the AI system as such. The notified body issues an EU technical-documentation assessment certificate confirming that the technical documentation conforms to the high-risk requirements. The provider remains responsible for signing the Article 47 declaration of conformity, registering under Article 71, and affixing the CE mark. The notified body certificate is a precondition for those steps when Module H applies.

A substantial modification of the AI system during the certificate validity period requires re-certification. Article 43(4) defines substantial modification as a change that affects compliance with the high-risk requirements or that changes the intended purpose of the system. Pre-defined adaptive behavior within the original conformity-assessment scope does not trigger re-certification; a fine-tuning event that changes accuracy, robustness, or fairness characteristics likely does.

Annex VI Internal Control - What the Provider Self-Assesses

Annex VI internal control is the lighter conformity-assessment route, but "lighter" should not be read as "easier." The provider takes full responsibility for substantiating conformity with all high-risk requirements without third-party validation before market placement. The post-placement enforcement risk falls entirely on the provider.

The Annex VI procedure requires the provider to:

• Establish, implement, and maintain the quality management system under Article 17 (the same QMS expected under Module H, but self-attested).
• Establish and maintain the Annex IV technical documentation (the same 9-section file expected under Module H).
• Conduct internal conformity assessment against the Article 8-15 high-risk requirements.
• Sign the Article 47 EU declaration of conformity.
• Register under Article 71 in the EU AI Office database.
• Affix the CE marking.
• Maintain the documentation for the period specified in Article 18 (10 years for high-risk systems generally) and make it available to market-surveillance authorities under Article 74 on request.

The market-surveillance authority can inspect the provider's documentation at any time after placement. If the authority finds a non-conformity, the provider faces Article 79 enforcement, potential market-withdrawal orders under Article 83, and Article 99 penalties (up to €15M / 3% of global turnover for high-risk requirement breaches).

The ISO 42001 Stage 2 audit parallel matters here. A provider on Annex VI internal control with a current ISO 42001 certificate is in a substantially stronger evidentiary posture than a provider with only the Annex IV file. The ISO 42001 surveillance findings (or the absence of unresolved findings) function as a continuous third-party signal on the conformity posture, even though ISO 42001 is not a substitute for AI Act Annex VI internal control. Most L3-mature programs run the two in parallel: AI Act Annex VI for the legal posture, ISO 42001 Stage 2 for the audit-defensible substantive posture.

The Notified-Body Capacity Constraint - Why This Is a 2026 Problem

Article 31 designates notified bodies for the AI Act. The designation is granted by Member States, notified to the Commission, and published in the NANDO database (the same database that lists notified bodies for MDR, Machinery, RED, and other CE-marking regimes). As of mid-2026, approximately ten notified bodies have completed AI Act designation specifically for Annex III §1 biometric ID. That number will grow through 2026 and 2027, but the growth rate is bounded by the slow designation process: each notified body must demonstrate competence in AI Act conformity assessment, undergo Member State assessment, and accumulate AI-specific expertise.

The demand side: every Annex III §1 biometric ID system placed on the EU market after Dec 2, 2027 needs a notified-body certificate. That includes facility access systems (corporate offices, data centers, secure facilities), border-control biometric ID (non-LE government use), time-and-attendance biometric systems at scale, age-verification systems at scale, biometric categorization systems outside the Article 5(1)(g) prohibition, and non-workplace emotion-recognition systems. The aggregate demand from EU-deployed §1 systems is in the hundreds of provider-system pairs requiring Module H assessment by late 2027.

The capacity math: ten notified bodies, each conducting somewhere between five and twenty Module H assessments per year for AI Act §1 systems (the rate depends on each body's resourcing), produces an annual capacity in the low hundreds. Demand in 2027 will spike as the Dec 2, 2027 deadline approaches. Programs that start notified-body engagement in mid-2027 will find capacity booked out, and audit slots will not be available before the deadline. Programs that engage in early 2026 will secure Q1-Q2 2027 audit slots that 2027-deferrers cannot get.

The practical recommendation: engagement should begin 12-18 months ahead of the planned audit date. For a Q2 2027 Module H audit, pre-engagement scope discussions should begin in Q1-Q2 2026; the technical-documentation file v0.5 (draft) should be in the notified body's hands by Q4 2026; v1.0 final by Q1 2027; full audit Q2 2027; findings and remediation Q3 2027; assessment certificate Q4 2027; Article 47 declaration and Article 71 registration and CE marking by Dec 2, 2027.

Notified-Body Selection - Who to Engage and Why

Selecting the right notified body is a procurement and strategy decision, not just an availability question. The criteria that matter:

• Member State of designation, Notified bodies are designated by individual Member States. A body designated by Germany operates under BAFA / BSI oversight; a body designated by Ireland operates under HSA / ComReg oversight. The Member State of designation affects the regulatory relationship, the language of audit communications, the proximity to your operations, and sometimes the local interpretation of harmonized standards. Multi-country deployers often prefer notified bodies in the Member State where the bulk of their EU operations sit.
• Scope of designation, A notified body designated for Annex III §1 may not be designated for other AI Act scopes (e.g., GPAI conformity assessment under future evolution). Confirm the body's scope of designation matches your conformity-assessment need. The NANDO database lists the precise scope per body.
• Capacity and availability, A notified body with a 12-month booking window in early 2026 may have a 24-month booking window by mid-2027. Confirm audit-slot availability for your target audit window during pre-engagement. Get the availability commitment in writing.
• Industry experience, Notified bodies bring experience from their other CE-marking work. A body with deep MDR experience brings medical-device-grade rigor and may be the right fit for safety-critical AI systems. A body with deep RED experience may be the right fit for biometric systems integrated into consumer hardware. Match the body's existing competence to your system context.
• Cost, Module H Module H assessment fees vary substantially. A representative range for a single Annex III §1 biometric ID system: €150K-€500K for the full QMS + technical-documentation audit, plus annual surveillance fees of €30K-€80K. The variance reflects body, system complexity, location, and remediation scope. Budget at the upper end of the range during planning.
• Language coverage: Working language of the audit, language of audit findings, and language of the assessment certificate. English is supported by most bodies; local-language coverage matters for some Member State interactions.
• ISO 42001 audit experience, Notified bodies that also conduct ISO 42001 Stage 2 surveillance audits can sometimes synchronize the two engagements, reducing overhead. This is an emerging area; confirm capability and willingness.

Worked Example - Acme's Facility Biometric-ID System

Acme Corp is a global enterprise deploying a remote-biometric-identification system for office-building access across its EU facilities. The system uses facial recognition at building entries for employee and authorized-visitor access, integrated with Acme's identity-management platform. Annex III classification: §1 (remote biometric identification, non-LE use). The Article 5(1)(h) prohibition does not apply because the system is non-LE and non-publicly-accessible-space-real-time-LE-use. GDPR overlap is substantial (biometric data is special category under Article 9).

Article 43 routing decision: Annex VII Module H notified-body assessment required. This is the §1 default and Acme should plan accordingly without seeking out interpretive exceptions.

The 2026-2027 sequence Acme's program lead builds:

• Q1 2026, Tier memo confirming §1 classification with Article 5(1)(h) negative-assurance attestation; Article 27 FRIA scoped jointly with GDPR Article 35 DPIA; identification of three candidate notified bodies (NANDO database query for Annex III §1 scope); preliminary RFP scoping; budget allocation €350K for Module H plus €60K/year surveillance.
• Q2 2026, Notified-body shortlist to two; pre-engagement scope discussions with both; commitment letter from selected body with Q2 2027 audit-slot reservation; QMS gap assessment against Article 17 expectations; Annex IV technical file v0.1 outline complete.
• Q3 2026, QMS remediation work (procedures gaps closed); Annex IV technical file v0.3 draft (sections 1-5 complete); ISO 42001 Stage 1 readiness review; data-governance documentation under Article 10; accuracy benchmarking and bias-testing methodology defined.
• Q4 2026, Annex IV technical file v0.5 (sections 1-9 draft) delivered to notified body for early review; bias-testing results documented; human-oversight design under Article 14 documented; post-market monitoring plan v0.5 drafted.
• Q1 2027, Annex IV technical file v1.0 final delivered to notified body; QMS audit-readiness review with internal audit team; FRIA artifact final and notified per Article 27(3) to national supervisory authority; ISO 42001 Stage 2 surveillance audit conducted (parallel track).
• Q2 2027, Module H full audit by notified body: QMS audit + technical-documentation review + on-site verification; preliminary findings delivered; remediation plan agreed.
• Q3 2027, Remediation work completed; closing audit by notified body; EU technical-documentation assessment certificate issued.
• Q4 2027, Article 47 EU declaration of conformity signed; Article 71 EU database registration entry submitted; CE marking affixed; market placement formalized; Dec 2, 2027 deadline met.

Total budget envelope: €350K Module H assessment + €120K Annex IV technical-file build + €80K FRIA/DPIA combined + €60K/year surveillance + €40K legal review + €30K ISO 42001 parallel. Aggregate FY26-FY27 budget for this single system: approximately €680K, with ongoing FY28+ surveillance running €80K/year. This is for ONE Annex III §1 system. A multinational with five §1 systems faces a multi-million euro program.

The lesson Acme's program lead carries to L4 and L5 work: the §1 conformity-assessment cost and timeline is materially different from §4 employment or §5 essential-services internal-control. Programs that fail to separate these tracks in budget and scheduling will under-resource the §1 work and miss the deadline.

Common Article 43 Mistakes - And How to Catch Them

Mistake 1 - Assuming Internal Control Covers All Annex III

Annex VI internal control covers seven of the eight Annex III categories. §1 biometric ID is the principal exception requiring Annex VII Module H. Programs that assume internal control across the board miss the Module H trigger for §1 systems and under-resource the notified-body engagement work. The tier memo for §1 systems should explicitly cite Annex VII Module H as the conformity route.

Mistake 2 - Late Notified-Body Engagement

The capacity constraint is real. Programs that start notified-body engagement in mid-2027 will find audit slots booked beyond Dec 2, 2027. Engagement should begin 12-18 months ahead of the planned audit date. For Q2 2027 audits, pre-engagement starts Q1-Q2 2026. The cost of late engagement is missed CE-marking on the deadline and the inability to place the system on the EU market until the audit is completed.

Mistake 3 - Choosing a Notified Body Without the Right Scope of Designation

A notified body designated for MDR is not automatically designated for AI Act Annex III §1. The NANDO database lists the precise scope per body. Confirm AI Act Annex III §1 scope before contracting. A wrong-scope body cannot issue a valid assessment certificate.

Mistake 4 - Missing the Substantial-Modification Re-Certification Trigger

Article 43(4) requires re-certification when a substantial modification changes compliance with the high-risk requirements or changes the intended purpose. A fine-tuning event that improves accuracy by 3% may not trigger; a model swap that changes the underlying architecture from ResNet to a transformer may. The Article 17 QMS should include a change-evaluation procedure that classifies each change against the substantial-modification threshold and routes accordingly. Missing this trigger leaves the provider operating an uncertified system in the field, an Article 79 enforcement target.

Mistake 5 - Weak Coordination Between Module H Audit and ISO 42001 Stage 2

Many providers running parallel AI Act Module H and ISO 42001 Stage 2 work duplicate effort, miss synergy opportunities, and confuse the auditors. The L4-mature pattern is to map the Module H QMS audit scope against the ISO 42001 Annex A controls, identify the substantial overlap (risk management, change management, data governance, supplier management, incident management), and present a single integrated evidence pack to both audits where the same notified body can support both engagements. Where different bodies are involved, coordinate the audit calendars to minimize duplicate document requests.

Mistake 6 - Confusing the Notified-Body Certificate with the EU Declaration of Conformity

The notified body issues an EU technical-documentation assessment certificate. The provider signs the Article 47 EU declaration of conformity. The CE mark is affixed by the provider. The notified-body certificate is a precondition for the declaration when Module H applies, but it is not the declaration itself. Programs sometimes treat the certificate as the end-state; it is not. The Article 47 declaration, the Article 71 registration, and the CE marking are separate, sequential steps after the certificate.

Cross-Walks - Articles, Annexes, and Lesson 052

The Article 43 decision integrates with broader AI Act provisions:

• Article 31, Notified-body designation process and Member-State authority.
• Article 43(1)-(3), Conformity-assessment routing rules.
• Article 43(4), Substantial-modification re-certification trigger.
• Article 17, QMS expectations assessed under Module H.
• Article 44, Validity of notified-body certificates.
• Article 47, EU declaration of conformity.
• Article 71, EU database registration.
• Article 16(f), Provider obligation to undergo conformity assessment.
• Annex VI, Internal-control procedure.
• Annex VII, Notified-body Module H procedure.
• Annex IV, Technical documentation reviewed under both routes.
• ISO 42001 Stage 2, Parallel third-party assurance complementing the AI Act conformity work.

Lesson 052 (notified-body engagement playbook) takes the routing decision from this lesson and walks the operational engagement steps in detail: the RFP process, the contract structure, the audit-preparation discipline, the finding-remediation pattern, and the surveillance-audit cadence. Programs that complete the Article 43 routing decision from lesson 051 carry it forward into the engagement playbook in lesson 052.

Key Takeaways

• Article 43 splits high-risk conformity assessment into two routes. Annex VI internal control (provider self-assesses) and Annex VII Module H notified-body assessment (independent third-party assessment).
• Seven of the eight Annex III categories sit on Annex VI internal control. §1 biometric ID is the principal exception requiring Annex VII Module H. §2-§8 use internal control (subject to Annex I overlap for §2 systems integrated with CE-marked harmonized products).
• Module H requires three artifacts. QMS audit under Article 17, Annex IV technical-documentation review, and ongoing surveillance during the certificate validity period (up to 5 years per Article 44).
• Annex VI internal control is not easier. It is less validated. The provider takes full responsibility for substantiating conformity. Market-surveillance authorities can inspect at any time. ISO 42001 Stage 2 in parallel materially strengthens the evidentiary posture.
• Notified-body capacity is the binding constraint for §1 systems. Approximately 10 notified bodies designated for AI Act §1 as of mid-2026. Demand spike toward Dec 2, 2027. Engagement should begin 12-18 months ahead of the planned audit date.
• Notified-body selection criteria. Member State of designation, scope of designation (NANDO database confirms), capacity / availability for your audit window, industry experience, cost (€150K-€500K per Module H assessment plus €30K-€80K annual surveillance), language coverage, ISO 42001 audit experience.
• Acme's worked example. A representative facility biometric-ID system requires ~€680K aggregate FY26-FY27 budget plus €80K/year ongoing surveillance, with Q1 2026 pre-engagement, Q2 2027 audit, Q4 2027 certificate, and Dec 2, 2027 CE marking.
• Article 43(4) substantial-modification re-certification. A change that affects compliance with high-risk requirements or changes the intended purpose triggers re-certification. The Article 17 QMS should include a change-evaluation procedure.
• The six common Article 43 mistakes. Assuming internal control covers all Annex III; late notified-body engagement; wrong-scope notified body; missing substantial-modification re-certification; weak Module H / ISO 42001 coordination; confusing the certificate with the declaration of conformity.
• Lesson 052 carries this forward. The notified-body engagement playbook walks the operational steps once the Article 43 routing decision is made.