In short
- Article 47(4) of Regulation (EU) 2024/1689 says that by drawing up the declaration, the provider assumes responsibility for every requirement in Chapter III Section 2.
- Annex V point 8 asks for the name and function of the person who signed and for whom they signed. The Regulation names no job title that must sign.
- Annex V point 5 makes the declaration also state compliance with the GDPR, Regulation (EU) 2018/1725 and Directive (EU) 2016/680 wherever personal data is processed.
- A system also covered by other Union harmonisation legislation gets 1 single declaration under Article 47(3), not one per law.
- The declaration is kept for 10 years and kept up to date, and a breach of the provider duty in Article 16(g) sits in the Article 99(4) band of up to EUR 15 000 000 or 3% of worldwide turnover.
Signing the EU declaration of conformity for a high-risk AI system is where a compliance programme gets a name under it. The person asked to sign wants to know two things: am I the right person, and what am I putting my name to?
Regulation (EU) 2024/1689 answers the second question in detail and the first barely at all. Under Article 113(c), as amended by Regulation (EU) 2026/1744, the duty applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I.
01Who may sign the declaration of conformity under Article 47?
Someone entitled to bind the provider, because the declaration belongs to the provider and not to the signatory.
Article 47(1) of the AI Act places the duty on the provider, and Article 16(g) repeats it in the list of provider obligations. Annex V point 8 asks for the place and date of issue, the name and function of the person who signed, an indication of for whom or on behalf of whom that person signed, and a signature. It does not name a role. A chief executive, a managing director or a head of quality can all sign, provided the company’s own constitution or internal mandate lets that person commit it.
Two parties are commonly assumed to sign and do not. A notified body appears in the declaration only as a reference under Annex V point 7. A provider established outside the Union must appoint an authorised representative under Article 22(1), and Article 22(3)(a) gives that representative the task of verifying that the declaration has been drawn up, which is a check on the provider’s document rather than a transfer of it. Annex V point 3 settles the point: the declaration is issued under the sole responsibility of the provider.
02What does the provider commit to when the declaration is signed?
Everything in Chapter III Section 2, plus data protection law where personal data is involved.
Article 47(4) of the AI Act states that by drawing up the declaration the provider assumes responsibility for compliance with the Section 2 requirements, which run from risk management in Article 9 to accuracy, robustness and cybersecurity in Article 15. Annex V turns that into eight concrete statements.
| Annex V point | What the declaration asserts | Evidence to see first |
|---|---|---|
| 1 | Which system, traceably identified | Version and build reference matching the Annex IV file |
| 3 | Sole responsibility of the provider | Board or management mandate for the signatory |
| 4 | Conformity with the AI Act and any other Union law requiring a declaration | Completed Article 43 assessment record |
| 5 | Compliance with Regulations 2016/679 and 2018/1725 and Directive 2016/680 | Data protection sign-off, including any DPIA |
| 6 | Harmonised standards or common specifications applied | List of standards with the clauses relied on |
| 7 | Notified body, procedure and certificate, where applicable | Certificate number and scope |
Point 5 is the line signatories miss. A declaration for a system that processes personal data asserts GDPR compliance in the same document, so the data protection officer’s view belongs in the signing file, not in a separate workstream.
03What does Article 99 attach to an inaccurate declaration?
Fines on the provider as an operator, set by Member States within the ceilings in Article 99 of the AI Act.
| Infringement | Provision | Ceiling |
|---|---|---|
| Provider obligations in Article 16, including the declaration in 16(g) | Article 99(4)(a) | EUR 15 000 000 or 3% of turnover |
| Incorrect or misleading information to authorities in reply to a request | Article 99(5) | EUR 7 500 000 or 1% of turnover |
| SMEs, including start-ups | Article 99(6) | Whichever is lower |
| Small mid-cap enterprises, paragraphs 4 and 5 | Article 99(6a) | Whichever is lower |
Article 99 fines fall on operators, which Article 3(8) defines as providers, product manufacturers, deployers, authorised representatives, importers and distributors. An employee signing on the provider’s behalf is not an operator in that capacity. Any personal exposure comes from national law, which the AI Act leaves untouched, and that is the question to put to the company’s own counsel before signing.
Article 47(4) and Annex V point 8 of Regulation (EU) 2024/1689: record the signatory's mandate and the evidence reviewed in the same file as the declaration, so the signature can be traced to a decision rather than to a person.
04Does a system under two laws need two declarations?
No, it gets one, and that one document has to name every law it covers.
Article 47(3) of the AI Act requires a single EU declaration of conformity where the high-risk system is also subject to other Union harmonisation legislation that requires one, such as the machinery or medical device rules listed in Annex I. That single document must identify every piece of legislation it covers.
The CE marking follows the same logic. Article 48(5) says that where other Union law also provides for CE marking, the marking indicates that the system meets that law too. For AI inside a regulated product, Article 43(3) routes the assessment through the product legislation, so the team that already signs the product declaration usually becomes the team that signs the AI Act content as well.
05How long is the declaration kept, and when must it change?
For 10 years, and it has to change whenever it stops describing the system on the market.
Article 47(1) of the AI Act requires the provider to keep the declaration at the disposal of national competent authorities for 10 years after the system is placed on the market or put into service, and to hand a copy over on request. Article 18(1)(e) repeats the 10 year period, and Article 22(3)(b) gives the same duty to an authorised representative. Article 47(2) adds that it must be translated into a language the authorities in each Member State of sale can easily understand.
Article 47(4) also requires the provider to keep the declaration up to date. A retraining cycle that was predetermined and documented stays inside the original assessment. A substantial modification, defined in Article 3(23), triggers a new assessment under Article 43(4), and the declaration has to follow it. The same risk applies to a deployer who has become the provider through Article 25 and inherits a declaration it never signed.
A usable test for the person holding the pen: could you show, today, the evidence behind each of the six rows in the Annex V table above? If one row has no owner, the audit pack is incomplete and the signature is premature.
06Frequently asked questions
Can a notified body or consultant sign the AI Act declaration of conformity?
No. Article 47(1) gives the duty to the provider, and Annex V point 3 requires a statement that the declaration is issued under the provider's sole responsibility. A notified body appears in the declaration only as a reference under Annex V point 7, with its identification number and certificate.
Does the person who signs face a personal fine under the AI Act?
Not under Article 99 itself. The fines in Article 99 are imposed on operators, defined in Article 3(8) as providers, deployers, authorised representatives and similar parties. Whether a signatory carries personal liability is a question for national company, employment or criminal law, which the AI Act does not settle.
Does an AI medical device need two declarations, one under the MDR and one under the AI Act?
No. Article 47(3) requires a single EU declaration of conformity covering all Union law applicable to the high-risk AI system, and that document must identify each piece of harmonisation legislation it relates to.
When does the AI Act declaration of conformity have to be updated?
Whenever its content stops being accurate. Article 47(4) requires the provider to keep it up to date as appropriate, and a substantial modification under Article 43(4) triggers a new conformity assessment, which a new or revised declaration then has to reflect.
07References and method
- Regulation (EU) 2024/1689, Article 47 and Annex V, for the duty to draw up the declaration, the single declaration rule, the assumption of responsibility and the eight items the declaration must contain.
- Regulation (EU) 2024/1689, Articles 3(8), 3(23), 16(g), 18(1)(e), 22(3) and 48, for the definition of operator, substantial modification, the provider and authorised representative duties, the 10 year retention period and CE marking.
- Article 47, Annex V and Article 99 in the consolidated presentation, read in raw HTML on 25 September 2026 to separate current from superseded wording. Article 47 and Annex V show no amendment. Article 99 shows amended paragraph 1 and new paragraphs 4(da) and 6a.
- Regulation (EU) 2026/1744, for the amended Article 113(c) applying Chapter III Sections 1 to 3 from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, and for the new Article 99(6a) on small mid-cap enterprises. The EUR-Lex pages returned a bot check on 25 September 2026, so wording was read from the consolidated presentation.