Builds on AR-000142 (Human Oversight), AR-000210 (High-Risk AI Systems), and AR-000230 (Transparency) — none of their content is re-derived here. This article focuses specifically on the procedural obligations Article 16 adds: quality management, conformity assessment, declaration of conformity, CE marking, registration, and corrective action.
Executive summary
What this means
Who this applies to
Regulatory context
Quality management system (Article 17)
Conformity assessment (Article 43)
EU declaration of conformity (Article 47)
CE marking (Article 48)
Registration (Article 49)
Corrective actions and duty of information (Article 20)
Requirements
What organizations must do
- Build the Article 17 quality management system first — it explicitly incorporates the Article 9 risk management system and Article 72 post-market monitoring plan.
- Determine early which Annex III point (or Annex I Section A sectoral regime) the system falls under — this determines whether a notified body is required at all.
- Treat the EU declaration of conformity as a formal legal commitment, not a routine administrative form — Article 47(4) makes drawing it up the act that assumes legal responsibility.
- Map systems against the Article 49(4) restricted-database categories early — registration mechanics differ materially by category.
- Build internal escalation procedures that can act on the Article 20 corrective-action duty proactively — it is triggered by the provider's own belief, not a regulator's finding.
Common mistakes
Treating conformity assessment as a single uniform process is a common error — which Annex III point a system falls under, and whether it's also covered by Annex I Section A sectoral legislation, changes whether internal control alone suffices or a notified body is required.
Assuming the EU declaration of conformity is purely descriptive, rather than an assumption of legal responsibility, is a second mistake — Article 47(4) makes drawing it up the point at which the provider takes on responsibility for compliance.
Registering a high-risk system in the general EU database when it falls under the restricted-category or national-level rules is a third mistake — the registration channel is not one-size-fits-all.
Waiting for a market surveillance authority to flag non-conformity before acting is a fourth mistake — Article 20(1)'s duty is triggered by the provider's own awareness or reasonable grounds to suspect non-conformity, independent of any external finding.
Open questions
- Whether the Digital Omnibus changed Article 43's conformity-assessment mechanics, beyond the already-confirmed high-risk application-date shift. Article 43's Service Desk page carries the Omnibus disclaimer; whether anything else changed is unconfirmed.
- Whether Articles 16, 17, 20, 47, 48, and 49 are genuinely unamended by the Omnibus, given the absence of disclaimers on their Service Desk pages — consistent with the pattern already noted in AR-000230 for Article 13, not treated as confirmation.
- Whether any harmonised standard now simplifies Article 17 quality management system compliance — not re-checked on this pass; AR-000142's finding (no AI Act standard yet cited in the Official Journal) should be treated as still governing unless independently re-verified.