Conformity Assessment

Conformity assessment is the process of demonstrating whether a technology product, service, system or related process fulfils specified requirements. These requirements may come from legislation, technical regulations, standards or contracts. It is an umbrella concept covering activities such as testing, inspection and certification, rather than being synonymous with certification alone.

How conformity is assessed

A conformity assessment scheme specifies what must be assessed, who may assess it, what evidence is required and how conformity is recorded.

• The applicable requirements and assessment scope are identified, including the product version and intended use.
• Evidence is obtained through methods such as testing, inspection, sampling, documentation review or process audit.
• The evidence is reviewed and a decision is made on whether the requirements have been fulfilled.
• Depending on the scheme, conformity may be recorded through a supplier declaration, certificate, approval or conformity mark; surveillance or reassessment may follow.

Who performs the assessment

The required degree of independence usually reflects the product's risks and the governing regulatory scheme.

• In first-party assessment, the supplier assesses and declares conformity of its own product.
• In second-party assessment, a purchaser or another interested user performs the assessment.
• In third-party assessment, an independent body performs activities such as testing, inspection or certification.
• Accreditation formally demonstrates the competence, impartiality and consistent operation of a conformity assessment body; it is distinct from certification of the product itself.

Application to regulated technologies

For software and AI systems, assessment may examine both the technical system and the provider's lifecycle controls. Applicable evidence can cover risk management, data governance, documentation, performance testing, cybersecurity and human oversight.

• The regulator determines whether supplier self-assessment is sufficient or whether an independent assessment is mandatory.
• Assessment can support market access, regulatory approval and trust by creating documented, comparable evidence of compliance.
• A conformity decision does not prove that a product is risk-free; it establishes compliance with the specified requirements and assessed scope at the relevant time.
• Updates or material changes may require renewed assessment, while monitoring helps identify problems after deployment.