Putting Your AI System on the Market

How is the EU AI Act governed and enforced?
The Act uses a multi-layered governance system to ensure everything runs smoothly. At the top, the European Artificial Intelligence Board (EAIB) acts like an orchestral conductor, co-ordinating implementation across member states, while the European AI Office provides technical expertise, especially for general-purpose AI. At the local level, each country has National Competent Authorities who serve as your primary contacts. These authorities have serious market surveillance powers, meaning they can:

Additionally, private organisations known as Notified Bodies are authorised to step in when third-party assessments are required. For global organisations, this can be complex since different national authorities might interpret things slightly differently. The best approach is to be proactive and build relationships with regulators early on rather than waiting for a problem to arise.

What is the process for conformity assessment and CE marking?
Think of a conformity assessment as a driving test for your AI. You must prove it meets all requirements before it can be deployed. There are two main paths: self-assessment, where you evaluate compliance and document everything internally, and third-party assessment, where an external Notified Body independently verifies your work. Self-assessment is common for recruitment or financial services AI, while third-party checks are mandatory for higher-risk cases like biometric identification or critical safety components. Once you pass the assessment, you prepare an EU declaration of conformity, which is your way of taking legal responsibility for the system. Finally, you affix the CE marking—this acts as your AI’s 'passport', allowing it to be sold and used across the European market. Because these assessments can add weeks or even months to your timeline, it's vital to start your documentation early so it doesn't become a bottleneck.

What are your ongoing post-market obligations after launch?
Compliance doesn't end the moment your AI hits the market - you need to maintain "continuous vigilance." This involves mandatory monitoring of system performance, user feedback, and any emerging risks. If a serious incident occurs (e.g. major disruption to infrastructure or serious harm) you must report it to the authorities within a strict 72-hour window.

Even after launch, your responsibilities continue in several ways:

For example, if a credit scoring AI starts making odd decisions due to outdated data, you must act immediately by stopping those decisions, notifying the provider, and potentially reporting the pattern to regulators.