Category: Compliance & Audit

Presumption of Conformity

Simply put

Presumption of conformity is a legal concept in EU law under which an AI system (or organization) that follows certain officially recognized standards is treated as meeting the corresponding legal requirements. This makes compliance more predictable, because following the published standards is accepted as evidence of meeting the law. Importantly, it is a presumption and not an absolute guarantee, so it can be challenged.

Formal definition

In the context of the EU AI Act, presumption of conformity is a mechanism whereby an AI system, process, or assessment organization that conforms to harmonised standards (references to which are published in the EU's Official Journal) is presumed to comply with the applicable legal requirements those standards cover. Per the evidence, this simplifies demonstrating compliance by allowing observance of the relevant standards to serve as evidence of conformity, rather than requiring bespoke demonstration against the legal text itself. The presumption is rebuttable, not an irrefutable fiction: a product may be sufficiently safe without applying the standard, and conversely the presumption can in principle be contested. The precise scope, conditions, and the specific harmonised standards that trigger this presumption under the AI Act are determined by the applicable legal instrument and the standards published in the Official Journal; this entry does not enumerate those specific standards, article-level conditions, or effective dates, which should be verified against primary sources.

Why it matters

Presumption of conformity matters because it converts an otherwise open-ended compliance question — does this AI system satisfy the legal requirements? — into a more predictable exercise. Under the EU AI Act, when a system conforms to harmonised standards whose references are published in the EU's Official Journal, it is presumed to comply with the corresponding legal requirements those standards cover. For organizations building or deploying high-risk AI systems, this offers a defined route to demonstrate compliance by observing published standards rather than constructing a bespoke argument directly against the legal text. This tends to reduce uncertainty and cost, and it gives developers, notified bodies, and regulators a common reference point.

The concept also carries an important limitation that professionals should not overlook: it is a presumption, not a guarantee. As the evidence notes, the presumption of conformity is not an irrefutable fiction, and a product can be sufficiently safe even without applying the relevant standard. Conversely, the presumption can in principle be contested. Following a harmonised standard therefore reduces and helps manage compliance risk, but it does not eliminate legal exposure or the possibility that a system is later found non-conforming despite adherence to the standard.

The precise scope of the presumption depends on the applicable legal instrument and on which harmonised standards are actually published in the Official Journal. Because the set of standards, the article-level conditions, and any effective dates are determined by primary sources rather than by this entry, organizations relying on the presumption should verify current standards and conditions directly, and should treat the presumption as a rebuttable mechanism rather than a settled shield against enforcement.

Who it's relevant to

Compliance officers and regulatory affairs specialists

For those responsible for demonstrating that an AI system meets EU AI Act requirements, the presumption of conformity offers a defined compliance route: showing adherence to the relevant harmonised standards published in the Official Journal. They should track which standards are actually published and treat the presumption as rebuttable rather than as a definitive guarantee of legal compliance.

AI system developers and deployers of high-risk systems

Developers and deployers can use conformity with harmonised standards to simplify how they evidence compliance, rather than arguing directly against the legal text. However, because the presumption can be contested and a system may be sufficiently safe without applying a particular standard, teams should not assume that standard adherence alone forecloses all compliance risk.

Notified bodies and assessment organizations

The evidence indicates the concept extends to assessment organizations that demonstrate they meet approved EU standards published in the Official Journal, which is relevant to bodies involved in conformity assessment. Such organizations should confirm the specific standards and conditions applicable to them against primary sources.

Legal and audit professionals

Legal advisers and auditors evaluating an organization's AI Act posture need to understand that the presumption is rebuttable, not absolute. This affects how they assess residual legal exposure, advise on documentation, and evaluate whether reliance on a given standard is sufficient given that the specific triggering standards and conditions must be verified against the applicable legal instrument.

Inside Presumption of Conformity

Legal Effect of Conformity Presumption

A mechanism under which a product or system that follows a designated technical standard is presumed to comply with the corresponding legal requirements, shifting the practical burden of demonstrating conformity. As commonly framed in EU product legislation, this is a rebuttable presumption rather than an irrebuttable guarantee of legal compliance.

Harmonized or Designated Standards

The presumption typically attaches to standards that a competent authority has formally designated or harmonized against specific legal requirements. Following a general industry standard that has not been so designated does not, on its own, trigger the presumption.

Scope Limitation to Covered Requirements

The presumption usually covers only those legal requirements that the relevant standard addresses. Requirements not covered by the standard remain subject to separate demonstration of conformity, so the presumption is rarely comprehensive across all obligations.

Rebuttability

Authorities may generally challenge or rebut the presumption where evidence suggests that a product or system does not in fact meet the underlying requirements, notwithstanding adherence to the standard.

Relationship to Conformity Assessment

The presumption interacts with, but does not necessarily replace, applicable conformity assessment or documentation obligations. Its availability and effect depend on the specific legal instrument and jurisdiction and should not be assumed to be uniform across frameworks.

Common questions

Answers to the questions practitioners most commonly ask about Presumption of Conformity.

Does a presumption of conformity mean my AI system is automatically compliant and cannot be challenged?

No. As commonly used in EU product legislation, a presumption of conformity means that following a relevant harmonized standard leads authorities to presume the corresponding legal requirements are met, which shifts the practical burden. It is a rebuttable presumption, not a guarantee: a market surveillance authority can still challenge conformity, and the presumption can be overturned if the system is shown not to meet the underlying legal requirements. It also does not certify that the system is free of risk.

Is applying a harmonized standard the same thing as being legally required to use that standard?

Not in most frameworks that use this mechanism. Harmonized standards are typically voluntary to apply; you are generally not obligated to use them. The obligation is to meet the legal requirements themselves. The standard offers one route to demonstrate compliance and to obtain the presumption, but an organization may in principle meet the requirements by other means, though it would then not benefit from the presumption and would carry a heavier evidentiary burden.

How do we determine which standards actually confer a presumption of conformity?

Confirm whether a given standard has been formally recognized for this purpose under the applicable legal instrument, since only standards designated through the relevant official process typically trigger the presumption. Check the current designated references, note the version cited, and be aware that this status can change over time. Where you are uncertain whether a specific standard has been designated, treat that as an open question to verify rather than assume.

What documentation should we retain to rely on a presumption of conformity?

Maintain evidence that shows how the applied standard maps to the underlying legal requirements, which version of the standard was used, and the results demonstrating adherence. Because the presumption is rebuttable, retain records that would support your position if a supervisory authority questions conformity. Governance and model risk management practitioners often coordinate here so that validation and control evidence aligns with the conformity claim; note that documentation reduces but does not eliminate the risk of challenge.

What happens if we only partially apply a standard or a standard is later withdrawn?

The presumption typically applies only to the extent that the relevant parts of the standard have been applied, so partial application may yield only a partial presumption, with remaining requirements needing separate demonstration. If a standard is superseded or its designated status is withdrawn, the presumption tied to it can lapse, which may require reassessment against the current requirements. Track the lifecycle of the standards you rely on.

How does a presumption of conformity interact with our internal governance and model risk management processes?

It relates to but does not replace them. A presumption of conformity concerns demonstrating compliance with external legal requirements, whereas AI governance concerns internal accountability structures and oversight, and model risk management concerns identifying, measuring, monitoring, and controlling model risk. Meeting the standard can inform these processes, but relying on the presumption does not discharge ongoing internal validation, monitoring, and oversight obligations, which serve broader purposes than the conformity claim.

Common misconceptions

A presumption of conformity means a product is legally guaranteed to be compliant and cannot be challenged.

As commonly defined in EU product legislation, the presumption is typically rebuttable. It shifts the practical burden but does not provide an absolute guarantee; authorities may still challenge conformity where evidence indicates the requirements are not met.

Following any recognized industry or international standard automatically confers a presumption of conformity.

The presumption generally attaches only to standards formally designated or harmonized against specific legal requirements by a competent authority. Adherence to a standard that lacks this designation does not, by itself, trigger the presumption.

Once the presumption applies, no further compliance work or documentation is needed.

The presumption typically covers only the requirements addressed by the relevant standard. Obligations outside that scope, as well as applicable conformity assessment and documentation duties, may still need to be satisfied separately depending on the instrument and jurisdiction.

Best practices

Verify that the standard you rely on has been formally designated or harmonized against the specific legal requirements at issue, rather than assuming general industry standards suffice to trigger the presumption.

Map each applicable legal requirement to the standard clauses that address it, and identify requirements left uncovered so they can be demonstrated through separate means.

Treat the presumption as rebuttable and maintain supporting evidence of actual conformity, so you can substantiate compliance if an authority challenges it.

Confirm the jurisdiction and specific legal instrument under which the presumption operates, since its availability, scope, and effect are not uniform across frameworks.

Continue to meet applicable conformity assessment and documentation obligations, rather than assuming the presumption removes those duties.

Monitor updates to designated standards and their referencing legal instruments, and reassess whether existing conformity claims remain supported when standards or requirements change.