EU AI Act Art.47 Simplified EU Declaration of Conformity: Annex I Embedded AI in Regulated Products — Developer Guide (2026)

EU AI Act Article 47 is the conformity chapter's bridge article for embedded AI. Where Art.48 defines the standard EU declaration of conformity (DoC) that every high-risk AI provider must draw up, Art.47 addresses a specific and increasingly common scenario: an AI system that is not a standalone product but is embedded as a safety component inside a product already regulated under EU product harmonisation law. For developers building AI into medical devices, machinery, toys, pressure equipment, or radio devices — Art.47 defines how to handle the DoC without duplicating paperwork across two separate regulatory regimes.

The practical effect of Art.47 is a consolidation right. Instead of maintaining one EU DoC for the product regulation and a separate EU DoC for the EU AI Act, Art.47 allows a single combined declaration that satisfies both. The combined declaration must meet the content requirements of both legal regimes simultaneously — the product regulation's declaration requirements and the EU AI Act's Annex V requirements. This is not a simplification of the compliance burden; it is a simplification of the documentation structure.

For SaaS developers, Art.47 is usually not the primary article — it applies to hardware-embedded AI, not cloud-served AI. But for AI companies providing models, inference APIs, or AI components that OEMs integrate into regulated products, Art.47 defines how the documentation consolidation works at the point where your AI becomes part of a CE-marked product.

Art.47 in the EU AI Act Conformity Framework

Art.47 sits between Art.46 (derogation from conformity assessment in exceptional circumstances) and Art.48 (standard EU Declaration of Conformity). Its position reflects that it is a variant of the standard DoC mechanism rather than a standalone obligation. Providers of Annex I embedded AI face the same underlying conformity assessment requirements as other high-risk AI providers — Art.43 assessment, Art.44 certification if notified body path applies — but handle the output documentation (the declaration) differently.

The key distinction: Art.47 applies when the high-risk AI system qualifies as a safety component of a product covered by Annex I Union harmonisation legislation. The AI system is not placed on the market independently — it is integrated into a product that is already subject to product-specific EU regulations. The product-level DoC absorbs the AI Act DoC.

Annex I Section A: Product Scope

Annex I of the EU AI Act, Section A, lists the Union harmonisation legislation whose product scope triggers Art.47's combined DoC mechanism. The key categories relevant for AI developers are:

Critical threshold: Art.47 applies only when the AI system functions as a safety component of the product under the relevant Annex I legislation. An AI-powered display overlay on a medical device is not a safety component; an AI-powered diagnostic algorithm that outputs clinical recommendations used for treatment decisions is. The "safety component" determination is made under the product regulation, not under the EU AI Act directly.

The Combined Declaration Mechanism

Art.47 operates through a single combined EU declaration of conformity that covers both the product regulation and the EU AI Act. The mechanism works as follows:

Step 1 — Complete EU AI Act conformity assessment. The AI system embedded in the product must still undergo the Art.43 conformity assessment appropriate to its category. For most Annex I embedded AI systems, the conformity assessment path will be determined by whether an Annex VII notified body assessment is required under Art.43(3) (Commission implementing act) or whether Annex VI self-assessment suffices.

Step 2 — Complete product regulation conformity assessment. Separately, the product (e.g., the medical device) undergoes its own conformity assessment under the applicable Annex I legislation (e.g., MDR Annex IX/X/XI procedures).

Step 3 — Draft a single combined declaration. Instead of drawing up two separate EU declarations of conformity — one for the MDR and one for the EU AI Act — the provider issues a single document that satisfies the content requirements of both legal regimes simultaneously.

Step 4 — The combined declaration serves as the Art.48 DoC. For CE marking under Art.49 and EU database registration under Art.32, the combined declaration functions identically to a standard Art.48 DoC. It is the authoritative document establishing compliance.

Who draws up the combined declaration? The entity that qualifies as the "provider" under both the EU AI Act (Art.3(3)) and the relevant Annex I product regulation. In many cases, this is the same legal entity — the manufacturer of the medical device or machinery who has also developed or commissioned the AI component. In cases where the AI component is supplied by a third party, Art.47's consolidated DoC mechanism applies at the level of the product manufacturer who integrates the AI component and takes responsibility for the combined product.

MDR + EU AI Act: Combined Declaration Structure

For medical device manufacturers integrating AI safety components, the combined DoC must satisfy both MDR 2017/745 and EU AI Act requirements.

MDR DoC requirements (Annex IV of MDR 2017/745):

• Name and address of the manufacturer
• Confirmation that the device conforms to MDR
• Classification and intended purpose of the device
• Applicable common specifications and harmonised standards
• Notified body name and certificate number (if applicable)
• Reference to regulations the declaration covers
• Place, date, name, and signature

EU AI Act additions required under Annex V:

• Name of the AI system and its version identifier
• Statement of conformity with Chapter III, Section 2 of the EU AI Act
• Reference to the conformity assessment procedure followed (Annex VI or Annex VII)
• References to harmonised standards applied under Art.40 (AI-specific standards, e.g., CEN/CLC JTC 21 outputs)
• References to common specifications under Art.41 (if applicable)
• Notified body reference under EU AI Act (may differ from MDR notified body — different designations)

Key complexity for MDR + AI Act combined declarations:

Different notified bodies. MDR notified bodies (designated under Art.37 MDR) and EU AI Act notified bodies (designated under Art.31 EU AI Act) are separately designated. A notified body designated under MDR is not automatically designated under the EU AI Act. If Track 2 / Annex VII assessment applies to the AI component, the provider may need a different notified body for the AI Act portion than for the MDR portion — both notified bodies must be referenced in the combined declaration.

Different assessment cycles. MDR certificates under Annex IX/X/XI typically run for five years. EU AI Act certificates under Art.44 run for whatever period the notified body specifies. The combined declaration must remain accurate across the different renewal cycles of both certificate types.

Classification divergence. A device that is Class IIa or IIb under MDR may host an AI system that is high-risk under EU AI Act Annex III but not necessarily subject to notified body assessment. The conformity path under each regulation must be determined independently before drafting the combined declaration.

Machinery Regulation + EU AI Act: Combined Declaration Structure

For machinery manufacturers, the Machinery Regulation 2023/1230 replaced the Machinery Directive 2006/42/EC with effect from January 2027 (phased-in). The combined DoC must satisfy Machinery Regulation requirements alongside EU AI Act requirements.

Machinery Regulation DoC requirements (Annex VI of Regulation (EU) 2023/1230):

• Name, address, and EU representative details of the manufacturer
• Description and identification of the machinery (name, model, serial number)
• Statement that the machinery conforms to Regulation (EU) 2023/1230
• Harmonised standards applied under Machinery Regulation (EN standards from TC 114 and others)
• Notified body reference (if applicable — Machinery Regulation requires notified body for Annex I highest-risk categories)
• Authorised signatory name, function, and signature

EU AI Act additions (Annex V):

• AI system version identifier (must track with firmware/software version of the safety logic)
• Art.40 harmonised standard references specific to AI (different standards track than mechanical EN standards)
• Conformity assessment path under EU AI Act (Annex VI or VII)
• If Track 2: EU AI Act notified body name and NANDO number

Machinery-specific complexity:

Safety logic as AI. Under the Machinery Regulation, safety functions that prevent hazardous conditions are subject to specific requirements. An AI system implementing a safety function (e.g., a collaborative robot that uses vision AI to detect human presence and trigger stop sequences) is simultaneously a Machinery Regulation safety component and potentially a high-risk AI system under Annex III of the EU AI Act. Both regulatory regimes apply, and the combined DoC must address both.

Version control. Machinery AI safety components are often subject to on-device firmware updates. Each firmware update that modifies the AI component must be assessed under the EU AI Act's Art.3(23) substantial modification definition. A version change that qualifies as substantial modification requires a new EU AI Act conformity assessment — and updates to the combined declaration.

Annex V Content Requirements (AI Act Portion)

Regardless of which Annex I product is involved, the EU AI Act's Annex V defines what must appear in the AI Act portion of any combined declaration. The Annex V minimum elements are:

Element 9 is the structural linchpin of Art.47 combined declarations. It is where the AI Act DoC references the Annex I product regulation, making explicit that a single declaration covers multiple legal regimes. Without Element 9, the document is not a valid combined declaration — it is only a standard Art.48 DoC.

Art.47 Intersection Matrix

CLOUD Act Jurisdiction Risk for Combined Records

For providers hosting their combined declaration records and related technical documentation on cloud infrastructure, the EU AI Act's data sovereignty concern intersects with the CLOUD Act risk at a specific point: combined declaration records for AI embedded in national security or law enforcement products are the most sensitive documentation in the conformity chain.

Under the US CLOUD Act, a US court can compel a US cloud provider (or a non-US provider with US-connected infrastructure) to produce data held on servers anywhere in the world. A combined EU DoC for an AI system embedded in, for example, a critical infrastructure monitoring device or a biometric identification system — both of which may trigger Art.47 combined declarations — contains:

• Detailed AI system architecture and version history
• Assessment procedures and outcomes
• Notified body identities and certificate details
• Reference to other Union harmonisation legislation applied

This documentation is exactly the kind that a national security investigation or law enforcement action might seek to compel. Maintaining combined declaration records — and the technical documentation they reference — on EU-native infrastructure that is not subject to CLOUD Act compellability is not just a best practice under the EU AI Act; for Annex I products in sensitive categories, it is a compliance risk management obligation.

Hosting combined records on EU PaaS infrastructure with no US parent entity eliminates the CLOUD Act compellability risk for declaration records while satisfying Art.18's 10-year retention requirement under a single regime.

Python Implementation

from dataclasses import dataclass, field
from datetime import date
from enum import Enum
from typing import Optional
import hashlib
import json


class AnnexIProductCategory(Enum):
    MEDICAL_DEVICE_MDR = "MDR_2017_745"
    IVDR = "IVDR_2017_746"
    MACHINERY = "MACHINERY_REG_2023_1230"
    TOYS = "TOYS_DIR_2009_48"
    RECREATIONAL_CRAFT = "CRAFT_DIR_2013_53"
    LIFTS = "LIFTS_DIR_2014_33"
    ATEX = "ATEX_DIR_2014_34"
    RADIO_EQUIPMENT = "RED_DIR_2014_53"
    PRESSURE_EQUIPMENT = "PED_DIR_2014_68"
    PPE = "PPE_REG_2016_425"
    GAS_APPLIANCES = "GAS_REG_2016_426"


class ConformityAssessmentPath(Enum):
    ANNEX_VI_INTERNAL = "Annex VI — Internal control"
    ANNEX_VII_NOTIFIED_BODY = "Annex VII — Notified body assessment"


@dataclass
class NotifiedBodyReference:
    """Reference to a notified body under a specific regulation."""
    name: str
    nando_number: str
    regulation: str  # "EU_AI_ACT" or the Annex I product regulation identifier
    certificate_number: Optional[str] = None
    certificate_date: Optional[date] = None


@dataclass
class HarmonisedStandardReference:
    """Reference to a harmonised standard applied."""
    standard_id: str       # e.g., "EN ISO 13485:2016" or "ISO/IEC 42001:2023"
    standard_title: str
    publication_date: date
    regulation_scope: str  # "EU_AI_ACT", "MDR", "MACHINERY", etc.


@dataclass
class AnnexIProductDoC:
    """
    Combined EU Declaration of Conformity for Art.47 — AI system as safety
    component in an Annex I regulated product.

    Satisfies both Annex V of the EU AI Act and the DoC requirements of
    the applicable Annex I product regulation.
    """
    # Provider details
    provider_name: str
    provider_address: str
    authorised_representative: Optional[str] = None  # Art.22

    # AI system identification (Annex V elements 1-2)
    ai_system_name: str = ""
    ai_system_version: str = ""
    ai_system_type: str = ""

    # Annex I product details
    product_name: str = ""
    product_model: str = ""
    product_serial: Optional[str] = None
    annex_i_category: AnnexIProductCategory = AnnexIProductCategory.MACHINERY

    # Conformity statements
    ai_act_conformity_statement: str = (
        "The AI system identified above conforms with the requirements of "
        "Chapter III, Section 2 of Regulation (EU) 2024/1689 (EU Artificial "
        "Intelligence Act)."
    )

    # Assessment paths
    ai_act_assessment_path: ConformityAssessmentPath = (
        ConformityAssessmentPath.ANNEX_VI_INTERNAL
    )
    product_assessment_reference: str = ""  # e.g., "MDR Annex IX"

    # Notified bodies (may differ per regulation)
    notified_bodies: list[NotifiedBodyReference] = field(default_factory=list)

    # Standards applied
    harmonised_standards: list[HarmonisedStandardReference] = field(default_factory=list)

    # Declaration details
    place_of_issue: str = ""
    date_of_issue: date = field(default_factory=date.today)
    signatory_name: str = ""
    signatory_function: str = ""

    def validate_annex_v_elements(self) -> list[str]:
        """
        Validate that all required Annex V elements are present.
        Returns list of missing elements.
        """
        missing = []
        if not self.provider_name:
            missing.append("Element 1: Provider name missing")
        if not self.ai_system_name or not self.ai_system_version:
            missing.append("Element 2: AI system identification incomplete (name + version required)")
        if not self.ai_act_conformity_statement:
            missing.append("Element 3: Conformity statement missing")
        if not self.ai_act_assessment_path:
            missing.append("Element 4: Assessment procedure reference missing")
        ai_standards = [s for s in self.harmonised_standards
                        if s.regulation_scope == "EU_AI_ACT"]
        if not ai_standards:
            missing.append("Element 5: No AI Act harmonised standards referenced")
        if not self.annex_i_category:
            missing.append("Element 9: Annex I product regulation not specified")
        if not self.signatory_name or not self.signatory_function:
            missing.append("Element 10: Signatory details incomplete")

        # Validate notified body reference if Track 2
        if self.ai_act_assessment_path == ConformityAssessmentPath.ANNEX_VII_NOTIFIED_BODY:
            ai_nb = [nb for nb in self.notified_bodies
                     if nb.regulation == "EU_AI_ACT"]
            if not ai_nb:
                missing.append("Element 7: EU AI Act notified body reference required for Annex VII path")
            else:
                ai_nb_ref = ai_nb[0]
                if not ai_nb_ref.certificate_number:
                    missing.append("Element 8: Art.44 certificate number required for Track 2")
        return missing

    def has_different_notified_bodies(self) -> bool:
        """
        Check if AI Act and Annex I product notified bodies differ.
        Relevant for compliance complexity flagging.
        """
        ai_nbs = {nb.nando_number for nb in self.notified_bodies
                  if nb.regulation == "EU_AI_ACT"}
        product_nbs = {nb.nando_number for nb in self.notified_bodies
                       if nb.regulation != "EU_AI_ACT"}
        return bool(ai_nbs and product_nbs and not ai_nbs.intersection(product_nbs))

    def generate_document_hash(self) -> str:
        """
        Generate SHA-256 hash of the declaration content for integrity tracking.
        """
        content = {
            "provider": self.provider_name,
            "ai_system": f"{self.ai_system_name}:{self.ai_system_version}",
            "product": f"{self.product_name}:{self.product_model}",
            "annex_i_category": self.annex_i_category.value,
            "date_of_issue": self.date_of_issue.isoformat(),
            "assessment_path": self.ai_act_assessment_path.value,
        }
        return hashlib.sha256(
            json.dumps(content, sort_keys=True).encode()
        ).hexdigest()

    def to_combined_declaration_text(self) -> str:
        """
        Generate the combined declaration text referencing both regulations.
        """
        lines = [
            "EU DECLARATION OF CONFORMITY",
            "(Combined — Regulation (EU) 2024/1689 + "
            f"{self.annex_i_category.value})",
            "",
            f"Provider: {self.provider_name}",
            f"Address: {self.provider_address}",
        ]
        if self.authorised_representative:
            lines.append(f"Authorised Representative: {self.authorised_representative}")
        lines += [
            "",
            "This declaration of conformity is issued under the sole "
            "responsibility of the provider identified above.",
            "",
            "Object of the Declaration:",
            f"  AI System: {self.ai_system_name} (Version: {self.ai_system_version})",
            f"  Product: {self.product_name} (Model: {self.product_model})",
            f"  Annex I Category: {self.annex_i_category.value}",
            "",
            "Declaration:",
            self.ai_act_conformity_statement,
            f"  Assessment path: {self.ai_act_assessment_path.value}",
            f"  Product assessment: {self.product_assessment_reference}",
        ]
        if self.harmonised_standards:
            lines.append("")
            lines.append("Harmonised Standards Applied:")
            for std in self.harmonised_standards:
                lines.append(
                    f"  [{std.regulation_scope}] {std.standard_id}: "
                    f"{std.standard_title} ({std.publication_date})"
                )
        if self.notified_bodies:
            lines.append("")
            lines.append("Notified Bodies:")
            for nb in self.notified_bodies:
                cert_ref = ""
                if nb.certificate_number:
                    cert_ref = f" | Certificate: {nb.certificate_number} ({nb.certificate_date})"
                lines.append(
                    f"  [{nb.regulation}] {nb.name} (NANDO: {nb.nando_number}){cert_ref}"
                )
        lines += [
            "",
            f"Place: {self.place_of_issue}",
            f"Date: {self.date_of_issue.isoformat()}",
            f"Signed by: {self.signatory_name}, {self.signatory_function}",
            "",
            f"Document integrity hash (SHA-256): {self.generate_document_hash()}",
        ]
        return "\n".join(lines)


@dataclass
class CombinedConformityRecord:
    """
    Tracks Art.47 combined declaration records over the 10-year retention period.
    Maps to Art.18 record-keeping obligations.
    """
    doc: AnnexIProductDoC
    storage_location: str          # EU-native infrastructure preferred
    retention_deadline: date       # date_of_issue + 10 years (Art.18)
    last_validated: date = field(default_factory=date.today)
    substantial_modification_dates: list[date] = field(default_factory=list)

    def is_within_retention_period(self) -> bool:
        return date.today() <= self.retention_deadline

    def requires_update_check(self, modification_date: date) -> bool:
        """
        Flag whether a firmware/model update requires assessment of substantial
        modification under Art.3(23) — which would trigger a new combined DoC.
        """
        # Any modification after the last validation date requires review
        return modification_date > self.last_validated


def validate_art47_eligibility(
    ai_system_annex_iii_category: str,
    product_category: AnnexIProductCategory,
    ai_is_safety_component: bool,
) -> dict:
    """
    Check whether a product + AI combination qualifies for Art.47 combined DoC.
    """
    if not ai_is_safety_component:
        return {
            "eligible": False,
            "reason": "AI system is not a safety component of the product. "
                      "Art.47 applies only to AI safety components under Annex I "
                      "product legislation. Non-safety AI in regulated products "
                      "requires separate Art.48 DoC.",
        }
    if not annex_iii_category:
        return {
            "eligible": False,
            "reason": "AI system is not listed as high-risk in Annex III. "
                      "Only high-risk AI systems require a DoC under Art.47/48.",
        }
    return {
        "eligible": True,
        "combined_doc_required": True,
        "product_category": product_category.value,
        "ai_category": ai_system_annex_iii_category,
        "note": "Draw up single combined DoC satisfying both Annex V (EU AI Act) "
                "and the DoC requirements of the applicable Annex I legislation.",
    }

Common Mistakes with Art.47 Combined Declarations

Mistake 1: Treating the combined declaration as optional. Art.47 does not make a combined declaration optional for Annex I product AI safety components — it defines how the declaration is structured. Providers who draw up two separate declarations (one for the product regulation, one for the EU AI Act) are not in violation, but they are creating unnecessary documentation overhead. The combined approach is the intended mechanism.

Mistake 2: Using different version identifiers across the two regulatory portions. The product technical file references the AI component as integrated into product version X.Y. The EU AI Act DoC must reference the same AI system version X.Y. A mismatch between the version in the Annex I product DoC and the version in the EU AI Act Annex V portion creates an evidentiary gap that market surveillance can exploit.

Mistake 3: Assuming one notified body covers both regimes. MDR notified bodies are not automatically designated under the EU AI Act. If Annex VII assessment is required for the AI component, the provider must engage a notified body with EU AI Act designation — which may be a different organisation entirely from the MDR notified body. The combined declaration must reference both.

Mistake 4: Failing to update the combined declaration after AI model updates. For embedded AI systems that receive model or firmware updates (e.g., a medical device AI that is retrained annually), each update must be assessed under Art.3(23) substantial modification. If the update constitutes a substantial modification, the EU AI Act portion of the combined declaration must be redrawn — while the Annex I product DoC may or may not require updating depending on the product regulation's own rules on changes.

Mistake 5: Retaining combined declaration records on non-EU infrastructure. The 10-year retention obligation under Art.18 intersects with the CLOUD Act compellability risk for Annex I product declarations — especially for medical devices or machinery in critical infrastructure. Combined declarations that reference national security-relevant AI deployments should be stored on EU-native infrastructure with no US parent entity exposure.

Art.47 Compliance Checklist (30 Items)

Eligibility (Items 1–5)

• 1. AI system is classified as high-risk under Annex III EU AI Act
• 2. AI system functions as a safety component of an Annex I product
• 3. Annex I product category identified and applicable legislation confirmed
• 4. "Safety component" determination documented under the Annex I product regulation
• 5. Decision made to use combined declaration (vs. two separate declarations)

AI Act Conformity Assessment (Items 6–11)

• 6. Art.43 conformity assessment path determined (Annex VI or Annex VII)
• 7. If Annex VII: EU AI Act notified body engaged and designated
• 8. Art.43 conformity assessment completed before DoC is drawn up
• 9. Technical documentation under Annex IV prepared for AI component
• 10. Risk management file under Art.9 prepared for AI component
• 11. QMS under Art.17 covers AI component lifecycle

Product Regulation Conformity (Items 12–15)

• 12. Annex I product regulation conformity assessment completed
• 13. Product regulation notified body engaged (if required)
• 14. Product technical file includes AI component description
• 15. Coordination between AI Act and product regulation assessment established

Combined Declaration Content — Annex V (Items 16–25)

• 16. Provider name and address included (Annex V Element 1)
• 17. AI system name, type, and version identifier included (Element 2)
• 18. Conformity statement covering Chapter III, Section 2 included (Element 3)
• 19. Assessment procedure reference (Annex VI or VII) included (Element 4)
• 20. AI Act harmonised standards with version numbers included (Element 5)
• 21. Common specifications referenced if applicable (Element 6)
• 22. EU AI Act notified body name and NANDO number included (Element 7, if Track 2)
• 23. Art.44 certificate number and date included (Element 8, if Track 2)
• 24. Annex I product regulation identified as other Union legislation (Element 9)
• 25. Authorised signatory name, function, and signature included (Element 10)

Record-Keeping and Lifecycle (Items 26–30)

• 26. Combined declaration retention period set to 10 years from market placement
• 27. Combined declaration stored on EU-native infrastructure
• 28. Version control process established for AI component updates
• 29. Substantial modification assessment process documented for AI model/firmware changes
• 30. Procedure established for reissuing combined declaration after substantial modification

Art.47 is the conformity chapter's answer to the reality that AI does not exist in isolation — it is increasingly embedded in products that already carry regulatory obligations. The combined declaration mechanism avoids the duplication of two separate EU DoCs while ensuring that the substantive compliance requirements of both the EU AI Act and the applicable Annex I product regulation are fully addressed. For embedded AI developers, Art.47 is the legal basis for treating the product manufacturer — not the AI component supplier — as the primary responsible party for the combined declaration, while ensuring the AI supplier's technical documentation and conformity assessment remain independently complete.