SPRINKLING ACT · GLOSSARY
Human in the Map, Conformity Assessment & Certification
Three distinct things, routinely confused
Last updated: March 24, 2026
The EU AI Act introduces a layered regulatory framework where different actors perform different roles. Confusion between these roles creates legal risk. This glossary defines the three critical distinctions that every AI system deployer and provider must understand.
WHAT SPRINKLING ACT PRODUCES
1. Human in the Map
Human in the Map is an independent examination of one workflow that already runs on AI. It renders what actually happens in that chain, dated, along with what each finding rests on.
- Covers one workflow, the one the executive names, from human input to used output.
- Built from the elements you provide, exports, version history, dated files, the procedure as written, and from interviews reconstructed episode by episode.
- Nothing is installed, no agent runs in your environment, nothing remains afterwards.
- Each finding carries a proof status. An uncorroborated statement is marked as such, and a gap is established only after a second source of a different kind.
- Every family of findings carries an expiry date, because a chain that keeps running stops matching its description.
- Does not constitute legal advice, a compliance audit, or regulatory certification. We measure, we do not resolve.
THE FORMAL ART. 43 EU AI ACT PROCESS
2. Conformity Assessment
A Conformity Assessment is the formal procedure defined in Article 43 of the EU AI Act through which a high-risk AI system is evaluated against the requirements set out in Chapter III, Section 2 (Articles 8–15).
- Required for high-risk AI systems as classified under Article 6 and listed in Annex III.
- Can be performed via internal conformity assessment (based on Annex VI) or via third-party conformity assessment involving a Notified Body (based on Annex VII).
- Third-party assessment is mandatory for high-risk AI systems covered by Article 6(1), those falling under Union harmonisation legislation listed in Annex I, Section A.
- For Annex III systems, providers may generally use internal assessment, except for biometric identification systems (Annex III, point 1), which require Notified Body involvement.
- Must be completed before the AI system is placed on the market or put into service.
- Results in a Declaration of Conformity (Art. 47) and CE marking (Art. 48).
WHAT ONLY NOTIFIED BODIES CAN DELIVER
3. Certification
Certification is the formal attestation issued by a Notified Body, an independent organisation designated by a Member State under Article 28, confirming that a high-risk AI system meets the requirements of the AI Act.
- Only Notified Bodies designated under Article 28 and meeting the requirements of Article 31 can issue certifications.
- Notified Bodies must be accredited by national accreditation bodies and formally notified to the European Commission.
- Certification involves a quality management system assessment and a technical documentation assessment of the AI system (Annex VII).
- Certificates are valid for a maximum of 5 years and can be renewed (Art. 44).
- Certification can be suspended or withdrawn if the system no longer meets the requirements (Art. 44(4)).
- No private company, consultancy, or assessment tool can issue a conformity certificate: this is exclusively a Notified Body function.
Comparison at a Glance
| Human in the Map | Conformity Assessment | Certification | |
|---|---|---|---|
| Who performs it | Independent measurement (e.g. Sprinkling Act) | Provider (internal) or Notified Body (third-party) | Notified Body only |
| Legal basis | None · voluntary | Art. 43 EU AI Act | Art. 44, Annex VII EU AI Act |
| Output | A dated report on one workflow, with a proof status per finding | Declaration of Conformity + CE marking | Conformity certificate |
| Legal effect | Informational · not binding | Mandatory for market access (high-risk) | Formal attestation of compliance |
| Scope | One workflow that already runs on AI | High-risk AI systems only (Art. 6 + Annex III) | High-risk systems requiring third-party assessment |
| Timing | While the material is still recent | Before placing on market / putting into service | As part of third-party conformity assessment |
Important Disclaimer
Sprinkling Act produces dated reports on a single workflow, not certifications. Our reports describe what happens in a chain where a machine has taken part of the work, with the evidence each finding rests on. They do not constitute conformity assessments under Article 43, they do not replace the involvement of Notified Bodies where required, and they do not constitute legal advice. Organisations deploying high-risk AI systems must follow the formal conformity assessment procedures defined in the AI Act.
AI Act References
- Article 6 · Classification rules for high-risk AI systems
- Article 43 · Conformity assessment for high-risk AI systems
- Article 44 · Certificates issued by Notified Bodies
- Article 47 · EU Declaration of Conformity
- Article 48 · CE marking
- Annex I · Union harmonisation legislation (Section A)
- Annex III · High-risk AI systems (areas of use)
- Annex VI · Internal conformity assessment procedure
- Annex VII · Conformity assessment based on assessment of quality management system and technical documentation
Six questions, two minutes, no account: what supports what you know about your deployment.