Internal Control Procedure

What the Internal Control Procedure Actually Does

The internal control procedure is the self-assessment route for most Annex III high-risk AI systems. The provider checks its own quality management system, prepares the technical file, and registers the system directly unless a notified body is required.

This matters because it is not just a filing step. It is the compliance path that places primary responsibility on the provider to prove conformity, maintain the underlying controls, and produce the evidence expected by the EU AI Act.

Where It Sits in the EU AI Act Conformity Process

For most high-risk systems, the internal control procedure is the default conformity assessment route. It sits between design and market entry, turning the provider’s internal governance, testing, and documentation into the basis for declaration of conformity.

That structure makes the procedure especially important for Annex III systems, where the legal question is often not whether controls exist in theory, but whether they have been implemented, verified, and documented well enough to support self-assessment.

The difference from an external assessment is practical as well as legal. A provider can move faster with internal control, but it also carries the burden of making sure its evidence is complete enough to withstand regulatory scrutiny later.

What Providers Must Be Able to Show

The procedure assumes that the provider can evaluate its own controls in a disciplined way. That means the quality management system, technical documentation, risk management evidence, and post-market processes all need to align, not just exist as separate artifacts.

A useful way to think about the procedure is as an internal proof package. If the system is challenged by a regulator, customer, or auditor, the provider needs to show how the system was designed, tested, controlled, and approved under a documented process rather than ad hoc judgment.

That is why it also connects to broader control disciplines such as segregation of duties and internal governance. NHIMG’s Segregation of Duties (SoD) Guide is a useful companion where the same organisation needs to prevent one team from designing, approving, and releasing controls without challenge.

How It Affects Evidence, Accountability, and Market Entry

The internal control procedure compresses accountability into the provider’s own organisation, which is efficient but unforgiving. If the technical documentation is thin, the QMS is weak, or the conformity basis is unclear, the problem does not disappear because no external body was involved.

In practice, the procedure also shapes how teams work across legal, compliance, engineering, and product functions. The provider must be able to register confidently, support the declaration of conformity, and keep the evidence current as the system changes.

For readers mapping the legal obligation back to primary source text, the EU AI Act regulatory framework is the canonical reference for the high-risk system regime and its conformity pathways.

Risk and Threat Considerations

The main risk is that self-assessment can create a false sense of completeness. If the provider’s internal controls are weak, the procedure can turn into paper compliance, where documentation looks formal but does not accurately reflect how the system was built, tested, or governed.

Failure mechanism: Gaps in quality management, undocumented design decisions, weak evidence trails, or poorly controlled changes can lead to a flawed conformity assessment that survives internally but fails under external review.

Impact: The result can be delayed market access, regulatory findings, forced remediation, and loss of trust in the system’s declared compliance posture.

Practitioner Guidance

Governance implication: Treat the internal control procedure as a control discipline, not a document collection exercise. Ownership should be explicit across product, compliance, and engineering so that the QMS, technical documentation, and registration evidence remain consistent as the system evolves.

What to watch for: The strongest warning sign is a mismatch between what the organisation can actually demonstrate and what the conformity file says. If the evidence depends on informal assumptions or unowned approvals, the procedure is not ready for dependable self-assessment.

Related resources from NHI Mgmt Group

• Control Monitoring
• Why do internal Kubernetes services need identity-based access control?
• Why do service accounts and other NHIs expose internal control weaknesses?
• Why do encrypted internal channels still fail in access control breaches?