Conformity Assessment API

The Conformity Assessment API manages product-scoped EU AI Act conformity assessments for AI products. It supports assessment creation, checklist evidence updates, review lifecycle transitions, draft Declaration of Conformity generation, CE marking, and substantial-modification checks.

All paths below are under /api/v1.0. The router is gated by governance.conformity_assessment and requires access to the target space and product.

Endpoints Overview

Method	Endpoint	Description
POST	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/	Create a draft assessment with the default Article 9-15 checklist.
GET	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/	List assessments for one product.
GET	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}	Retrieve one assessment.
PUT	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}	Update checklist and assessment metadata while editable.
POST	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/submit-review	Move a draft assessment to review.
POST	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/review	Record review outcome.
POST	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/ce-marking	Apply CE marking to a passed assessment.
POST	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/generate-declaration	Generate a draft Declaration of Conformity reference and data payload.
POST	/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/evaluate-modification	Evaluate whether a product change is substantial.

Lifecycle

Field	Values
assessment_type	self, third_party, dual
status	draft, in_review, passed, ce_marked
Checklist item status	pending, pass, fail, na
review_outcome	pass, fail, conditional
ce_marking_status	not_applied, applied, revoked

New assessments start as draft. Only draft and in_review assessments can be updated. Submitting for review requires draft status. A pass or conditional review moves the assessment to passed; a fail review returns it to draft. CE marking requires passed status and changes the assessment status to ce_marked.

Create Assessment

POST /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/

{
  "assessment_type": "self",
  "notes": "Initial Annex VI assessment"
}

assessment_type must be self, third_party, or dual. The response includes the default checklist for Art. 9 through Art. 15, the assessor, timestamps, ce_marking_status, and declaration fields.

List Assessments

GET /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/?limit=20&offset=0

The list is ordered newest first. limit is 1-100.

Update Assessment

PUT /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}

{
  "checklist": [
    {
      "article": "Art. 9",
      "title": "Risk Management System",
      "status": "pass",
      "evidence_refs": ["doc:technical-file-123"],
      "notes": "Risk management procedure approved."
    }
  ],
  "notified_body_name": "Example Notified Body",
  "notified_body_certificate_ref": "NB-2026-001",
  "valid_from": "2026-06-29T00:00:00Z",
  "valid_until": "2027-06-29T00:00:00Z",
  "reassessment_reason": "Annual review"
}

Updating a completed assessment returns 409. Create a new reassessment instead.

Submit for Review

POST /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/submit-review

{
  "reviewer_id": "00000000-0000-0000-0000-000000000000"
}

The assessment must be in draft status. The response has status: "in_review" and records the reviewer ID.

Complete Review

POST /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/review

{
  "outcome": "pass",
  "remediation_notes": null
}

The assessment must be in in_review. outcome must be pass, fail, or conditional.

Apply CE Marking

POST /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/ce-marking

The assessment must be passed. The response sets status to ce_marked and ce_marking_status to applied.

Generate Declaration

POST /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/{assessment_id}/generate-declaration

The assessment cannot be draft. The response includes declaration_ref and declaration_data with generated timestamp, assessment type, product ID, assessor/reviewer IDs, review outcome, checklist summary, CE marking status, notified-body fields, and validity dates.

Evaluate Substantial Modification

POST /api/v1.0/catalog/spaces/{space_slug}/products/{product_id}/conformity-assessments/evaluate-modification

{
  "accuracy_delta": 0.06,
  "data_volume_delta": 0.3,
  "architecture_changed": false,
  "feature_set_changed": true,
  "intended_purpose_changed": false
}

The heuristic weights accuracy delta, training data volume change, architecture changes, feature-set changes, and intended-purpose changes. The response includes is_substantial, confidence_score, factors, and a human-readable recommendation. The heuristic threshold for a substantial modification is a confidence score of 0.5.

Response Fields

Assessment responses include:

Field	Description
id, product_id, space_id	Assessment identity and scope.
assessment_type, status	Lifecycle state.
checklist	Article-level checklist items with evidence refs and notes.
assessor_id, assessed_at	Creator and assessment timestamp.
reviewer_id, reviewed_at, review_outcome, remediation_notes	Review metadata.
notified_body_name, notified_body_certificate_ref	Third-party assessment metadata.
ce_marking_status	CE marking state.
declaration_ref, declaration_data	Generated declaration data.
valid_from, valid_until, reassessment_reason	Validity and reassessment metadata.
substantial_mod_heuristic	Stored substantial-modification result when present.
created_at, updated_at	Audit timestamps.

Error Responses

Status	Description
400	Invalid assessment type or review outcome.
401	Authentication required.
404	Product or assessment not found in the space.
409	Invalid lifecycle transition, such as updating a completed assessment or applying CE marking before pass.