Who actually does the assessment?

The manufacturer, unless the legislation applying to that product requires a conformity assessment body to be involved. That default is the single most useful thing to know here, because a declaration produced either way looks the same to somebody reading it.

What can a buyer read into it?

That the product was assessed against the requirements applying to it before going on sale. Not that it was independently audited, not that it is well made, and not that it suits your use, all of which are separate questions that still need answering.

What should we ask a supplier?

What was assessed, against which requirements, and whether anybody outside the company was involved. The last part is the one that distinguishes two documents that look alike, and a supplier who has involved an outside body will answer it immediately.

Glossary

Conformity assessment

The check that a regulated product meets its legal requirements, carried out before it goes on sale rather than after somebody complains.

In plain terms

Proving a product meets the rules before selling it. The important and widely missed detail is who does the proving: usually the company making the product, not an outside inspector, unless the law for that particular product says otherwise.

Why it matters

Because buyers read a declaration as though somebody independent had checked, and mostly nobody has. Knowing which kind of statement you are looking at changes what weight it can carry in a purchase decision, and the distinction is invisible on the label itself.

How it works

It happens before the product goes on the market rather than after. The assessment has to demonstrate that all the applicable legislative requirements are met, which places the work ahead of the first sale instead of after the first complaint.

The manufacturer carries out the assessment. That is the default position and it surprises people: an outside body is involved only where the legislation applying to that particular product requires it, so most declarations are self-produced.

Which route applies is decided by the legislation for the product, not by the company. Different procedures exist and the applicable law specifies which one is available, so a manufacturer choosing a lighter route has not necessarily cut a corner.

The paperwork is a package rather than a stamp. Carrying out the assessment, assembling a technical file, issuing a declaration and applying the marking are separate steps, and the visible mark is the last and least informative of them.

The mark signifies assessment against requirements, not quality or suitability. It says the product was assessed against the standards applying to it, which is a floor for market access rather than a judgement that it is any good.

A declaration is a statement about a version rather than about a company. It is made against the product as assessed, so a substantially changed product raises the question of whether what you are buying is the thing the paperwork describes, which matters more for software that ships continuously than for anything on a shelf.

For AI, the significance is the timing. In the territory carrying the heaviest obligations, the requirements are meant to be satisfied before deployment, which turns them into a procurement question your supplier answers rather than a project you run afterwards.

Two documents that look the same

This is not a criticism of self-assessment, which is a deliberate design rather than a loophole. Requiring an outside body for every regulated product would be slow and expensive and would improve very little, so the legislation reserves that for the cases where the stakes justify it and lets the manufacturer carry the burden everywhere else. The problem is purely one of reading: the visible output is the same either way, so the distinction that the law took care to draw is invisible at exactly the moment a buyer is making a decision. That makes it a question rather than a document check. Ask what was assessed, against which requirements, and whether anybody outside the company took part. A supplier who has been through an external process answers the third part instantly and usually volunteers the body's name, and a supplier who has not will say so in a way you will not have to interpret.

Seen in the wild

Assuming a widely used assistant carries some assessment behind it that nobody has actually checked.
ChatGPT
Asking a supplier in regulated hiring territory what has been assessed and by whom.
LinkedIn Recruiter
Meeting the same self-declared-versus-independently-checked distinction in security paperwork.
Drata

Common misconceptions

People assume

A declared conformity means an independent body checked it.

In fact

The manufacturer carries out the assessment by default. An outside body is involved only where the legislation for that product requires it, so most declarations are the maker's own statement and read identically to ones that are not.

People assume

The mark means the product is good.

In fact

It signifies assessment against the requirements that apply, which is a condition of being sold rather than a verdict on quality. Whether something suits your particular use is untouched by it and still has to be worked out.

Questions

Who actually does the assessment?: The manufacturer, unless the legislation applying to that product requires a conformity assessment body to be involved. That default is the single most useful thing to know here, because a declaration produced either way looks the same to somebody reading it.
What can a buyer read into it?: That the product was assessed against the requirements applying to it before going on sale. Not that it was independently audited, not that it is well made, and not that it suits your use, all of which are separate questions that still need answering.
What should we ask a supplier?: What was assessed, against which requirements, and whether anybody outside the company was involved. The last part is the one that distinguishes two documents that look alike, and a supplier who has involved an outside body will answer it immediately.