AI Act Obligations for Notified Bodies

Source text: “The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date. The technical documentation shall be drawn up in such a way as to demonstrate that the high-risk AI system complies with the requirements set out in this Section and to provide national competent authorities and notified bodies with the necessary information in a clear and comprehensive form to assess the compliance of the AI system with those requirements. It shall contain, at a minimum, the elements set out in Annex IV. SMEs, including start-ups, may provide the elements of the technical documentation specified in Annex IV in a simplified manner. To that end, the Commission shall establish a simplified technical documentation form targeted at the needs of small and microenterprises. Where an SME, including a start-up, opts to provide the information required in Annex IV in a simplified manner, it shall use the form referred to in this paragraph. Notified bodies shall accept the form for the purposes of the conformity assessment.”

In practice: Establish a documentation management process that maps each Annex IV element to your AI system's design artefacts; if you are an SME, monitor the Commission's publication of the simplified form and adopt it as your standard template to reduce administrative burden while remaining audit-ready.

Source text: “Conformity assessment bodies shall submit an application for notification to the notifying authority of the Member State in which they are established.”

In practice: Conformity assessment bodies should identify the relevant national notifying authority in their Member State and prepare a complete notification application package before seeking designation under the AI Act.

Source text: “The application for notification shall be accompanied by a description of the conformity assessment activities, the conformity assessment module or modules and the types of AI systems for which the conformity assessment body claims to be competent, as well as by an accreditation certificate, where one exists, issued by a national accreditation body attesting that the conformity assessment body fulfils the requirements laid down in Article 31. Any valid document related to existing designations of the applicant notified body under any other Union harmonisation legislation shall be added.”

In practice: Prepare a comprehensive application package that includes the accreditation certificate from the national accreditation body, a detailed description of the conformity assessment modules and AI system types, and copies of any existing notified body designations under other EU harmonisation laws.

Source text: “Where the conformity assessment body concerned cannot provide an accreditation certificate, it shall provide the notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of its compliance with the requirements laid down in Article 31.”

In practice: If your organisation lacks an accreditation certificate, compile a comprehensive dossier of documentary evidence demonstrating compliance with Article 31 requirements, including internal audits, competence records, independence declarations, and quality management documentation, to support the notifying authority's verification and ongoing monitoring.

Source text: “For notified bodies which are designated under any other Union harmonisation legislation, all documents and certificates linked to those designations may be used to support their designation procedure under this Regulation, as appropriate. The notified body shall update the documentation referred to in paragraphs 2 and 3 of this Article whenever relevant changes occur, in order to enable the authority responsible for notified bodies to monitor and verify continuous compliance with all the requirements laid down in Article 31.”

In practice: Notified bodies with existing designations under other EU harmonisation laws should map their current documentation to AI Act requirements and establish a change management process to trigger documentation updates whenever relevant changes occur, ensuring the notifying authority can continuously verify compliance with Article 31.

Source text: “A notified body shall be established under the national law of a Member State and shall have legal personality.”

In practice: Verify that any candidate notified body is formally incorporated or established under the relevant Member State's national law and holds recognised legal personality before applying for notification status.

Source text: “Notified bodies shall satisfy the organisational, quality management, resources and process requirements that are necessary to fulfil their tasks, as well as suitable cybersecurity requirements.”

In practice: Notified bodies should implement a documented quality management system, ensure adequate staffing and technical resources, and establish cybersecurity controls (e.g., access controls, secure data handling) appropriate to their conformity assessment activities.

Source text: “The organisational structure, allocation of responsibilities, reporting lines and operation of notified bodies shall ensure confidence in their performance, and in the results of the conformity assessment activities that the notified bodies conduct.”

In practice: Notified bodies should document their internal governance structure, clearly define roles and responsibilities, establish transparent reporting lines, and conduct regular internal audits to demonstrate organisational integrity and impartiality.

Source text: “Notified bodies shall be independent of the provider of a high-risk AI system in relation to which they perform conformity assessment activities. Notified bodies shall also be independent of any other operator having an economic interest in high-risk AI systems assessed, as well as of any competitors of the provider. This shall not preclude the use of assessed high-risk AI systems that are necessary for the operations of the conformity assessment body, or the use of such high-risk AI systems for personal purposes.”

In practice: Notified bodies should implement conflict-of-interest policies, conduct regular independence checks, and maintain documented procedures to identify and manage any financial or commercial relationships with providers or competitors of assessed AI systems.

Source text: “Notified bodies shall be organised and operated so as to safeguard the independence, objectivity and impartiality of their activities. Notified bodies shall document and implement a structure and procedures to safeguard impartiality and to promote and apply the principles of impartiality throughout their organisation, personnel and assessment activities.”

In practice: Notified bodies should establish a formal impartiality policy, conduct regular internal reviews to detect conflicts of interest, and maintain documented organisational charts showing separation between commercial and assessment functions.

Source text: “Notified bodies shall have documented procedures in place ensuring that their personnel, committees, subsidiaries, subcontractors and any associated body or personnel of external bodies maintain, in accordance with Article 78, the confidentiality of the information which comes into their possession during the performance of conformity assessment activities, except when its disclosure is required by law. The staff of notified bodies shall be bound to observe professional secrecy with regard to all information obtained in carrying out their tasks under this Regulation, except in relation to the notifying authorities of the Member State in which their activities are carried out.”

In practice: Implement confidentiality agreements for all staff, subcontractors, and associated bodies; establish a clear policy referencing Article 78 obligations; and create a register of personnel with access to sensitive conformity assessment information.

Source text: “Notified bodies shall have procedures for the performance of activities which take due account of the size of a provider, the sector in which it operates, its structure, and the degree of complexity of the AI system concerned.”

In practice: Develop tiered assessment procedures that scale with provider size and AI system complexity; document how these factors are considered in each assessment; consider creating specific checklists for SMEs versus large enterprises.

Source text: “Notified bodies shall take out appropriate liability insurance for their conformity assessment activities, unless liability is assumed by the Member State in which they are established in accordance with national law or that Member State is itself directly responsible for the conformity assessment.”

In practice: Notified bodies should obtain and maintain professional indemnity and liability insurance policies commensurate with the scope and risk of their conformity assessment activities; document the insurance coverage and review it annually.

Source text: “Notified bodies shall be capable of carrying out all their tasks under this Regulation with the highest degree of professional integrity and the requisite competence in the specific field, whether those tasks are carried out by notified bodies themselves or on their behalf and under their responsibility.”

In practice: Notified bodies should maintain a competency framework documenting required qualifications for all assessment roles, conduct regular competency assessments of staff and subcontractors, and ensure that any tasks delegated to third parties are subject to the same integrity and competence standards.

Source text: “Notified bodies shall have sufficient internal competences to be able effectively to evaluate the tasks conducted by external parties on their behalf. The notified body shall have permanent availability of sufficient administrative, technical, legal and scientific personnel who possess experience and knowledge relating to the relevant types of AI systems, data and data computing, and relating to the requirements set out in Section 2.”

In practice: Notified bodies should conduct regular skills gap analyses to ensure their permanent staff covers all relevant AI domains (e.g., machine learning, data governance, legal frameworks). Consider establishing a competency matrix mapping staff qualifications to the types of AI systems they assess.

Source text: “Notified bodies shall participate in coordination activities as referred to in Article 38. They shall also take part directly, or be represented in, European standardisation organisations, or ensure that they are aware and up to date in respect of relevant standards.”

In practice: Notified bodies should designate a standards liaison officer responsible for tracking relevant CEN, CENELEC, and ETSI activities on AI, and should formally register participation in Article 38 coordination groups. Maintain a standards monitoring log updated at least quarterly.

Source text: “Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof, the references of which have been published in the Official Journal of the European Union, it shall be presumed to comply with the requirements set out in Article 31 in so far as the applicable harmonised standards cover those requirements.”

In practice: Conformity assessment bodies seeking notification should identify and document which harmonised standards they comply with, ensuring those standards are published in the OJEU and map directly to the Article 31 criteria. Maintain up-to-date records of standard references and coverage gaps.

Source text: “Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements laid down in Article 31, and shall inform the notifying authority accordingly.”

In practice: Maintain a register of all subcontractors and subsidiaries involved in conformity assessment activities, document their compliance with Article 31 requirements, and establish a formal notification process to the notifying authority whenever such arrangements are made or changed.

Source text: “Notified bodies shall take full responsibility for the tasks performed by any subcontractors or subsidiaries.”

In practice: Implement robust oversight mechanisms and contractual accountability clauses with all subcontractors and subsidiaries to ensure the notified body can demonstrate full responsibility for all delegated conformity assessment work.

Source text: “Activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. Notified bodies shall make a list of their subsidiaries publicly available.”

In practice: Establish a formal consent process with providers before subcontracting any conformity assessment activities, and publish and regularly update a list of subsidiaries on the notified body's public website to ensure transparency.

Source text: “The relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation shall be kept at the disposal of the notifying authority for a period of five years from the termination date of the subcontracting.”

In practice: Implement a document retention policy that ensures all qualification assessment records and work documentation for subcontractors and subsidiaries are securely stored and accessible to the notifying authority for at least five years from the termination date of each subcontracting arrangement.

Source text: “Notified bodies shall verify the conformity of high-risk AI systems in accordance with the conformity assessment procedures set out in Article 43.”

In practice: Ensure that your high-risk AI system undergoes the correct conformity assessment procedure as defined in Article 43 before market placement; engage an accredited notified body early in the development lifecycle to avoid delays.

Source text: “Notified bodies shall avoid unnecessary burdens for providers when performing their activities, and take due account of the size of the provider, the sector in which it operates, its structure and the degree of complexity of the high-risk AI system concerned, in particular in view of minimising administrative burdens and compliance costs for micro- and small enterprises within the meaning of Recommendation 2003/361/EC. The notified body shall, nevertheless, respect the degree of rigour and the level of protection required for the compliance of the high-risk AI system with the requirements of this Regulation.”

In practice: SMEs and micro-enterprises should document their size and sector context when engaging notified bodies, as this information can be used to tailor the assessment process and reduce administrative overhead without compromising compliance standards.

Source text: “Notified bodies shall make available and submit upon request all relevant documentation, including the providers’ documentation, to the notifying authority referred to in Article 28 to allow that authority to conduct its assessment, designation, notification and monitoring activities, and to facilitate the assessment outlined in this Section.”

In practice: Notified bodies should maintain a well-organised, up-to-date documentation repository for each assessed AI system so that it can be promptly provided to the notifying authority upon request, ensuring smooth oversight and monitoring activities.

Source text: “Where a notified body decides to cease its conformity assessment activities, it shall inform the notifying authority and the providers concerned as soon as possible and, in the case of a planned cessation, at least one year before ceasing its activities. The certificates of the notified body may remain valid for a period of nine months after cessation of the notified body’s activities, on condition that another notified body has confirmed in writing that it will assume responsibilities for the high-risk AI systems covered by those certificates. The latter notified body shall complete a full assessment of the high-risk AI systems affected by the end of that nine-month-period before issuing new certificates for those systems. Where the notified body has ceased its activity, the notifying authority shall withdraw the designation.”

In practice: Notified bodies should maintain a succession plan identifying potential successor bodies; providers should monitor their notified body's status and proactively seek reassignment of certificates if cessation is announced.

Source text: “Where its designation has been suspended, restricted, or fully or partially withdrawn, the notified body shall inform the providers concerned within 10 days.”

In practice: Notified bodies should maintain an up-to-date register of all providers for whom they have issued certificates, enabling rapid notification within the 10-day deadline if their designation status changes.

Source text: “With the exception of certificates unduly issued, and where a designation has been withdrawn, the certificates shall remain valid for a period of nine months under the following circumstances: In the circumstances referred to in the first subparagraph, the national competent authority of the Member State in which the provider of the system covered by the certificate has its place of business may extend the provisional validity of the certificates for additional periods of three months, which shall not exceed 12 months in total. The national competent authority or the notified body assuming the functions of the notified body affected by the change of designation shall immediately inform the Commission, the other Member States and the other notified bodies thereof.”

In practice: Maintain a registry of all active certificates linked to each notified body so that upon withdrawal, the national competent authority can immediately assess validity conditions; pre-identify candidate replacement notified bodies and establish written assumption-of-responsibility agreements to avoid gaps in certificate coverage.

Source text: “Each notifying authority shall ensure that the bodies notified by it participate in the work of a group referred to in paragraph 1, directly or through designated representatives.”

In practice: Notifying authorities should establish formal mechanisms (e.g., mandates or standing instructions) requiring notified bodies under their jurisdiction to actively participate in the sectoral group, and should monitor attendance and contribution to group activities.

Source text: “Conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies under this Regulation, provided that they meet the requirements laid down in Article 31 or they ensure an equivalent level of compliance.”

In practice: Providers seeking conformity assessment from a third-country body should verify that the relevant EU-third country agreement is in force and that the body has been formally authorised under this provision. Document the authorisation status and equivalence determination before relying on the body's assessment for CE marking purposes.

Source text: “For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I, the provider shall follow the relevant conformity assessment procedure as required under those legal acts. The requirements set out in Section 2 of this Chapter shall apply to those high-risk AI systems and shall be part of that assessment. Points 4.3., 4.4., 4.5. and the fifth paragraph of point 4.6 of Annex VII shall also apply. For the purposes of that assessment, notified bodies which have been notified under those legal acts shall be entitled to control the conformity of the high-risk AI systems with the requirements set out in Section 2, provided that the compliance of those notified bodies with requirements laid down in Article 31(4), (5), (10) and (11) has been assessed in the context of the notification procedure under those legal acts. Where a legal act listed in Section A of Annex I enables the product manufacturer to opt out from a third-party conformity assessment, provided that that manufacturer has applied all harmonised standards covering all the relevant requirements, that manufacturer may use that option only if it has also applied harmonised standards or, where applicable, common specifications referred to in Article 41, covering all requirements set out in Section 2 of this Chapter.”

In practice: If your AI system is a safety component of a product regulated under Annex I Section A legislation (e.g., medical devices, machinery), integrate the AI Act's Section 2 requirements into your existing conformity assessment. Verify that your notified body has been assessed against Article 31(4), (5), (10) and (11). If opting out of third-party assessment, ensure harmonised standards covering all Section 2 AI Act requirements have been applied.

Source text: “Certificates issued by notified bodies in accordance with Annex VII shall be drawn-up in a language which can be easily understood by the relevant authorities in the Member State in which the notified body is established.”

In practice: Notified bodies should establish a language policy ensuring all certificates are drafted in the official language(s) of their Member State of establishment. Where a notified body operates across borders, consider providing translations or bilingual certificates to facilitate oversight by national authorities.

Source text: “Certificates shall be valid for the period they indicate, which shall not exceed five years for AI systems covered by Annex I, and four years for AI systems covered by Annex III. At the request of the provider, the validity of a certificate may be extended for further periods, each not exceeding five years for AI systems covered by Annex I, and four years for AI systems covered by Annex III, based on a re-assessment in accordance with the applicable conformity assessment procedures. Any supplement to a certificate shall remain valid, provided that the certificate which it supplements is valid.”

In practice: Providers should track certificate expiry dates and initiate re-assessment requests well in advance of expiry. Maintain a register of all certificates and their supplements, ensuring that supplements are automatically flagged for review when the parent certificate approaches expiry or is withdrawn.

Source text: “Where a notified body finds that an AI system no longer meets the requirements set out in Section 2, it shall, taking account of the principle of proportionality, suspend or withdraw the certificate issued or impose restrictions on it, unless compliance with those requirements is ensured by appropriate corrective action taken by the provider of the system within an appropriate deadline set by the notified body. The notified body shall give reasons for its decision. An appeal procedure against decisions of the notified bodies, including on conformity certificates issued, shall be available.”

In practice: Providers should establish internal processes to respond promptly to notified body findings of non-compliance, including a corrective action plan with clear timelines. Notified bodies should document their decisions with detailed reasoning and ensure that an accessible, transparent appeal mechanism is in place and communicated to providers.

Source text: “Notified bodies shall inform the notifying authority of the following:”

In practice: Establish an internal tracking system for all certificates and QMS approvals issued or refused, with automated alerts to trigger notifications to the notifying authority whenever a certificate status changes or scope conditions are affected.

Source text: “Each notified body shall inform the other notified bodies of:”

In practice: Implement a shared information protocol or use the Commission's electronic notification tool to systematically share certificate and QMS approval decisions with peer notified bodies, ensuring timely responses to information requests.

Source text: “Each notified body shall provide the other notified bodies carrying out similar conformity assessment activities covering the same types of AI systems with relevant information on issues relating to negative and, on request, positive conformity assessment results.”

In practice: Create a structured process for documenting and categorising conformity assessment outcomes by AI system type, and establish a secure channel for sharing negative results proactively and positive results on request with peer notified bodies covering the same AI system categories.

Source text: “Notified bodies shall safeguard the confidentiality of the information that they obtain, in accordance with Article 78.”

In practice: Implement a confidentiality policy for all staff and subcontractors of the notified body, including NDAs, data classification procedures, and secure handling protocols for all information received during conformity assessment activities, aligned with Article 78 requirements.

Source text: “Where applicable, the CE marking shall be followed by the identification number of the notified body responsible for the conformity assessment procedures set out in Article 43. The identification number of the notified body shall be affixed by the body itself or, under its instructions, by the provider or by the provider’s authorised representative. The identification number shall also be indicated in any promotional material which mentions that the high-risk AI system fulfils the requirements for CE marking.”

In practice: After obtaining a notified body certificate, ensure the notified body's identification number is placed immediately after the CE marking on the product, packaging, and documentation, and is also included in all marketing materials referencing CE compliance.

Source text: “The specific interests and needs of the SME providers, including start-ups, shall be taken into account when setting the fees for conformity assessment under Article 43, reducing those fees proportionately to their size, market size and other relevant indicators.”

In practice: Notified bodies and competent authorities should establish a tiered fee schedule for conformity assessments that explicitly accounts for SME status, using criteria such as number of employees, annual turnover, and market reach to determine proportionate reductions.