AI Act Obligations for Notifying Authorities

Source text: “Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. Those procedures shall be developed in cooperation between the notifying authorities of all Member States.”

In practice: Member States should establish a clear organisational structure for their notifying authority, including documented procedures for assessment, designation, notification, and monitoring of conformity assessment bodies, and actively participate in cross-border cooperation mechanisms with other Member States.

Source text: “Notifying authorities shall be established, organised and operated in such a way that no conflict of interest arises with conformity assessment bodies, and that the objectivity and impartiality of their activities are safeguarded.”

In practice: Notifying authorities should implement formal conflict-of-interest policies, including declarations of interest for staff, separation of duties, and regular audits to verify that no financial or organisational ties exist with the conformity assessment bodies they oversee.

Source text: “Notifying authorities shall be organised in such a way that decisions relating to the notification of conformity assessment bodies are taken by competent persons different from those who carried out the assessment of those bodies.”

In practice: Establish clear organisational charts and role definitions within the notifying authority that formally separate the assessment team from the decision-making team, and document this separation in internal governance policies.

Source text: “Notifying authorities shall safeguard the confidentiality of the information that they obtain, in accordance with Article 78.”

In practice: Notifying authorities should implement internal confidentiality policies and data handling procedures aligned with Article 78, including access controls and non-disclosure agreements for staff handling sensitive conformity assessment information.

Source text: “Notifying authorities shall have an adequate number of competent personnel at their disposal for the proper performance of their tasks. Competent personnel shall have the necessary expertise, where applicable, for their function, in fields such as information technologies, AI and law, including the supervision of fundamental rights.”

In practice: Notifying authorities should conduct a skills gap analysis to ensure their staff have adequate expertise in AI, IT, and law including fundamental rights; consider establishing training programmes or hiring specialists in these domains to meet the staffing requirement.

Source text: “Notifying authorities shall notify the Commission and the other Member States, using the electronic notification tool developed and managed by the Commission, of each conformity assessment body referred to in paragraph 1.”

In practice: Notifying authorities should register and familiarise themselves with the Commission's electronic notification tool well in advance of any planned notifications. Ensure all required information is prepared before submission to avoid delays.

Source text: “The notification referred to in paragraph 2 of this Article shall include full details of the conformity assessment activities, the conformity assessment module or modules, the types of AI systems concerned, and the relevant attestation of competence. Where a notification is not based on an accreditation certificate as referred to in Article 29(2), the notifying authority shall provide the Commission and the other Member States with documentary evidence which attests to the competence of the conformity assessment body and to the arrangements in place to ensure that that body will be monitored regularly and will continue to satisfy the requirements laid down in Article 31.”

In practice: Prepare a comprehensive notification dossier that includes all required details. If relying on documentary evidence rather than an accreditation certificate, ensure the evidence clearly demonstrates both current competence and the existence of regular monitoring mechanisms as required by Article 31.

Source text: “The notifying authority shall notify the Commission and the other Member States of any relevant changes to the notification of a notified body via the electronic notification tool referred to in Article 30(2).”

In practice: Establish an internal process to track and promptly communicate any changes to notified body status via the EU electronic notification tool; assign a dedicated compliance officer to manage this obligation.

Source text: “The procedures laid down in Articles 29 and 30 shall apply to extensions of the scope of the notification. For changes to the notification other than extensions of its scope, the procedures laid down in paragraphs (3) to (9) shall apply.”

In practice: Distinguish between scope extensions (requiring full re-notification under Articles 29 and 30) and other changes (governed by Article 36 paragraphs 3–9); document the type of change before initiating the appropriate procedure.

Source text: “Where a notified body decides to cease its conformity assessment activities, it shall inform the notifying authority and the providers concerned as soon as possible and, in the case of a planned cessation, at least one year before ceasing its activities. The certificates of the notified body may remain valid for a period of nine months after cessation of the notified body’s activities, on condition that another notified body has confirmed in writing that it will assume responsibilities for the high-risk AI systems covered by those certificates. The latter notified body shall complete a full assessment of the high-risk AI systems affected by the end of that nine-month-period before issuing new certificates for those systems. Where the notified body has ceased its activity, the notifying authority shall withdraw the designation.”

In practice: Notified bodies should maintain a succession plan identifying potential successor bodies; providers should monitor their notified body's status and proactively seek reassignment of certificates if cessation is announced.

Source text: “Where a notifying authority has sufficient reason to consider that a notified body no longer meets the requirements laid down in Article 31, or that it is failing to fulfil its obligations, the notifying authority shall without delay investigate the matter with the utmost diligence. In that context, it shall inform the notified body concerned about the objections raised and give it the possibility to make its views known. If the notifying authority comes to the conclusion that the notified body no longer meets the requirements laid down in Article 31 or that it is failing to fulfil its obligations, it shall restrict, suspend or withdraw the designation as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations. It shall immediately inform the Commission and the other Member States accordingly.”

In practice: Notifying authorities should establish a formal investigation protocol with defined timelines and due-process steps (including the right of the notified body to be heard) to ensure swift and legally sound action when compliance concerns arise.

Source text: “In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall take appropriate steps to ensure that the files of the notified body concerned are kept, and to make them available to notifying authorities in other Member States and to market surveillance authorities at their request.”

In practice: Establish a secure document management protocol for notified body files that enables rapid sharing with other national authorities; ensure files are stored in a format accessible to cross-border requests and assign a responsible custodian within the notifying authority.

Source text: “In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall:”

In practice: Create a certificate impact assessment template to be activated immediately upon any change to a notified body's designation; set up automated tracking of all certificates issued by each notified body and establish a reporting workflow to the Commission within the three-month deadline.

Source text: “With the exception of certificates unduly issued, and where a designation has been suspended or restricted, the certificates shall remain valid in one of the following circumstances:”

In practice: Develop a certificate validity decision tree for use by notifying authorities when a suspension or restriction occurs; ensure written confirmations and timelines are documented within one month and that providers are notified immediately if a substitute notified body must be engaged within three months.

Source text: “The notifying authority shall provide the Commission, on request, with all relevant information relating to the notification or the maintenance of the competence of the notified body concerned.”

In practice: Notifying authorities should maintain organised and readily accessible records of all information related to notified body notifications, including competence assessments, audits, and ongoing monitoring results, so they can respond promptly to Commission requests.

Source text: “Each notifying authority shall ensure that the bodies notified by it participate in the work of a group referred to in paragraph 1, directly or through designated representatives.”

In practice: Notifying authorities should establish formal mechanisms (e.g., mandates or standing instructions) requiring notified bodies under their jurisdiction to actively participate in the sectoral group, and should monitor attendance and contribution to group activities.