Notified body

How a body becomes notified

A conformity assessment body is an organisation that does third-party testing, certification and inspection. Under the EU AI Act, it becomes a notified body in three steps.

1. It applies to its country’s notifying authority: the national authority that assesses, notifies and monitors these bodies. It names the types of AI system it claims competence for (Articles 28 and 29).
2. The authority assesses it against the Act’s requirements for notified bodies (Article 31), directly or through the national accreditation body.
3. The authority notifies it to the Commission and the other Member States (Article 30). It can start work if nobody objects within two weeks, or two months without an accreditation certificate. On an objection, the Commission decides.

What a notified body must be

Independent. It must be independent of the provider it assesses, of that provider’s competitors, and of anyone with an economic interest in the system. Neither it, its management nor its assessors may be directly involved in designing, developing, marketing or using high-risk AI systems, or take on work that could compromise their independence, such as consultancy (Article 31(4) and (5)).

Competent. It must act with integrity and have staff permanently available who know the AI it assesses and the Act’s requirements (Article 31(10) and (11)).

Scoped. Its notification lists the AI system types it covers, by Annex XIV code.

Why it matters

A notified body is the only outside check some high-risk AI gets before sale. Under the Act’s conformity assessment rules, one is needed mainly for biometric systems and for AI in regulated products such as medical devices (Article 43).

Most other uses on the Act’s high-risk list (Annex III), such as hiring tools, are checked by their provider alone (Article 43(2)). The rules apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products.

In practice

Biometric systems. A provider needs a notified body unless it fully applied harmonised standards (EU-endorsed technical standards) or common specifications, and even then for any part of a standard published with a restriction. It may choose one anyway, and picks which (Article 43(1)). For systems put into service by law enforcement, immigration or asylum authorities, or by EU institutions, the national market surveillance authority acts as the notified body.

AI in regulated products. For AI in products under the laws listed in Section A of Annex I, such as medical devices, the product law’s own procedure applies. A notified body is involved where that law requires one. A manufacturer can use the law’s option to skip the third party only if it also applied standards or common specifications covering all the AI Act’s high-risk requirements (Article 43(3)).

Product-law notified bodies. Bodies already notified under one of those laws can assess the AI in those products, if their notification checked the Act’s independence and competence rules (Article 31(4), (5), (10) and (11)). The Digital Omnibus on AI, an amending regulation in force since 27 July 2026, added a deadline: they must apply for designation under the AI Act by 28 January 2028 (Article 43(3), as replaced). Recital 18 describes this as a power for 18 months from 27 July 2026. They can use a single application where the product law provides one, and apply only once even if designated under several such laws (Article 28(8)).

Annex XIV codes. The Omnibus added the list of codes that sets each body’s scope. AIP codes point to a product law in Section A of Annex I. AIB codes cover three biometric uses: remote biometric identification, biometric categorisation and emotion recognition. AIH codes cover the technology, from expert systems through machine learning to generative AI and “Agentic AI”, and combine with the other two.

AI Office systems. The Commission’s AI Office supervises some high-risk systems, such as certain systems built on a provider’s own general-purpose AI model. Where such a system needs third-party assessment under Article 43, the Commission entrusts it to notified bodies acting on its behalf (Article 75(1e)).

Oversight. The Commission gives each body one identification number and publishes the list (Article 35). A designation can be restricted, suspended or withdrawn if the body stops meeting the rules (Articles 36 and 37).

Outside the EU. A body from a non-EU country can act as a notified body only under an agreement between that country and the EU (Article 39).

Questions and answers

What is a notified body under the EU AI Act?

A conformity assessment body that a Member State has notified to the Commission and the other Member States under the EU AI Act (Article 3(22)). It independently tests, certifies or inspects high-risk AI systems, within the scope its notification covers.

Who designates notified bodies for AI?

Each Member State designates at least one notifying authority (Article 28). That authority assesses bodies against Article 31 and notifies them to the Commission and the other Member States, which can object within two weeks, or two months if the body has no accreditation certificate (Article 30). If there is an objection, the Commission decides.

Can a medical device notified body assess AI under the AI Act?

It can assess an AI system in a product covered by Section A of Annex I, such as a medical device, if its notification under that product law already checked the AI Act's independence and competence rules (Article 31(4), (5), (10) and (11)). It must apply for designation under the AI Act by 28 January 2028 (Article 43(3), as replaced in 2026).