Skip to main content
Praxikon
Back to the explorer
ObligationApplicablev1.0.0

Articles 28 to 39: notifying authorities and notified bodies

Section 4 of Chapter III governs who may carry out your conformity assessment and on what conditions that power continues to exist. Each Member State designates a notifying authority that assesses, designates, notifies and monitors conformity assessment bodies. A notified body is established under the national law of a Member State, has legal personality, and is independent of the provider, of any other operator with an economic interest and of the provider competitors; consultancy services in particular are ruled out. Subcontracting to a subcontractor or a subsidiary is allowed only with the agreement of the provider, and the body then retains full responsibility. In its work it avoids unnecessary burdens for providers and minimises administrative burdens and compliance costs for micro- and small enterprises, without giving up the required degree of rigour. Article 36 distinguishes the cases. Where it ceases its activities, the certificates remain valid under paragraph 3 for at most nine months, provided another notified body assumes responsibility in writing. Where its designation is suspended, restricted or withdrawn, it informs the providers concerned within ten days under paragraph 5; paragraph 8 sets continuity conditions there without that general nine-month limit, and paragraph 9 gives certificates a nine-month validity on withdrawal, with a conditional extension in periods of three months up to twelve months at most. A body from a third country can carry out these activities only where the Union has concluded an agreement with that country.

The official source remains authoritative. This is general information about obligations and not legal advice. See this object on the map

Address and citation

This object has an address of its own that is never renamed or reused. Store the identifier in your own file, not the title or the link.

Identifier
praxikon:eu:ai-act:obligation:article-28-39-notified-bodies
Payload hash (sha256)
244200659e300ee841c99c7ece25bf19795a8036b16b7faca26e35a05ecae3b1

Citation line

Praxikon, "Articles 28 to 39: notifying authorities and notified bodies", praxikon:eu:ai-act:obligation:article-28-39-notified-bodies@1.0.0, dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0), effective_at 2026-08-08T00:00:00.000Z, known_at 2026-09-06T00:00:00.000Z, sha256 244200659e300ee841c99c7ece25bf19795a8036b16b7faca26e35a05ecae3b1
Version
1.0.0
Legal time (effective_at)
2 August 2025
Knowledge time (known_at)
6 September 2026
Closed on
Not closed
Topics
conformity, governance

Review status: Placed against the official source (6 September 2026). Next check due by 5 March 2027. The check date is the knowledge date of this version; no later recheck has been recorded.

Who must act and who is affected

On an obligation the addressee is recorded separately from the party that is merely affected. That difference decides who a supervisory authority addresses and who has work to do without the duty resting on them.

No duty holder assigned

The addressee falls outside the roles this dataset models. The duty exists, it just does not rest on a role recorded here.

Duty holder

Not recorded on this object.

Affected actor

Oversight

Evidence owner

Not recorded on this object.

What this object links to

Every relation appears below as a path: from the source with its locator, through the conditions and exceptions of the object carrying the relation, to the consequence. A locator belongs to a statement in the data and not to a relation, so the source is the source anchor of the carrying object.

Who is affected without being the addressee

1 of 1 shown

This role is practically affected without being the addressee: it receives the information, has to cooperate, or absorbs the consequences in its own process.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allPractically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
    • Condition | allArticle 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.
    • ExceptionArticle 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
    • ExceptionThe presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Who supervises this

1 of 1 shown

This role supervises and receives the notifications. It is the institutional role, not the national body that fills it.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allPractically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
    • Condition | allArticle 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.
    • ExceptionArticle 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
    • ExceptionThe presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be done

1 of 1 shown

This is what concretely has to be done under the obligation.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allPractically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
    • Condition | allArticle 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.
    • ExceptionArticle 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
    • ExceptionThe presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be recorded

1 of 1 shown

This is what has to be in the file to show that the action was carried out.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allPractically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
    • Condition | allArticle 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.
    • ExceptionArticle 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
    • ExceptionThe presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What keeps it in place

1 of 1 shown

This is what keeps compliance in place over time, periodic or event-driven.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allPractically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
    • Condition | allArticle 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.
    • ExceptionArticle 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
    • ExceptionThe presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Public tools

1 of 1 shown

This is the public route a reader can actually use.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allPractically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
    • Condition | allArticle 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.
    • ExceptionArticle 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
    • ExceptionThe presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What points at this object

Objects hanging off this obligation

4 of 4 shown

The object belongs to this obligation. The source line it hangs off sits there.

  1. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allArises as soon as you select or contract a notified body, on every renewal of the assignment, and on every notice of a change to its designation.

    Relation recorded on: Check the standing and independence of your notified body

    Consequence

  2. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Control on the continuity of your conformity assessment

    Consequence

  3. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: File on the chosen notified body

    Consequence

  4. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 31(1), (4), (5), (6), (8) and (11)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 32; Article 33(1) to (4)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 34(1) to (3); Article 35(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 36(3), (5), (6) and (9)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Full text of Articles 28 to 39

    Consequence

What this object states

Official fact

Attributable to a named primary source, with a locator. Where they differ, the official source prevails.

  • Article 28(1) provides: Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. Those procedures shall be developed in cooperation between the notifying authorities of all Member States. Paragraph 3 provides: Notifying authorities shall be established, organised and operated in such a way that no conflict of interest arises with conformity assessment bodies, and that the objectivity and impartiality of their activities are safeguarded. Paragraph 5 provides: Notifying authorities shall offer or provide neither any activities that conformity assessment bodies perform, nor any consultancy services on a commercial or competitive basis. Article 29(1) provides: Conformity assessment bodies shall submit an application for notification to the notifying authority of the Member State in which they are established. Paragraph 2 provides: The application for notification shall be accompanied by a description of the conformity assessment activities, the conformity assessment module or modules and the types of AI systems for which the conformity assessment body claims to be competent, as well as by an accreditation certificate, where one exists, issued by a national accreditation body attesting that the conformity assessment body fulfils the requirements laid down in Article 31. Article 30(1) provides: Notifying authorities may notify only conformity assessment bodies which have satisfied the requirements laid down in Article 31. Paragraph 2, as replaced by Article 1, point (16), of Regulation (EU) 2026/1744, provides: Notifying authorities shall notify the Commission and the other Member States, based on the list of codes, categories, and corresponding types of AI systems referred to in Annex XIV, and using the electronic notification tool developed and managed by the Commission, of each conformity assessment body referred to in paragraph 1. The second subparagraph of that paragraph empowers the Commission to amend Annex XIV by delegated act. Until 27 July 2026 paragraph 2 carried no such list of codes; since then it sets the scope of the designation. Paragraph 4 provides: The conformity assessment body concerned may perform the activities of a notified body only where no objections are raised by the Commission or the other Member States within two weeks of a notification by a notifying authority where it includes an accreditation certificate referred to in Article 29(2), or within two months of a notification by the notifying authority where it includes documentary evidence referred to in Article 29(3).

    • Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

  • Article 28(8), as added by Article 1, point (14), of Regulation (EU) 2026/1744, provides: notifying authorities designated pursuant to this Regulation that are responsible for AI systems covered by the Union harmonisation legislation listed in Section A of Annex I shall ensure that the conformity assessment body that applies for designation both pursuant to this Regulation and that legislation is provided with the possibility to submit a single application and undergoes a unified assessment procedure, where the relevant Union harmonisation legislation provides for such a procedure. A conformity assessment body designated pursuant to more than one piece of that legislation shall have to apply only once to be designated pursuant to this Regulation, and a designation pursuant to this Regulation shall be applicable for all Union harmonisation legislation listed in Section A of Annex I for which it is designated. Paragraph 9 provides that a notifying authority designated pursuant to that legislation is also the notifying authority for the application of that procedure, unless the Member State designates another notifying authority for this Regulation. Article 29(4), as replaced by Article 1, point (15), provides that notified bodies undergoing the unified assessment procedure shall submit the single application to the notifying authority designated pursuant to that Union harmonisation legislation.

    • Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

  • Article 31(1) provides: A notified body shall be established under the national law of a Member State and shall have legal personality. Paragraph 4 provides: Notified bodies shall be independent of the provider of a high-risk AI system in relation to which they perform conformity assessment activities. Notified bodies shall also be independent of any other operator having an economic interest in high-risk AI systems assessed, as well as of any competitors of the provider. This shall not preclude the use of assessed high-risk AI systems that are necessary for the operations of the conformity assessment body, or the use of such high-risk AI systems for personal purposes. Paragraph 5 provides: Neither a conformity assessment body, its top-level management nor the personnel responsible for carrying out its conformity assessment tasks shall be directly involved in the design, development, marketing or use of high-risk AI systems, nor shall they represent the parties engaged in those activities. They shall not engage in any activity that might conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are notified. This shall, in particular, apply to consultancy services. Paragraph 6 provides: Notified bodies shall be organised and operated so as to safeguard the independence, objectivity and impartiality of their activities. Paragraph 8 provides: Notified bodies shall have procedures for the performance of activities which take due account of the size of a provider, the sector in which it operates, its structure, and the degree of complexity of the AI system concerned. Paragraph 11 provides: The notified body shall have permanent availability of sufficient administrative, technical, legal and scientific personnel who possess experience and knowledge relating to the relevant types of AI systems, data and data computing, and relating to the requirements set out in Section 2.

    • Locator: Article 31(1), (4), (5), (6), (8) and (11)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

  • Article 32 provides: Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof, the references of which have been published in the Official Journal of the European Union, it shall be presumed to comply with the requirements set out in Article 31 in so far as the applicable harmonised standards cover those requirements. Article 33(1) provides: Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements laid down in Article 31, and shall inform the notifying authority accordingly. Paragraph 2 provides: Notified bodies shall take full responsibility for the tasks performed by any subcontractors or subsidiaries. Paragraph 3 provides: Activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. Notified bodies shall make a list of their subsidiaries publicly available. Paragraph 4 provides: The relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation shall be kept at the disposal of the notifying authority for a period of five years from the termination date of the subcontracting.

    • Locator: Article 32; Article 33(1) to (4)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

  • Article 34(1) provides: Notified bodies shall verify the conformity of high-risk AI systems in accordance with the conformity assessment procedures set out in Article 43. Paragraph 2 provides: Notified bodies shall avoid unnecessary burdens for providers when performing their activities, and take due account of the size of the provider, the sector in which it operates, its structure and the degree of complexity of the high-risk AI system concerned, in particular in view of minimising administrative burdens and compliance costs for micro- and small enterprises within the meaning of Recommendation 2003/361/EC. The notified body shall, nevertheless, respect the degree of rigour and the level of protection required for the compliance of the high-risk AI system with the requirements of this Regulation. Paragraph 3 provides: Notified bodies shall make available and submit upon request all relevant documentation, including the providers documentation, to the notifying authority referred to in Article 28 to allow that authority to conduct its assessment, designation, notification and monitoring activities, and to facilitate the assessment outlined in this Section. Article 35(1) provides: The Commission shall assign a single identification number to each notified body, even where a body is notified under more than one Union act. Paragraph 2 provides: The Commission shall make publicly available the list of the bodies notified under this Regulation, including their identification numbers and the activities for which they have been notified. The Commission shall ensure that the list is kept up to date.

    • Locator: Article 34(1) to (3); Article 35(1) and (2)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

  • Article 36(3) provides: Where a notified body decides to cease its conformity assessment activities, it shall inform the notifying authority and the providers concerned as soon as possible and, in the case of a planned cessation, at least one year before ceasing its activities. The certificates of the notified body may remain valid for a period of nine months after cessation of the notified body activities, on condition that another notified body has confirmed in writing that it will assume responsibilities for the high-risk AI systems covered by those certificates. The latter notified body shall complete a full assessment of the high-risk AI systems affected by the end of that nine-month-period before issuing new certificates for those systems. Where the notified body has ceased its activity, the notifying authority shall withdraw the designation. Paragraph 5 provides: Where its designation has been suspended, restricted, or fully or partially withdrawn, the notified body shall inform the providers concerned within 10 days. Paragraph 6 provides: In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall take appropriate steps to ensure that the files of the notified body concerned are kept, and to make them available to notifying authorities in other Member States and to market surveillance authorities at their request. Paragraph 9 provides: With the exception of certificates unduly issued, and where a designation has been withdrawn, the certificates shall remain valid for a period of nine months under the following circumstances: (a) the national competent authority of the Member State in which the provider of the high-risk AI system covered by the certificate has its registered place of business has confirmed that there is no risk to health, safety or fundamental rights associated with the high-risk AI systems concerned; and (b) another notified body has confirmed in writing that it will assume immediate responsibility for those AI systems and completes its assessment within 12 months of the withdrawal of the designation.

    • Locator: Article 36(3), (5), (6) and (9)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

  • Article 37(1) provides: The Commission shall, where necessary, investigate all cases where there are reasons to doubt the competence of a notified body or the continued fulfilment by a notified body of the requirements laid down in Article 31 and of its applicable responsibilities. Paragraph 2 provides: The notifying authority shall provide the Commission, on request, with all relevant information relating to the notification or the maintenance of the competence of the notified body concerned. Paragraph 4 provides: Where the Commission ascertains that a notified body does not meet or no longer meets the requirements for its notification, it shall inform the notifying Member State accordingly and request it to take the necessary corrective measures, including the suspension or withdrawal of the notification if necessary. Where the Member State fails to take the necessary corrective measures, the Commission may, by means of an implementing act, suspend, restrict or withdraw the designation. Article 38(1) provides: The Commission shall ensure that, with regard to high-risk AI systems, appropriate coordination and cooperation between notified bodies active in the conformity assessment procedures pursuant to this Regulation are put in place and properly operated in the form of a sectoral group of notified bodies. Paragraph 2 provides: Each notifying authority shall ensure that the bodies notified by it participate in the work of a group referred to in paragraph 1, directly or through designated representatives. Paragraph 3 provides: The Commission shall provide for the exchange of knowledge and best practices between notifying authorities. Article 39 provides: Conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies under this Regulation, provided that they meet the requirements laid down in Article 31 or they ensure an equivalent level of compliance.

    • Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

Our interpretation

Our own reading. It can change without the law changing, and it is not the position of a supervisory authority.

  • Read this Section as the supplier terms of your conformity assessor, because that is exactly what it is. Three points in it go wrong in practice. The first is the independence requirement of Article 31(4) and (5). It prohibits not only the obvious double role but rules out consultancy services in particular. Anyone who has his high-risk file built by the advisory firm that later performs the assessment buys a certificate that can be challenged on that ground. Separate those two purchases at the outset, not halfway through. The second is Article 31(1) read alongside Article 39. The body must be established under the national law of a Member State and have legal personality; a body from a third country comes into the picture only where the Union has concluded an agreement with that country. For a group that places its worldwide certification with a single house, that is a hard limit: the European assessment must sit with a European notified legal person, and the group brand name says nothing about that. The third is Article 33. Subcontracting is allowed, but only with your agreement, and the body retains full responsibility for what the subcontractor does. The provision does not oblige it to tell you of its own motion; it only makes its subsidiaries publicly available. So ask, and record the answer, because without the question the agreement never comes up.

    • Locator: Article 31(1), (4), (5), (6), (8) and (11)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source
    • Locator: Article 32; Article 33(1) to (4)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

  • Two provisions in this Section work in your favour and are rarely used. Article 34(2) is the first. It requires the body to avoid unnecessary burdens for providers and to take due account of your size, your sector, your structure and the complexity of the system, in particular in view of minimising administrative burdens and compliance costs for micro- and small enterprises. That is not a policy aspiration but an operational obligation of the body, and it sits alongside Article 31(8), which demands the same proportionality in its procedures. The second sentence of paragraph 2 immediately bounds it: the degree of rigour and the level of protection stand. The practical reading is therefore not that a small provider has to demonstrate less, but that the road there must be proportionate. If you are handed a standard package plainly designed for a different kind of organisation, this is the provision on which you raise it. Article 36 is the second. It holds the scenario that hits a provider hardest and appears in no project plan: your body ceases or loses its designation. Your certificates then remain valid for at most nine months, and only where another notified body has confirmed in writing that it will assume responsibility. You hear about it within ten days, and that is the only deadline in this Section that runs directly to you. The follow-on steps for the certificate itself sit in the object on Article 44; what matters here is that the continuity of your market access depends on a party over which you have no control. So treat the notified body as a supplier with concentration risk, and not as a quality mark.

    • Locator: Article 34(1) to (3); Article 35(1) and (2)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source
    • Locator: Article 36(3), (5), (6) and (9)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source
    • Locator: Article 43(1) and (3); Article 44(2); Article 113, third paragraph, point (b)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

Recommended step

A practical step we consider appropriate. Not an obligation following from the Regulation.

  • First establish whether this Section touches you at all: only where your system goes through a notified body via Annex VII or via the sectoral route of Article 43(3). If it does, check four things in the Commission public list at the moment of choice and annually thereafter: is the body still listed, what identification number does it carry, for which conformity assessment activities and which types of AI systems is it notified, and has its designation been restricted or suspended. Record for each choice that you tested the independence of Article 31(4) and (5), in particular whether the same group previously advised you on the same system. When placing the assignment, ask explicitly which tasks are subcontracted to a subcontractor or a subsidiary, give or withhold your agreement under Article 33(3) in writing, and provide in the contract that any change to it requires your agreement again. Add two clauses: a duty on the body to report any change to its designation, mirroring the ten days of Article 36(5), and a handover clause describing which files you get back within what period if it ceases. Finally, keep a second notified body in view that is notified for your type of system, so that the nine months of Article 36(3) and (9) become a handover rather than a search.

    • Locator: Article 43(1) and (3); Article 44(2); Article 113, third paragraph, point (b)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source
    • Locator: Article 36(3), (5), (6) and (9)praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

When this applies

  1. 1Practically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
  2. 2Article 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.

When this does not apply

  • Article 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
  • The presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Articles 28 to 39: notifying authorities and notified bodies",
praxikon:eu:ai-act:obligation:article-28-39-notified-bodies@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0),
effective_at 2025-08-02T00:00:00.000Z, known_at 2026-09-06T00:00:00.000Z,
sha256 244200659e300ee841c99c7ece25bf19795a8036b16b7faca26e35a05ecae3b1,
https://www.praxikon.com/en/verkenner/obligation/article-28-39-notified-bodies
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-28-39-notified-bodies&effective_at=2025-08-02&known_at=2026-09-06&lang=en, accessed 2026-09-20)

Short form

praxikon:eu:ai-act:obligation:article-28-39-notified-bodies@1.0.0 (sha256 24420065)

BibTeX

@misc{praxikon-eu-ai-act-obligation-article-28-39-notified-bodies-1-0-0,
  author       = {{Praxikon}},
  title        = {Articles 28 to 39: notifying authorities and notified bodies},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:article-28-39-notified-bodies},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.2.0, schema 1.5.0},
  note         = {effective_at 2025-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 244200659e300ee841c99c7ece25bf19795a8036b16b7faca26e35a05ecae3b1},
  url          = {https://www.praxikon.com/en/verkenner/obligation/article-28-39-notified-bodies},
  urldate      = {2026-09-20},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:article-28-39-notified-bodies@1.0.0",
    "type": "dataset",
    "title": "Articles 28 to 39: notifying authorities and notified bodies",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:article-28-39-notified-bodies",
    "URL": "https://www.praxikon.com/en/verkenner/obligation/article-28-39-notified-bodies",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          9,
          6
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          9,
          20
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0; schema 1.5.0; effective_at 2025-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 244200659e300ee841c99c7ece25bf19795a8036b16b7faca26e35a05ecae3b1; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-28-39-notified-bodies&effective_at=2025-08-02&known_at=2026-09-06&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

For agents and integrations

This page and the machine output come from the same object and the same two time axes.

Open as JSONOpen as JSON-LDHuman explanationRead the methodology