Articles 28 to 39: notifying authorities and notified bodies

Article 28(8), as added by Article 1, point (14), of Regulation (EU) 2026/1744, provides: notifying authorities designated pursuant to this Regulation that are responsible for AI systems covered by the Union harmonisation legislation listed in Section A of Annex I shall ensure that the conformity assessment body that applies for designation both pursuant to this Regulation and that legislation is provided with the possibility to submit a single application and undergoes a unified assessment procedure, where the relevant Union harmonisation legislation provides for such a procedure. A conformity assessment body designated pursuant to more than one piece of that legislation shall have to apply only once to be designated pursuant to this Regulation, and a designation pursuant to this Regulation shall be applicable for all Union harmonisation legislation listed in Section A of Annex I for which it is designated. Paragraph 9 provides that a notifying authority designated pursuant to that legislation is also the notifying authority for the application of that procedure, unless the Member State designates another notifying authority for this Regulation. Article 29(4), as replaced by Article 1, point (15), provides that notified bodies undergoing the unified assessment procedure shall submit the single application to the notifying authority designated pursuant to that Union harmonisation legislation.

Article 31(1) provides: A notified body shall be established under the national law of a Member State and shall have legal personality. Paragraph 4 provides: Notified bodies shall be independent of the provider of a high-risk AI system in relation to which they perform conformity assessment activities. Notified bodies shall also be independent of any other operator having an economic interest in high-risk AI systems assessed, as well as of any competitors of the provider. This shall not preclude the use of assessed high-risk AI systems that are necessary for the operations of the conformity assessment body, or the use of such high-risk AI systems for personal purposes. Paragraph 5 provides: Neither a conformity assessment body, its top-level management nor the personnel responsible for carrying out its conformity assessment tasks shall be directly involved in the design, development, marketing or use of high-risk AI systems, nor shall they represent the parties engaged in those activities. They shall not engage in any activity that might conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are notified. This shall, in particular, apply to consultancy services. Paragraph 6 provides: Notified bodies shall be organised and operated so as to safeguard the independence, objectivity and impartiality of their activities. Paragraph 8 provides: Notified bodies shall have procedures for the performance of activities which take due account of the size of a provider, the sector in which it operates, its structure, and the degree of complexity of the AI system concerned. Paragraph 11 provides: The notified body shall have permanent availability of sufficient administrative, technical, legal and scientific personnel who possess experience and knowledge relating to the relevant types of AI systems, data and data computing, and relating to the requirements set out in Section 2.

Article 32 provides: Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof, the references of which have been published in the Official Journal of the European Union, it shall be presumed to comply with the requirements set out in Article 31 in so far as the applicable harmonised standards cover those requirements. Article 33(1) provides: Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements laid down in Article 31, and shall inform the notifying authority accordingly. Paragraph 2 provides: Notified bodies shall take full responsibility for the tasks performed by any subcontractors or subsidiaries. Paragraph 3 provides: Activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. Notified bodies shall make a list of their subsidiaries publicly available. Paragraph 4 provides: The relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation shall be kept at the disposal of the notifying authority for a period of five years from the termination date of the subcontracting.

Article 34(1) provides: Notified bodies shall verify the conformity of high-risk AI systems in accordance with the conformity assessment procedures set out in Article 43. Paragraph 2 provides: Notified bodies shall avoid unnecessary burdens for providers when performing their activities, and take due account of the size of the provider, the sector in which it operates, its structure and the degree of complexity of the high-risk AI system concerned, in particular in view of minimising administrative burdens and compliance costs for micro- and small enterprises within the meaning of Recommendation 2003/361/EC. The notified body shall, nevertheless, respect the degree of rigour and the level of protection required for the compliance of the high-risk AI system with the requirements of this Regulation. Paragraph 3 provides: Notified bodies shall make available and submit upon request all relevant documentation, including the providers documentation, to the notifying authority referred to in Article 28 to allow that authority to conduct its assessment, designation, notification and monitoring activities, and to facilitate the assessment outlined in this Section. Article 35(1) provides: The Commission shall assign a single identification number to each notified body, even where a body is notified under more than one Union act. Paragraph 2 provides: The Commission shall make publicly available the list of the bodies notified under this Regulation, including their identification numbers and the activities for which they have been notified. The Commission shall ensure that the list is kept up to date.

Article 36(3) provides: Where a notified body decides to cease its conformity assessment activities, it shall inform the notifying authority and the providers concerned as soon as possible and, in the case of a planned cessation, at least one year before ceasing its activities. The certificates of the notified body may remain valid for a period of nine months after cessation of the notified body activities, on condition that another notified body has confirmed in writing that it will assume responsibilities for the high-risk AI systems covered by those certificates. The latter notified body shall complete a full assessment of the high-risk AI systems affected by the end of that nine-month-period before issuing new certificates for those systems. Where the notified body has ceased its activity, the notifying authority shall withdraw the designation. Paragraph 5 provides: Where its designation has been suspended, restricted, or fully or partially withdrawn, the notified body shall inform the providers concerned within 10 days. Paragraph 6 provides: In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall take appropriate steps to ensure that the files of the notified body concerned are kept, and to make them available to notifying authorities in other Member States and to market surveillance authorities at their request. Paragraph 9 provides: With the exception of certificates unduly issued, and where a designation has been withdrawn, the certificates shall remain valid for a period of nine months under the following circumstances: (a) the national competent authority of the Member State in which the provider of the high-risk AI system covered by the certificate has its registered place of business has confirmed that there is no risk to health, safety or fundamental rights associated with the high-risk AI systems concerned; and (b) another notified body has confirmed in writing that it will assume immediate responsibility for those AI systems and completes its assessment within 12 months of the withdrawal of the designation.

Article 37(1) provides: The Commission shall, where necessary, investigate all cases where there are reasons to doubt the competence of a notified body or the continued fulfilment by a notified body of the requirements laid down in Article 31 and of its applicable responsibilities. Paragraph 2 provides: The notifying authority shall provide the Commission, on request, with all relevant information relating to the notification or the maintenance of the competence of the notified body concerned. Paragraph 4 provides: Where the Commission ascertains that a notified body does not meet or no longer meets the requirements for its notification, it shall inform the notifying Member State accordingly and request it to take the necessary corrective measures, including the suspension or withdrawal of the notification if necessary. Where the Member State fails to take the necessary corrective measures, the Commission may, by means of an implementing act, suspend, restrict or withdraw the designation. Article 38(1) provides: The Commission shall ensure that, with regard to high-risk AI systems, appropriate coordination and cooperation between notified bodies active in the conformity assessment procedures pursuant to this Regulation are put in place and properly operated in the form of a sectoral group of notified bodies. Paragraph 2 provides: Each notifying authority shall ensure that the bodies notified by it participate in the work of a group referred to in paragraph 1, directly or through designated representatives. Paragraph 3 provides: The Commission shall provide for the exchange of knowledge and best practices between notifying authorities. Article 39 provides: Conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies under this Regulation, provided that they meet the requirements laid down in Article 31 or they ensure an equivalent level of compliance.

Read this Section as the supplier terms of your conformity assessor, because that is exactly what it is. Three points in it go wrong in practice. The first is the independence requirement of Article 31(4) and (5). It prohibits not only the obvious double role but rules out consultancy services in particular. Anyone who has his high-risk file built by the advisory firm that later performs the assessment buys a certificate that can be challenged on that ground. Separate those two purchases at the outset, not halfway through. The second is Article 31(1) read alongside Article 39. The body must be established under the national law of a Member State and have legal personality; a body from a third country comes into the picture only where the Union has concluded an agreement with that country. For a group that places its worldwide certification with a single house, that is a hard limit: the European assessment must sit with a European notified legal person, and the group brand name says nothing about that. The third is Article 33. Subcontracting is allowed, but only with your agreement, and the body retains full responsibility for what the subcontractor does. The provision does not oblige it to tell you of its own motion; it only makes its subsidiaries publicly available. So ask, and record the answer, because without the question the agreement never comes up.

Two provisions in this Section work in your favour and are rarely used. Article 34(2) is the first. It requires the body to avoid unnecessary burdens for providers and to take due account of your size, your sector, your structure and the complexity of the system, in particular in view of minimising administrative burdens and compliance costs for micro- and small enterprises. That is not a policy aspiration but an operational obligation of the body, and it sits alongside Article 31(8), which demands the same proportionality in its procedures. The second sentence of paragraph 2 immediately bounds it: the degree of rigour and the level of protection stand. The practical reading is therefore not that a small provider has to demonstrate less, but that the road there must be proportionate. If you are handed a standard package plainly designed for a different kind of organisation, this is the provision on which you raise it. Article 36 is the second. It holds the scenario that hits a provider hardest and appears in no project plan: your body ceases or loses its designation. Your certificates then remain valid for at most nine months, and only where another notified body has confirmed in writing that it will assume responsibility. You hear about it within ten days, and that is the only deadline in this Section that runs directly to you. The follow-on steps for the certificate itself sit in the object on Article 44; what matters here is that the continuity of your market access depends on a party over which you have no control. So treat the notified body as a supplier with concentration risk, and not as a quality mark.