Article 44: certificates of notified bodies

Article 43 sets out along which route a certificate arises and when it must be earned again. Paragraph 1 lets the provider of the systems listed in point 1 of Annex III choose between the internal control of Annex VI and the procedure involving a notified body of Annex VII where he has applied harmonised standards or common specifications, and makes the Annex VII procedure mandatory in four cases: the harmonised standards referred to in Article 40 do not exist and the common specifications referred to in Article 41 are not available; the provider has not applied, or has applied only part of, the harmonised standard; the common specifications referred to in point (a) exist but the provider has not applied them; or one or more of the harmonised standards referred to in point (a) has been published with a restriction, and then only on the part of the standard that was restricted. Paragraph 2 provides that for the systems of points 2 to 8 of Annex III providers follow the internal control of Annex VI, for which the involvement of a notified body is not required. Paragraph 4 provides that high-risk AI systems that have already been subject to a conformity assessment procedure shall undergo a new procedure whenever they are substantially modified, regardless of whether the modified system is intended to be further distributed or continues to be used by the current deployer, and that for systems that continue to learn, changes predetermined by the provider at the moment of the initial conformity assessment and part of the technical documentation referred to in point 2(f) of Annex IV do not constitute a substantial modification.

Paragraph 3 of Article 43 was replaced with effect from 27 July 2026. Under the text in force, the provider of a high-risk AI system covered by the Union harmonisation legislation listed in Section A of Annex I follows the relevant conformity assessment procedure as required in accordance with that harmonisation legislation, the requirements set out in Section 2 of this Chapter apply to those systems and form part of that assessment, an assessment of the quality management system set out in Article 17 is also undertaken, and points 3, 4.3, 4.4 and 4.5, the fifth paragraph of point 4.6 and point 5 of Annex VII apply. The second subparagraph gives notified bodies notified under that harmonisation legislation the power to assess the conformity of those systems with the requirements of Section 2, provided that their compliance with the requirements laid down in Article 31(4), (5), (10) and (11) has been assessed in the context of the notification procedure under that harmonisation legislation, which is evidenced through the assessment as part of the existing notification, and requires those same bodies, without prejudice to Article 28, to apply for designation in accordance with Section 4 of this Chapter by 28 January 2028. The third subparagraph provides that a manufacturer entitled under that harmonisation legislation to rely on a conformity assessment not involving a third party may use that option only if it has also applied harmonised standards or, where applicable, common specifications referred to in Article 41 covering all requirements of Section 2, that the classification of a product as a high-risk AI system in accordance with Article 6(1) does not affect the choice of conformity assessment procedure provided to those manufacturers, and that those manufacturers are not required to choose a procedure involving third-party conformity assessment only because the product includes a high-risk AI system as a safety component, if that harmonisation legislation does not require it. The fourth subparagraph provides that the provider of a system both covered by that harmonisation legislation and falling within one of the categories listed in Annex III follows the relevant conformity assessment procedure as required pursuant to the relevant Union harmonisation legislation listed in Section A of Annex I.

Annex I was amended with effect from 27 July 2026: in Section A, point 1 was deleted, and in Section B, point 21 was added, referring to Regulation (EU) 2023/1230 on machinery. Article 2(2), likewise replaced, provides that for AI systems classified as high-risk in accordance with Article 6(1) related to products covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 apply, and that Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that harmonisation legislation.

Article 36 governs what happens to certificates already issued where the notified body itself is concerned. Paragraph 3 provides that a body deciding to cease its conformity assessment activities shall inform the notifying authority and the providers concerned as soon as possible, and in the case of a planned cessation at least one year beforehand, and that its certificates may remain valid for nine months after the cessation on condition that another notified body has confirmed in writing that it will assume responsibility, that other body carrying out a full assessment before the end of those nine months before issuing new certificates. Paragraph 5 provides that a notified body whose designation is suspended, restricted or withdrawn in whole or in part shall inform the providers concerned within ten days. Paragraph 7 provides that in that case the notifying authority shall assess the impact on the certificates issued, shall require the body to suspend or withdraw within a reasonable period any certificates unduly issued, and shall provide the national competent authorities of the Member State in which the provider has its registered place of business with all relevant information on the certificates whose suspension or withdrawal it has ordered. Paragraph 8, point (b), provides that where the notifying authority establishes that the body is not capable of supporting existing certificates issued, the provider of the system covered by the certificate shall confirm in writing to the national competent authorities of the Member State of its registered place of business, within three months of the suspension or restriction, that another qualified notified body will temporarily assume the monitoring of and responsibility for the certificates. Paragraph 9 provides that upon withdrawal of a designation certificates, with the exception of those unduly issued, remain valid for nine months where the national competent authority has confirmed that there is no risk and another notified body has confirmed in writing that it assumes immediate responsibility and will complete its assessment within twelve months of the withdrawal.

Article 45(2), point (b), provides that each notified body shall inform the other notified bodies of Union technical documentation assessment certificates or any supplements thereto which it has refused, withdrawn, suspended or otherwise restricted, and, upon request, of the certificates and supplements which it has issued.

Point (c) of the third paragraph of Article 113 was replaced with effect from 27 July 2026 and now provides that Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), applies from 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and from 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I. That deferral concerns those three Sections alone. Article 44 sits in Section 5 of Chapter III and therefore falls under the general application date given in the second paragraph of Article 113: 2 August 2026.

Start with the question whether this Article touches you at all, because for most high-risk systems the answer is no. Of Annex III only the biometrics of point 1 pass through a notified body, and there only where you choose that route yourself or where one of the four cases in the second subparagraph of Article 43(1) arises; points 2 to 8 follow the internal control of Annex VI and produce no certificate whatsoever. Whoever does hold a certificate usually holds it through the regulated products of Annex I, Section A, and that certificate comes out of the sectoral conformity assessment of Article 43(3) rather than out of Annex VII. Check first which Section carries your product, because that shifted on 27 July 2026: machinery was taken out of Section A and placed in Section B as Regulation (EU) 2023/1230, and for Section B products the amended Article 2(2) makes only Article 6(1), Article 60a and Articles 102 to 112 applicable. Article 44 is not among them, so for AI in machinery this Article no longer bears, while it applies in full to the remaining products of Section A. On that Section A route the assessment is moreover wider than it was: since 27 July 2026 the quality management system of Article 17 is assessed as well, and point 3, points 4.3, 4.4 and 4.5, the fifth paragraph of point 4.6 and point 5 of Annex VII apply. That difference is practical: the language requirement of paragraph 1 is tied to the Annex VII certificate and does not carry over unchanged to that sectoral route, whereas the five years of paragraph 2 simply apply. The mistake the Article exposes is the idea that conformity assessment is a project that ends. The certificate has an end date, at most four years for an Annex III system and at most five for an Annex I product, and the re-assessment that carries the extension itself takes time. Whoever knocks on the door only in the final month stands on the expiry date without valid paper while the system simply runs in production. The clock is moreover not the most frequent reason to go back. Article 43(4) sends a system through the assessment again whenever it is substantially modified, including where you only keep using it internally; only changes you predetermined and recorded in the technical documentation do not count. In practice that trigger arrives years before the expiry date. Where things do go wrong, the response of the body is not binary: the principle of proportionality in paragraph 3 allows it to confine itself to restrictions instead of withdrawal, correcting within the deadline it sets holds off the measure, and an appeal procedure against its decision is available. Count on none of the three as a matter of course, but know that they exist. Nor should you count on starting afresh elsewhere after a refusal: Article 45(2), point (b), obliges the body to inform its peer bodies of certificates refused, withdrawn, suspended or restricted. Also put 28 January 2028 in your diary, even though that date is not addressed to you. The second subparagraph of the new Article 43(3) lets bodies notified only under the sectoral legislation of Annex I, Section A, assess conformity with Section 2, but only where their compliance with Article 31(4), (5), (10) and (11) has already been assessed in their existing notification, and requires those same bodies to apply for designation under Section 4 by that date. The recital accompanying the amendment describes that power as an arrangement for eighteen months from 27 July 2026. So ask your body what its status is and whether it is applying, because who can carry out your assessment after that date depends on it. Finally, watch the side that has nothing to do with your system. A notified body can cease its activities or lose its designation. Article 36 then gives you nine months, but only where another body assumes responsibility in writing, and the body must inform you within ten days. In a suspension where the authority establishes that your body can no longer support the existing certificates, there is even a genuine duty on you: to confirm in writing to your national competent authority, within three months, which other qualified body will temporarily take over the monitoring. That is the only hard deadline in this whole block that lands on your desk.