Accreditation Scope

The accreditation scope is a juridically binding statement issued by a national accreditation body that explicitly lists the categories of high-risk AI systems a notified body is authorized to assess. It is not a general license but a granular specification of technical competence, detailing the exact conformity assessment activities, standards, and product categories covered. This document serves as the primary evidence of a notified body's qualification under the EU AI Act.

An accreditation scope is inextricably linked to specific harmonized standards. A notified body is only competent to assess conformity against the standards explicitly listed in its scope. Key implications include:

• Presumption of Conformity: Assessment against a listed standard provides a legal presumption of conformity with the AI Act's essential requirements.
• No Implicit Extension: A body accredited for a general safety standard cannot automatically assess against a specialized AI fairness standard unless it is explicitly included.
• Version Control: The scope must be updated when harmonized standards are revised, requiring re-assessment of the body's competence.

The scope defines competence not just by standard, but by specific AI system categories. A notified body may be accredited for high-risk AI systems in medical devices but not for those in biometric identification. This categorization is critical because:

• Domain Expertise: Assessing a surgical robot requires fundamentally different engineering and clinical knowledge than assessing an AI-driven recruitment tool.
• Risk Profile Variance: The potential harms and required mitigation strategies differ vastly between categories, demanding specialized auditor expertise.
• Regulatory Overlap: Many AI systems are components of regulated products (e.g., machinery, medical devices), requiring the notified body to also demonstrate competence in the relevant sectoral legislation.

The accreditation scope specifies which conformity assessment modules from the AI Act the notified body is authorized to execute. This is a critical procedural boundary. The scope will explicitly list authorization for:

• Internal Control Review: Auditing the provider's own internal checks.
• Type Examination: Assessing the technical design of a representative AI system.
• Full Quality Assurance: Auditing the provider's entire quality management system for design, development, and post-market monitoring. A body authorized only for type examination cannot issue a certificate based on a full quality assurance audit.

The accreditation scope is issued by a single national accreditation body within an EU member state but operates under the principle of mutual recognition. This means a certificate issued by a notified body within its accredited scope is valid across the entire EU single market. However, the scope is tied to the legal entity of the notified body at a specific registered address; a subsidiary in another country requires its own separate accreditation, even if it is part of the same corporate group.

An accreditation scope is not a static certificate but a living document subject to continuous surveillance. The national accreditation body conducts regular audits—typically annually—to verify the notified body's ongoing competence. The scope can be:

• Extended: Through a formal application and successful assessment for new standards or product categories.
• Restricted: If surveillance identifies a loss of competence in a specific area.
• Suspended or Withdrawn: Immediately, if a critical non-conformity is found, instantly invalidating the body's authority to issue certificates in that domain.

An independent, accredited organization designated by an EU member state to conduct third-party conformity assessments of high-risk AI systems. A notified body's specific technical competence and authorized activities are precisely defined by its accreditation scope, which is granted by the national accreditation body. Without a defined scope, a notified body has no legal authority to issue certificates.

European technical specifications adopted by recognized standards bodies (CEN, CENELEC, ETSI) that provide presumption of conformity with the AI Act's essential requirements. A notified body's accreditation scope explicitly references the specific harmonized standards against which it is competent to assess. Applying these standards is voluntary but creates a safe harbor for providers, streamlining the certification process within the defined scope.

The comprehensive dossier a provider must compile to demonstrate compliance, forming the primary evidence base for a notified body's assessment. The documentation package must address every requirement within the accreditation scope being assessed. Required elements include:

• System architecture and design specifications
• Training data provenance and governance records
• Risk management system documentation
• Performance metrics and validation results

A change to an AI system's intended purpose or a significant alteration to its performance characteristics that triggers a new conformity assessment. If the modified system's risk profile shifts into a different category, the original notified body may no longer be competent to assess it if the new classification falls outside its accreditation scope, requiring re-certification by an appropriately scoped body.

A national public body empowered to enforce the AI Act and verify the validity of certifications. These authorities audit whether a notified body operated within its accredited scope when issuing a certificate. A finding of scope violation can result in:

• Certificate invalidation and mandatory market withdrawal
• Suspension of the notified body's designation
• Penalties against both the provider and the notified body