Notified Body

A notified body is not a self-appointed consultant but a legally designated entity. An EU member state's notifying authority formally assesses and designates the organization, then notifies the European Commission and other member states of its status.

• Must demonstrate technical competence and impartiality for specific AI categories
• Listed in the NANDO (New Approach Notified and Designated Organisations) database
• Operates under the legal jurisdiction of its designating member state

The cornerstone of a notified body's credibility is its structural separation from the AI provider. It must be a third party free from any influence that could affect its technical judgment.

• Cannot be the designer, manufacturer, or deployer of the AI system it assesses
• Personnel must not engage in activities conflicting with their assessment objectivity
• Financial independence from the commercial success of the assessed product is mandatory

The notified body performs the mandatory third-party assessment for high-risk AI systems, verifying compliance with the EU AI Act's essential requirements. This is the gatekeeping function before CE marking.

• Audits the provider's quality management system and technical documentation
• Evaluates the risk management system for completeness and effectiveness
• May conduct product testing or require specific performance demonstrations

A notified body is not authorized to assess all AI systems. Its accreditation scope strictly defines the categories of high-risk AI products it is competent to evaluate, based on its demonstrated technical expertise and resources.

• Scope is formally defined in the designation notification
• Covers specific AI technologies (e.g., biometrics, medical devices, safety components)
• Operating outside the defined scope invalidates the conformity assessment

The notified body's responsibility extends beyond the initial certification. It must conduct periodic audits and surveillance to ensure the AI system continues to comply with regulatory requirements throughout its lifecycle.

• Verifies the provider's post-market monitoring system is functioning
• Assesses substantial modifications to determine if re-certification is needed
• Can suspend or withdraw certificates if non-compliance is identified

The notified body must maintain professional indemnity insurance and employ personnel with the specialized knowledge to evaluate complex AI systems. Assessors must understand both the underlying technology and the applicable legal framework.

• Staff must possess deep knowledge of machine learning, data governance, and bias detection
• Must understand the intersection of AI functionality and fundamental rights
• Required to maintain confidentiality of all proprietary information obtained during assessment

The mandatory verification process by which a provider demonstrates that a high-risk AI system meets all applicable regulatory requirements prior to market placement. This is the core activity performed by a Notified Body. The assessment involves auditing the technical documentation, quality management system, and the system's compliance with essential requirements. Successful completion is a prerequisite for CE marking.

A physical or digital mark affixed to an AI system indicating the manufacturer's declaration that the product complies with all applicable EU harmonization legislation, including the AI Act. For many high-risk systems, the CE marking cannot be affixed without a certificate issued by a Notified Body. It serves as a passport for the free movement of goods within the European Economic Area.

The formally defined and authorized boundaries of technical competence within which a Notified Body is permitted to conduct conformity assessments. A body is not authorized to assess all AI systems; its scope is strictly limited to specific categories of high-risk AI systems (e.g., biometrics, medical devices). Providers must verify that a body's scope matches their system's classification.

European technical specifications adopted by recognized standards bodies (CEN/CENELEC) that provide a presumption of conformity with the AI Act's essential requirements. When a provider designs a system in full compliance with these standards, the Notified Body's assessment is streamlined, as compliance with the standard is accepted as proof of meeting the corresponding legal obligations.

The comprehensive dossier a provider must compile and submit to the Notified Body. It must contain detailed information on the system's design, development, and performance, including:

• Intended purpose and foreseeable misuse
• System architecture and design specifications
• Training data provenance and governance
• Risk management system outputs
• Accuracy, robustness, and cybersecurity metrics

A formalized, documented organizational structure of policies, processes, and procedures required for providers. The Notified Body audits this system to ensure the manufacturer can consistently design, develop, and maintain compliant high-risk AI systems. The audit covers strategy, design control, technical specifications, and post-market monitoring procedures.