Notified Body

A Notified Body must operate as a third-party entity completely separate from the AI system provider. It cannot have any direct involvement in the design, manufacture, or commercialization of the systems it assesses.

• Must be free from commercial, financial, or other pressures that might influence judgment
• Personnel cannot be remunerated based on assessment outcomes or volume
• Strict conflict-of-interest policies govern all assessment activities
• Cannot provide consultancy services to the same clients they assess

A conformity assessment body becomes a Notified Body only after a rigorous national designation procedure by an EU member state, followed by formal notification to the European Commission.

• The member state's National Competent Authority evaluates competence against harmonized standards
• The European Commission assigns a unique Notified Body identification number
• The body is listed in the NANDO (New Approach Notified and Designated Organisations) database
• Designation is scope-limited to specific categories of high-risk AI systems

Notified Bodies execute the third-party conformity assessment procedures mandated for high-risk AI systems that cannot be self-assessed by the provider alone.

• Review the Technical Documentation File for completeness and accuracy
• Audit the provider's Quality Management System for design and post-market processes
• Verify that risk management and data governance procedures meet regulatory thresholds
• Issue the EU-type examination certificate when compliance is confirmed
• Conduct unannounced audits during the certificate validity period

Notified Bodies must possess in-house technical competence directly relevant to the AI systems they assess, including deep understanding of machine learning architectures and risk profiles.

• Employ personnel with demonstrated expertise in algorithmic bias detection and model explainability
• Maintain knowledge of state-of-the-art adversarial robustness evaluation techniques
• Understand sector-specific requirements for domains like medical devices or critical infrastructure
• Participate in standardization activities and Notified Body coordination groups
• Continuously train staff on evolving AI technologies and threat landscapes

The Notified Body's responsibility extends beyond initial certification to ongoing oversight throughout the validity period of the EU-type examination certificate.

• Conduct periodic surveillance audits to verify continued compliance
• Review Post-Market Monitoring data submitted by the provider
• Assess whether Substantial Modifications to the AI system require a new conformity assessment
• Have authority to suspend or withdraw certificates if non-compliance is discovered
• Coordinate with National Competent Authorities on serious incident investigations

A conformity assessment certificate issued by a Notified Body in one EU member state is valid across the entire European Union market through the principle of mutual recognition.

• Eliminates the need for duplicate assessments in each member state
• Enables the CE Marking to serve as a single regulatory passport
• Requires Notified Bodies to participate in coordination groups to ensure harmonized interpretation
• Facilitates the Cross-Border Registration of high-risk AI systems in the EU database

The mandatory verification process by which a provider demonstrates that a high-risk AI system meets the essential requirements of the EU AI Act. For systems requiring third-party oversight, this assessment is performed by a Notified Body rather than through internal self-assessment. The process involves auditing the Quality Management System, reviewing the Technical Documentation File, and verifying the system's compliance with Harmonized Standards before a Declaration of Conformity can be signed.

The designated public authority within an EU member state responsible for supervising the implementation and enforcement of AI regulations. This entity is distinct from a Notified Body but plays a critical role in the ecosystem:

• Designation: Nominates and monitors the Notified Bodies within its jurisdiction.
• Enforcement: Receives Incident Reporting Linkage data and can issue a Registration Suspension.
• Oversight: Acts as the ultimate backstop for market surveillance, ensuring Notified Bodies perform their duties rigorously.

The comprehensive dossier that a provider must submit to a Notified Body for a conformity assessment. This is not merely a formality; it is the primary artifact under audit. The file must contain:

• System Architecture: Detailed design and algorithmic specifications.
• Risk Management: Documentation of risk mitigation and Residual Risk Disclosure.
• Data Provenance: A complete Training Data Provenance Record.
• Model Transparency: A Model Card Submission detailing evaluation results and limitations. The Notified Body verifies the completeness and accuracy of this file against regulatory requirements.

The regulatory gate requiring explicit approval from a Notified Body before a high-risk AI system can be registered and placed on the Union market. This is the direct output of a successful conformity assessment. Without a positive certificate from the Notified Body, the provider cannot affix the CE Marking or complete the registration in the EU AI Act Database. This gate is mandatory for systems listed in Annex III that are not covered by a Harmonized Standard or for which the provider has not fully applied the standard.

A European technical specification adopted by a recognized standards body (such as CEN/CENELEC) that provides a presumption of conformity with the EU AI Act's essential requirements. The relationship with a Notified Body is critical:

• Full Application: If a provider fully applies a Harmonized Standard, they may be able to self-assess, bypassing the Notified Body for those specific requirements.
• Partial or No Application: If a provider deviates from or does not use a Harmonized Standard, the involvement of a Notified Body becomes mandatory to verify that the alternative solutions meet the legal requirements.
• Audit Scope: The Notified Body's audit focuses intensely on any gaps where Harmonized Standards were not applied.

A change to an AI system's intended purpose or performance characteristics that triggers a new conformity assessment obligation. For systems originally certified by a Notified Body, this is a critical trigger point:

• Re-Assessment: The provider must return to the Notified Body for a new review of the modified system.
• Change Scope: Modifications that alter the Intended Purpose Declaration or significantly change the algorithmic logic invalidate the original certificate.
• Continuous Oversight: Notified Bodies may be involved in reviewing the provider's Post-Market Monitoring data to identify if a modification has occurred in practice.