Notified body
A notified body is an independent, accredited organisation designated to carry out third-party conformity assessments (Annex VII) for high-risk AI systems in the specific cases where self-assessment is not sufficient.
Notified bodies are designated by national notifying authorities and monitored on an ongoing basis, and they must satisfy requirements on independence, competence, confidentiality and liability insurance. They assess the provider's quality management system and technical documentation, issue certificates where the system conforms, and may restrict, suspend or withdraw a certificate where a system no longer meets the requirements. Providers have a right to appeal a refusal, and notified bodies must not offer consultancy that would compromise their independence from the providers they assess.
- Art. 29
- Art. 31
- Art. 44
- Annex VII
Notified body: why it matters
Notified-body capacity is the practical bottleneck in the high-risk regime: designation is slow, the pool of bodies competent in AI is small, and the systems that need one — biometrics above all — are concentrated. A provider that discovers it needs third-party assessment late is not facing a paperwork delay but a queue it does not control. The independence rules also close the obvious shortcut: the body that assesses you cannot be the consultancy that prepared your file.
Notified body in practice
A provider of a remote biometric identification system finds that no harmonised standard yet covers its approach, which puts it on the Annex VII route. It scopes the engagement early, engages a separate advisory firm to prepare the technical documentation so the assessing body stays independent, and treats the certificate — which is time-limited and subject to surveillance — as an ongoing relationship rather than a one-off sign-off.
Notified body: the mistake people make
Assuming a notified body's certificate makes the provider's own obligations lighter. It does not: the risk-management system, technical documentation, logging, post-market monitoring and incident reporting all remain the provider's, and the certificate can be suspended or withdrawn if the system stops conforming.
Notified body: common questions
- When is a notified body required for AI?
- Principally for high-risk biometric systems where the provider has not applied harmonised standards or common specifications, and where the Annex I product legislation applicable to the system already prescribes third-party conformity assessment.
- Can our consultants also be our notified body?
- No. Notified bodies must be independent of the provider and of the system they assess, and must not provide consultancy services that would compromise that independence. Preparation and assessment have to be separate organisations.
- How do we find a notified body for the AI Act?
- Notified bodies are designated by national notifying authorities and listed by the Commission with their identification numbers and scopes. Availability is limited, so engagement should be scoped well ahead of the intended launch.
Notified body: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.