SkarpChapter 15 of 25
Notifying Authorities and Notified Bodies
Independent conformity assessment depends on a regulated institutional chain of its own. Articles 28–39 govern who may assess systems, how competence is demonstrated, how subcontracting and certificates are controlled, and what happens when confidence in a notified body fails.
The Institutional Chain in Section 4
A chain of justified trust
Section 4 regulates the institutions that make independent conformity assessment possible: notifying authorities, conformity assessment bodies, notified bodies, Member States, and the Commission.
Follow the sequence
The logic runs from authority design and body application to notification, operational controls, changes to designation, challenges to competence, coordination, and third-country bodies.
Why this matters
A notified body is itself subject to oversight. Confidence in an AI conformity assessment depends on confidence in the assessor and the authority supervising it.
Article 28: Notifying Authorities
At least one authority
Article 28(1): "Each Member State shall designate or establish at least one notifying authority" responsible for procedures covering assessment, designation, notification, and monitoring.
Independence by design
No conflict of interest may arise with conformity assessment bodies. The people deciding notification must be different from the competent people who assessed the body.
No competing business role
The notifying authority shall not provide conformity assessment activities or commercial or competitive consultancy. It must protect confidentiality and have adequate expert personnel.
Articles 29-30: Applying for and Receiving Notification
The application package
Article 29 requires an application to the authority in the Member State where the body is established, including activity, module, AI-system scope, and accreditation material where it exists.
Accreditation changes the evidence route
Without an accreditation certificate, the applicant shall provide all documentary evidence necessary for verification, recognition, and regular monitoring of Article 31 compliance.
Two objection windows
The body may act only after no objections: two weeks for a notification including Article 29(2) accreditation, or two months for one including Article 29(3) documentary evidence.
Quiz: The Notification Clock
Choose the answer that follows Article 30(4) exactly.
A notification includes documentary evidence under Article 29(3), rather than an accreditation certificate under Article 29(2). If no objection is raised, after what period may the conformity assessment body perform notified-body activities?
- Immediately after the notifying authority submits the notification
- After two weeks
- After two months
- After one year
Show Answer
Answer: C) After two months
Article 30(4) distinguishes the routes. The two-week period applies where the notification includes an Article 29(2) accreditation certificate. The two-month period applies where it includes Article 29(3) documentary evidence.
Article 31: What a Notified Body Must Be
Legal, organisational, and cyber foundations
A notified body needs legal personality under Member State law, adequate organisation, quality management, resources, processes, and suitable cybersecurity requirements.
Independence is specific
"Notified bodies shall be independent of the provider of a high-risk AI system in relation to which they perform conformity assessment activities." Economic-interest and competitor independence also matter.
Competence cannot be outsourced away
The body needs permanent administrative, technical, legal, and scientific capability. External assistance does not remove the need for internal capacity to evaluate external work.
Worked Example: Independence, Confidentiality, and Proportionate Procedure
Conflict scenario
A senior manager who designed or commercially advises on the assessed provider's high-risk AI system creates a conflict with Article 31(5)'s independence and integrity safeguards.
External expert, internal responsibility
An external specialist may assist, but Article 31(11) requires the notified body to have enough internal competence to evaluate the work done on its behalf.
Proportionate does not mean optional
Article 31(8) permits procedures to take account of size, sector, structure, and complexity. It does not remove the mandatory requirements of Article 31.
Articles 32-35: Presumption, Subcontracting, Operations, and Public Identification
A limited presumption
Harmonised standards can support an Article 31 presumption only where their published criteria cover the relevant Article 31 requirements. Coverage defines the presumption's boundary.
Delegation is not escape
Subcontracting requires Article 31 compliance, authority information, and provider agreement. "Notified bodies shall take full responsibility for the tasks performed by any subcontractors or subsidiaries."
Transparent operations
Bodies must avoid unnecessary burdens but preserve required rigour. The Commission assigns one identification number and publishes an up-to-date list of bodies and activities.
Article 36(1)-(5): Changes, Cessation, and Investigation
Different change, different route
Extensions of notification scope use Articles 29 and 30. Other notification changes use Article 36(3)-(9), beginning with prompt information to the Commission and other Member States.
Planned cessation
A planned cessation requires notice "at least one year before ceasing its activities". Nine-month certificate continuity is conditional on written successor responsibility and a full assessment.
Fair process, mandatory response
The authority must investigate diligently, tell the body the objections, and hear its views. Established failure requires a proportionate restriction, suspension, or withdrawal response.
Article 36(6)-(9): What Happens to Files and Certificates?
Files and findings
After restriction, suspension, or withdrawal, files must be preserved and available on request. The authority must assess certificate impact and report findings within three months.
Suspension or restriction
Except for unduly issued certificates, validity can continue only in the specific Article 36(8) circumstances, including risk confirmation and, where necessary, temporary successor monitoring.
Withdrawal
For withdrawal, certificate validity may continue for nine months only with a no-risk confirmation and immediate successor responsibility. Assessment must finish within 12 months.
Articles 37-39: Commission Challenge, Coordination, and Third Countries
Commission challenge
Where necessary, the Commission investigates doubts about competence or continuing Article 31 compliance. It may ultimately act if the notifying Member State fails to take corrective measures.
Coordinated assessment practice
The Commission shall ensure a sectoral group of notified bodies. Notifying authorities shall ensure their bodies participate, while the Commission supports knowledge and best-practice exchange.
Third-country condition
Third-country bodies need a Union agreement and may be authorised only "provided that they meet the requirements laid down in Article 31 or they ensure an equivalent level of compliance".
Flashcards: Exact Rules and Time Limits
Flip each card and recall the relevant article, condition, and time limit.
- What must every Member State do under Article 28(1)?
- Each Member State shall designate or establish at least one notifying authority.
- Where does a conformity assessment body apply for notification?
- To the notifying authority of the Member State in which it is established.
- What are Article 30(4)'s objection periods?
- Two weeks where the notification includes an Article 29(2) accreditation certificate; two months where it includes Article 29(3) documentary evidence.
- What must notified bodies be independent of under Article 31(4)?
- The provider of the high-risk AI system assessed, other operators with an economic interest in assessed systems, and competitors of the provider.
- What does Article 31(11) require for external work?
- Notified bodies shall have sufficient internal competences to be able effectively to evaluate tasks conducted by external parties on their behalf.
- How long must Article 33(4) subcontracting records remain available?
- Five years from the termination date of the subcontracting.
- How much advance notice is required for planned cessation?
- At least one year before ceasing activities.
- What happens when Article 36(4) establishes failure?
- The notifying authority shall restrict, suspend or withdraw the designation as appropriate, depending on the seriousness of the failure.
Quiz: Subcontracting and Certificate Continuity
Test whether you can distinguish responsibility, provider agreement, and conditional certificate validity.
Which statement is correct under Articles 33 and 36?
- A notified body may subcontract without the provider's agreement if it tells the notifying authority.
- A subcontractor becomes solely responsible for conformity-assessment tasks it performs.
- A notified body remains fully responsible for subcontracted work, and subcontracting or subsidiary activity requires the provider's agreement.
- All certificates automatically become invalid as soon as a designation is suspended.
Show Answer
Answer: C) A notified body remains fully responsible for subcontracted work, and subcontracting or subsidiary activity requires the provider's agreement.
Article 33(2) makes the notified body fully responsible for tasks performed by subcontractors or subsidiaries. Article 33(3) states that activities may be subcontracted or carried out by a subsidiary only with the provider's agreement. Article 36 provides limited, conditional routes by which certificates may remain valid; automatic invalidity is not the rule.
Key Terms
- subsidiary
- A subsidiary used by a notified body for assessment-related activities; its use is subject to Article 33 conditions.
- designation
- The status granted to a conformity assessment body for notified-body purposes; it can be restricted, suspended, or withdrawn.
- notified body
- A conformity assessment body notified under the Regulation that satisfies Article 31 and may perform notified-body activities after the Article 30 procedure.
- subcontractor
- An external party to which a notified body subcontracts specific conformity-assessment tasks while retaining full responsibility.
- implementing act
- An EU legal act that the Commission may use under Article 37(4), following the Article 98(2) examination procedure, to suspend, restrict, or withdraw a designation when the Member State fails to take necessary corrective measures.
- planned cessation
- A notified body's intended end of conformity-assessment activities, requiring at least one year of advance notice.
- harmonised standard
- A standard whose relevant reference has been published in the Official Journal of the European Union and which may create the conditional Article 32 presumption.
- notifying authority
- A Member State authority responsible for procedures to assess, designate, notify, and monitor conformity assessment bodies under Article 28.
- accreditation certificate
- A certificate issued by a national accreditation body attesting that a conformity assessment body fulfils Article 31 requirements, where such a certificate exists.
- conformity assessment body
- A body that applies for notification and, once notified, may perform the relevant conformity assessment activities.