Under Annex VII, a notified body assesses the provider's quality management system and the technical documentation, to determine whether the high-risk AI system meets the Section 2 requirements. The provider must supply the documentation and information the body needs, cooperate with audits and evaluations, and address findings. A successful assessment leads to a certificate, on the basis of which the provider draws up the declaration of conformity and affixes the CE marking, while remaining responsible for the system.
When does Annex VII apply?
Annex VII applies where Article 43 requires or the provider has chosen the notified-body route, principally for Annex III point 1 systems in the circumstances set out in Article 43(1), and for Annex I systems where the relevant product legislation requires third-party assessment and the notified body meets the Article 43 conditions. The provider should record the route decision and the basis for it before engaging a body, so that the scope of the assessment is clear. Engaging a body does not change the classification or the requirements; it changes who assesses them. A provider should check that the body it chooses is notified for the relevant scope, that its notification covers the system in question, and that any market surveillance authority acting as a notified body for law enforcement or Union institution systems is correctly identified.
What does the notified body assess?
The notified body assesses the quality management system and the technical documentation, including whether the system design, development and post-market processes are consistent with the documentation and whether the Section 2 requirements are met. The assessment can include audits of the provider's premises and processes, examination of documentation, and evaluation of testing and evidence. The body may ask for additional information, clarification, or further testing, and the provider must cooperate and supply what is needed for the assessment. The body records its findings, distinguishes between findings that must be corrected and observations, and reaches a conclusion on whether a certificate can be issued. A provider should treat the body's questions as part of the assessment, not as an interruption to it, and should record the questions and the answers in the file.
For the broader regulatory framework, see Conformity assessment and CE marking overview.
What must the provider supply and do during assessment?
The provider must apply to a single notified body for the assessment, supply the technical documentation and quality system information, and make available the system, premises, data and personnel the body needs to carry out its work, subject to the safeguards in the Act. The provider must inform the body of any change that could affect compliance, and must not apply to another body for the same assessment in parallel. The provider should appoint a single contact for the assessment, maintain a log of requests and responses, and ensure that the version assessed is the version to be placed on the market. A provider that supplies different versions to the body and to the market, or that withholds a material change during assessment, undermines the certificate that follows.
What happens after a certificate is issued?
Where the assessment is successful, the notified body issues a certificate, with a scope, a validity period, and any conditions, as Annex VII provides. The provider draws up the declaration of conformity, affixes the CE marking, and registers the system where required, referencing the certificate where the declaration calls for it. The provider must keep the certificate, the assessment file, and the documentation together, and must inform the body of changes that could affect the certificate, including substantial modifications. The body carries out surveillance as Annex VII provides, which can include periodic audits and checks that the provider continues to meet the assessed conditions. A certificate is not a permanent approval: it is tied to the assessed system, version, and quality system, and it can be restricted, suspended or withdrawn where the conditions are no longer met.
What if the assessment does not succeed?
Where the body finds that the system does not meet the requirements, it must not issue a certificate, and the provider must address the findings before the system is placed on the market. The provider should record each finding, the corrective action taken, and the re-examination carried out, and should not draw up a declaration or affix CE marking on the basis of a failed or incomplete assessment. The provider may seek a new assessment after correction, following the procedure the body sets, and should record the history of the application, including any refusal, so that a later assessor can see the full picture. A provider should not seek a certificate from another body for the same system without disclosing the earlier assessment history, as Annex VII requires a single application and transparency about prior applications.
Continue with Conformity assessment routes under Article 43.
What does this guide not decide?
This guide does not decide whether a notified body should issue a certificate, whether a finding is material, whether a change affects a certificate, or whether a provider has cooperated sufficiently. It does not choose a notified body or assess a body's competence. Those questions depend on the assessment file, the body's findings, the system version, and the consolidated legal text. A provider should engage a notified body early, keep the assessment log complete, and confirm the position with the body and, where needed, a competent authority or legal adviser.
Frequently asked questions
Does a notified-body certificate transfer responsibility to the body?
No. The provider remains responsible for the system, the declaration and the CE marking. The certificate evidences the body's assessment of the quality system and documentation at the time of assessment, but it does not remove the provider's duties for post-market monitoring, corrective action and keeping the file current.
Can a provider apply to several notified bodies at once?
No. The provider must apply to a single notified body for an Annex VII assessment and must disclose prior applications for the same system. Parallel applications are not permitted, and the history should be recorded in the file.
How long does a certificate last?
The certificate has a scope and validity period set under Annex VII, and it is subject to surveillance and to notification of changes. The provider should record the scope, period and conditions, diarise renewal and surveillance, and inform the body of changes that could affect the certificate.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗