Notified bodies are independent conformity assessment bodies designated by a Member State's notifying authority to carry out third-party conformity assessment under the AI Act. Notifying authorities assess, designate, notify and monitor the bodies in their Member State, and the Commission maintains the list of notified bodies. A body must meet the requirements in the Act on independence, competence, impartiality and confidentiality, and may act only within the scope of its notification.
Who designates a notified body?
Each Member State designates a notifying authority responsible for setting up and carrying out the procedures for assessing, designating, notifying and monitoring conformity assessment bodies. The notifying authority assesses whether an applicant body meets the requirements in the Act, designates it where it does, notifies the Commission and other Member States, and monitors the body on an ongoing basis. The Commission assigns an identification number and publishes the list of notified bodies, with their scope. A provider should check that list, and the body's notification, before engaging a body, to confirm that the body is notified for the AI Act scope that covers the system in question. A body notified under other product legislation is not automatically notified for the AI Act, and the provider should check the AI Act scope specifically.
What requirements must a notified body meet?
A notified body must meet the requirements set out in Chapter III Section 4, including, in outline, establishment under national law, independence from the provider and from any other party with an interest in the system, absence of conflicts of interest, competence of personnel, appropriate procedures, confidentiality, and liability cover. Personnel carrying out assessment must have the technical and regulatory competence for the systems they assess, and must not have been involved in the design, manufacture, supply or maintenance of the system they assess. The body must have documented procedures for assessment, for handling appeals, and for protecting confidential information. A provider engaging a body should record the body's notification, scope, and identification number, and should check that the body's procedures and competence match the system to be assessed, rather than assuming that notification alone guarantees a good fit.
For the broader regulatory framework, see Conformity assessment and CE marking overview.
How is a body monitored and challenged?
Notifying authorities monitor notified bodies on an ongoing basis, including through periodic assessments, and must take action where a body no longer meets the requirements or fails to fulfil its obligations. That action can include restricting, suspending or withdrawing the notification. The Commission and other Member States can also raise concerns about a body's competence or performance, and the notifying authority must investigate and respond. A provider with a certificate from a body whose notification is restricted or withdrawn should check the effect on its certificate and on systems already on the market, and should record the assessment and any action taken. The provider should also have a route to appeal a body's decision, as the body's procedures must provide, and should use that route with evidence rather than seeking a second body in parallel.
What is the scope of a notification?
A notification has a scope that defines the conformity assessment activities, the types of systems, and the procedures the body may carry out. A body may act only within that scope, and a certificate issued outside scope does not evidence a valid assessment. The provider should check the scope in the Commission's list and in the body's notification, and should record the scope relied on for its system. Where a system spans more than one scope, or where the scope is unclear, the provider should clarify with the body and the notifying authority before starting the assessment. The scope check should be dated and kept in the conformity file, alongside the certificate, so that a later reviewer can see that the body was entitled to carry out the assessment it performed.
How should a provider choose and work with a body?
A provider should choose a body on the basis of scope, competence, capacity, and the ability to work to the timetable the system requires, not only on price or familiarity. The provider should agree the scope, the timetable, the information to be supplied, the audit arrangements, and the handling of findings before the assessment starts, and should appoint a single contact to manage the relationship. During assessment, the provider should respond promptly and completely to requests, log each request and response, and escalate any disagreement through the body's procedures with evidence. After assessment, the provider should diarise surveillance, renewal, and change notification duties, and should keep the body informed of changes that could affect the certificate. A well-managed relationship produces a file that both sides can follow, while a poorly managed one produces gaps that surface only when a certificate is questioned.
Continue with Third-party assessment under Annex VII.
What does this guide not decide?
This guide does not decide whether a particular body meets the requirements, whether its scope covers a specific system, whether a certificate is valid, or whether a notification should be restricted or withdrawn. It does not recommend a body or assess a body's performance. Those questions depend on the body's notification, its scope, its assessment file, and the decisions of the notifying authority and the Commission. A provider should check the current Commission list and the body's notification on the date of engagement, record the check, and confirm the position with the notifying authority or a legal adviser where the scope is unclear.
Frequently asked questions
Is every testing laboratory a notified body?
No. A notified body is a conformity assessment body that has been assessed, designated and notified by a Member State's notifying authority for the AI Act, and listed by the Commission with a scope and identification number. A laboratory that has not been through that process cannot carry out Annex VII assessment, even if it is competent in testing.
Can a body assess a system it helped design?
No, in outline. Notified bodies and their personnel must be independent and free from conflicts of interest, and must not have been involved in the design, manufacture, supply or maintenance of the system they assess. The provider should check independence and record the check before engaging a body.
Where can I check a body's scope?
Check the Commission's published list of notified bodies and the body's notification, which state the scope, the procedures covered, and the identification number. Record the check with its date in the conformity file, and clarify any scope question with the body or the notifying authority before assessment starts.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗