Notified bodies, certificates, and the emergency valve
Lesson 3 of 5 in Conformity Assessment, Standards, CE Marking, and Post-Market Duties.
A notified body is a private conformity-assessment organisation that a Member State has vetted and notified to the Commission as competent to certify against the AI Act. Articles 28–39 build the trust architecture around them, because the whole CE system collapses if certifiers are captured, incompetent, or shopping-friendly.
Each Member State designates a notifying authority that assesses applicants (accreditation under Regulation 765/2008 is the standard evidence), notifies successful bodies to the Commission via the NANDO database, and polices them afterwards. A certificate issued by a notified body in one Member State is valid across the whole Union — which is precisely why the entry requirements are strict and why any Member State or the Commission can challenge a body’s competence, with suspension or withdrawal of the notification on the line (Art 37).
Independence and impartiality
The body, its top management, and assessment personnel must be independent of the providers they assess and of any economic interest in the systems — no designing, building, supplying, or consulting on what they certify. Remuneration of assessors may not depend on assessment results (Art 31). This is the anti-capture core: a certifier paid per happy customer is not a control.
Competence
Documented procedures and personnel with the technical, regulatory, and — new for AI — data-science competence to assess against Arts 9–15. Bodies must be able to evaluate testing evidence, data-governance documentation, and cybersecurity claims, not just paperwork completeness.
Confidentiality and liability insurance
Everything the body learns — including, in Annex VII assessments, potential access to training data and models — is protected by professional secrecy (Art 78). Bodies must carry liability insurance unless the Member State assumes that liability. Confidentiality is what makes providers willing to open the black box to an auditor at all.
Subsidiaries and subcontracting
A notified body may subcontract specific tasks or use subsidiaries, but only with the provider’s consent, under the body’s full responsibility, and the subcontractor must meet the same requirements (Art 33). The name on the certificate cannot outsource its accountability.
Coordination and cross-border consistency
The Commission ensures coordination groups of notified bodies so that assessment practice converges — otherwise providers would forum-shop toward the most lenient certifier in the Union (Art 38). Third-country conformity bodies may act under mutual-recognition agreements on equivalent terms (Art 39).
The output of an Annex VII assessment is a Union technical documentation assessment certificate — and Article 44 puts an expiry date on it. Certificates are valid for the period they state, up to a ceiling of five years for Annex I systems and four years for Annex III systems, renewable on re-assessment for further periods of the same length. A notified body that finds a system no longer conforming must suspend or withdraw the certificate (or restrict it) unless the provider cures the problem within a set deadline — and its decisions must be appealable.
Then there is the emergency valve. Under Article 46, a market surveillance authority may authorise placing a specific high-risk system on the market before conformity assessment is completed, for exceptional reasons of public security, protection of life and health, environmental protection, or protection of key industrial and infrastructural assets — a temporary, conditioned authorisation while the procedure catches up, with a law-enforcement variant for duly justified urgency. It is the Act acknowledging that a flood-prediction system should not drown in its own paperwork during a flood.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.