Notified Body Assessment Procedures

Legal Framework

Notified body assessment procedures under the AI Act are governed primarily by Article 43, which establishes the conformity assessment pathways for high-risk AI systems. Providers of such systems must, under Article 16(1)(f), ensure compliance before market placement:

"ensure that the high-risk AI system undergoes the relevant conformity assessment procedure as referred to in Article 43, prior to its being placed on the market or put into service"
— AI Act Art. 16

Article 43 offers two routes for systems listed in point 1 of Annex III where harmonised standards or common specifications have been applied: internal control under Annex VI, or a fuller assessment involving a notified body under Annex VII. Where harmonised standards do not exist, have been only partially applied, or carry restrictions, the provider must follow the Annex VII procedure with notified body involvement. Critically, provider choice is preserved:

"the provider may choose any of the notified bodies"
— AI Act Art. 43

Downstream actors carry verification duties. Authorised representatives must confirm that an appropriate conformity assessment was performed by the provider, as must importers before placing systems on the Union market. Importers must verify that the CE marking, EU declaration of conformity, and technical documentation are all in place.

Key Developments

The AI Act's conformity assessment architecture draws on established Union product safety principles, including the New Legislative Framework. The CJEU has reinforced that independent oversight of regulatory compliance is essential to ensuring effective protection. In VB v Natsionalna agentsia za prihodite, the Court emphasised that supervisory mechanisms must operate with sufficient rigour to guarantee substantive rights. While that case arose under data protection law, its underlying logic—that procedural safeguards must be meaningful, not merely formal—applies squarely to notified body assessments under the AI Act.

The Maximillian Schrems litigation further underscores that adequacy of safeguards is assessed against the effectiveness of enforcement, not merely the existence of rules on paper. For notified body procedures, this means that the quality management system review and technical documentation assessment under Annex VII must be substantive exercises, not box-ticking.

Enforcement actions by national authorities, such as the Romanian ANSPDCP's fine against SC Cntar Tarom SA for inadequate technical and organisational measures, illustrate regulators' willingness to penalise failures in procedural compliance—reinforcing that conformity assessment documentation must withstand scrutiny.

Practical Guidance

• Determine your assessment pathway early. Under Article 43(1), providers applying harmonised standards in full may opt for internal control (Annex VI). If standards are absent, partial, or restricted, the Annex VII notified body route is mandatory—plan timelines accordingly.

• Select a notified body strategically. Article 43(2) grants providers free choice among notified bodies, but consider sectoral expertise, accreditation scope, and capacity. For law enforcement or immigration systems, specialised notified bodies may be designated.

• Prepare technical documentation to Annex IV standards. Both authorised representatives under Article 22(3)(a) and importers under Article 23(1)(a) must verify that conformity assessment was properly conducted. Gaps in documentation will block market access.

• Establish a robust quality management system. The Annex VII procedure centres on QMS and technical documentation review. Ensure your QMS under Article 17 covers the full lifecycle of the AI system and is audit-ready.

• Maintain conformity evidence for the full retention period. Authorised representatives must keep declarations and documentation available for 10 years post-placement on the market. Ensure records are complete, accessible, and version-controlled.