Notified Body Responsibilities and Operational Obligations

Legal Framework

Notified body responsibilities under the AI Act are governed primarily by Article 29 (application for notification), Article 30 (notification procedure), and the quality management obligations in Article 17. Together these provisions establish a lifecycle: a conformity assessment body applies for designation, the notifying authority verifies competence against Article 31 requirements, and the body may only commence activities once the Commission and Member States have had the opportunity to object.

Article 29 sets the documentary baseline. The applicant must submit a description of its intended activities accompanied by an accreditation certificate or, where none exists, equivalent documentary evidence:

"the conformity assessment body concerned cannot provide an accreditation certificate, it shall provide the notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of its compliance with the requirements laid down in Article 31"
— AI Act Art. 29(3)

Article 30 then gates operational commencement on a two-week or two-month objection window, depending on whether accreditation is in place. Notifying authorities may only notify bodies that have satisfied Article 31 requirements, and the notification must include full details of activities, modules, AI system types, and competence attestation.

Key Developments

The EDPB's accreditation guidelines, though issued under the GDPR framework, articulate principles that carry across to AI Act conformity assessment. Accreditation serves as an authoritative statement of competence, and the EDPB frames it as:

This logic — that accreditation is the presumptive proof of competence, with documentary evidence as a fallback — maps directly onto the AI Act's two-track notification design in Articles 29 and 30.

For bodies already designated under other Union harmonisation legislation, Article 29(4) permits reuse of existing documentation, and Article 29 requires ongoing updates:

"The notified body shall update the documentation referred to in paragraphs 2 and 3 of this Article whenever relevant changes occur, in order to enable the authority responsible for notified bodies to monitor and verify continuous compliance"
— AI Act Art. 29(4)

This continuous-compliance obligation means designation is not a static achievement; material changes in scope, personnel, or methodology trigger a duty to refresh the notification file.

Status of the Debate

This topic is actively litigated. The AI Act's notified body framework is new and borrows heavily from established Union harmonisation legislation (e.g., the Machinery Regulation, MDR), but courts and notifying authorities are still calibrating how the Article 31 competence requirements translate into operational practice for AI-specific assessments. No court split is on record yet, but the open questions are concrete: what constitutes "relevant changes" triggering a documentation update under Article 29(4), and what level of objection detail from Member States under Article 30(4) suffices to block a notification. Resolution will likely come through the first wave of Commission objection decisions and subsequent annulment actions before the CJEU, which will define the procedural floor for notified body designation and ongoing monitoring.

Practical Guidance

• Maintain a live notification file. Article 29(4) requires updating documentation whenever relevant changes occur. Establish internal triggers — changes in assessment scope, key personnel departures, or methodology shifts — that automatically prompt a documentation refresh to the notifying authority.

• Track the objection window before commencing operations. Under Article 30(4), a notified body may only act after a two-week window (with accreditation) or two-month window (with documentary evidence) expires without objection. Build this waiting period into client engagement timelines.

• Leverage existing designations but verify scope alignment. Article 29(4) allows reuse of documents from other Union harmonisation designations, but confirm that the AI system types and conformity assessment modules in the existing designation actually cover the AI Act scope you intend to assess.

• Ensure the quality management system under Article 17 is audit-ready. Article 17(1) requires documented policies covering regulatory compliance strategy, design verification, and data management — notifying authorities will cross-reference these against the Article 31 competence requirements during monitoring.