EU AI Act Conformity Assessment and Notified Bodies

Do not start with the question "Which auditor do we need?" Start with why the AI system is high-risk. Article 6 separates product-linked high-risk AI from Annex III use cases. That split controls the conformity route, the evidence package, and whether an existing product-law notified body may become part of the assessment.

For product-linked systems under Article 6(1), the AI system is high-risk when it is a safety component, or is itself a product, covered by Annex I Union harmonisation legislation and that product is already subject to third-party conformity assessment under that legislation. For Annex III systems, Article 43 generally points to internal control, with a narrower notified body route for point 1 Annex III systems in the conditions listed in Article 43(1).

Internal control is not a no-evidence shortcut. Annex VI requires the provider to verify that the quality management system complies with Article 17, examine the technical documentation against the high-risk requirements in Chapter III Section 2, and verify that the design, development process, and post-market monitoring match the technical documentation.

The minimum evidence package should therefore connect the Section 2 requirements to system design and operating controls: risk management, data governance, technical documentation, logging, deployer information, human oversight, accuracy, robustness, and cybersecurity. A self-assessment that only stores a policy or vendor attestation does not answer Annex VI.

A notified body is required under Article 43(1) for high-risk AI systems listed in point 1 of Annex III when the provider cannot rely fully on the relevant harmonised standards or common specifications, including where no such standards or specifications exist, only part of a standard is applied, a common specification is not applied, or a standard is published with a restriction for the relevant part.

For high-risk AI systems covered by Annex I product legislation, Article 43(3) sends the provider to the conformity assessment procedure required by that product law. Notified bodies notified under those product laws may control conformity with AI Act Section 2 requirements if their compliance with specified AI Act notified-body requirements has been assessed in the relevant notification procedure.

Article 16 makes the provider responsible for the complete pre-market chain: comply with Section 2 requirements, operate a quality management system, keep documentation, run the Article 43 conformity assessment before placement or putting into service, draw up the EU declaration of conformity, affix CE marking, and register where Article 49 applies.

The EU declaration is not just a cover sheet. Article 47 and Annex V require a declaration for each high-risk AI system, issued under the provider's sole responsibility, identifying the system, the provider or authorised representative, applicable Union law, relevant standards or common specifications, and, where applicable, the notified body, procedure, and certificate.

Notifying authorities are Member State authorities responsible for the assessment, designation, notification, and monitoring of conformity assessment bodies. They must be organised to avoid conflicts of interest and to safeguard objectivity and impartiality. A notifying authority is not the provider's assessor in the same way as a notified body; it controls which conformity assessment bodies can become notified bodies and monitors them.

A notified body is the conformity assessment body that has been notified and may perform the notified-body assessment tasks within the scope of its notification. Article 31 requires notified bodies to be independent of providers and other economically interested operators, to avoid consultancy conflicts, to maintain confidentiality, and to have sufficient administrative, technical, legal, and scientific personnel for the relevant AI systems, data, computing, and AI Act requirements.

Use this checklist as a release gate for a high-risk AI system. It focuses on whether the conformity file would let a competent authority, notified body, importer, distributor, or enterprise customer understand the route chosen and verify the evidence without rebuilding the history from memory.

Escalate the file for legal and regulatory review when the route depends on Annex I product law, Annex III point 1 conditions, partial standards coverage, a restricted harmonised standard, non-application of common specifications, a substantial modification, or a notified-body refusal or restriction.