EU AI Act Do you need a notified body?

For Annex III point 1 biometric systems, a provider may choose Annex VI internal control or Annex VII notified-body assessment when it demonstrates compliance using the relevant harmonised standards or, where applicable, common specifications. Articles 40 and 41 set the standards and specifications rules.

Annex III point 1 is the biometrics category. It covers specified remote biometric identification systems, biometric categorisation systems using sensitive or protected characteristics or inferred attributes, and emotion recognition systems, subject to the precise Annex III wording and exclusions. It should not be confused with every system that processes a face, voice, or other biometric data.

For those biometric systems, Annex VII becomes mandatory if relevant standards and specifications are unavailable, a relevant harmonised standard is unused or only partly applied, or available common specifications are unused. It also applies to the restricted part where a harmonised standard was published with a restriction.

Annex III points 2-8 use Annex VI internal control. Article 43 requires no notified-body involvement for that route.

For high-risk AI systems covered by Union harmonisation legislation in Section A of Annex I, Article 43(3), as replaced by Regulation (EU) 2026/1744 from 27 July 2026, keeps the conformity route under the applicable product law and makes the AI Act Section 2 requirements part of that assessment. If that product law permits assessment without a third party when all relevant harmonised standards are applied, inclusion of a high-risk AI safety component does not by itself force third-party assessment. If the same system is also listed in Annex III, the product-law route controls.

For Article 6(1) systems related to Annex I Section B products, amended Article 2(2) limits which AI Act provisions apply directly. Use the relevant sector law instead of assuming the Annex VI/VII route applies. For Section A systems, amended Article 43(3) also includes Article 17 quality-management assessment in the product procedure.

Under Annex VI, the provider checks its own evidence. It must verify that the quality management system meets Article 17, examine the technical documentation against Chapter III Section 2, and check that design, development and post-market monitoring match that documentation.

Prepare the technical documentation before market placement or first use and keep it current. Article 11 requires enough information for authorities and notified bodies to assess compliance. Annex IV lists the contents: purpose, versions, development, data, oversight, testing, cybersecurity, risk management, standards, declaration and monitoring.

Under Annex VII, a notified body reviews both the provider's quality management system and the system's technical documentation. The application identifies the provider and all AI systems covered by that management system. Include technical documentation for each system, Article 17 management-system records, procedures to keep it effective, and a declaration that the same application was not filed with another body.

The body may ask for evidence or tests and carry out tests itself. If other reasonable means are insufficient, it may seek access to training and trained models, subject to intellectual-property and trade-secret protection. It issues a Union technical documentation assessment certificate if the system conforms, or refuses with reasons.

Approval brings continuing surveillance, including periodic audits of the quality management system. Notify the body of intended changes to that system or the covered-system list, and of AI-system changes that could affect compliance or intended purpose.

Prepare an EU declaration of conformity for each high-risk system under Article 47. It may be written, machine-readable, physical or electronically signed. Identify the system, state compliance with Chapter III Section 2, include Annex V information and translate it for relevant authorities. Keep it current and available to national competent authorities for 10 years.

Article 48 requires CE marking for high-risk AI systems. For digital high-risk AI systems, a digital CE marking can be used only when it is easily accessible through the system interface or through an accessible machine-readable code or other electronic means. Where a notified body was responsible for the Article 43 conformity assessment, its identification number follows the CE marking and is also indicated in promotional material that mentions CE conformity.

Article 49 registration is separate from CE marking and must be checked before release. Providers or authorised representatives register themselves and Annex III high-risk AI systems in the EU database before placing them on the market or putting them into service, except for point 2 of Annex III, which is registered at national level. Providers also register systems they concluded are not high risk under Article 6(3). Public authorities, Union institutions, bodies, offices, agencies, and persons acting on their behalf have deployer registration duties for covered Annex III systems before use.

Article 46 lets a market surveillance authority authorise a specific high-risk system for a limited period before assessment is complete. The reasons must meet its exceptional public-security, life-and-health, environmental or key-infrastructure conditions. Complete assessment without undue delay. The authority must grant the permission. For Annex I Section A products, Article 46(7) limits the exception to the applicable product-law route.