Category: Compliance & Audit

Notified Body

Simply put

A notified body is an organization that an EU member state has designated to check whether certain products meet applicable EU requirements before they are placed on the market. This checking process is known as conformity assessment. The designation identifies the body as authorized to perform these assessments for specific categories of products.

Formal definition

In the European Union, a notified body is an organisation designated by an EU member state to carry out conformity assessment of certain products against the relevant EU requirements prior to their placement on the market. According to the evidence provided, the concept is documented most concretely in the context of product regulation such as medical devices, where a notified body may conduct conformity assessment under the applicable EU rules and issue related certification. The evidence describes designation by a member state as the mechanism that confers this authority for a defined scope. This entry does not address the extent to which the notified body concept has been incorporated into AI-specific EU regulation; the sources provided cover product conformity assessment generally and medical devices in particular, and any application to AI systems is out of scope of this evidence. Note that designation defines which bodies are eligible to perform assessments for a given scope; the evidence provided does not establish rules governing how a manufacturer selects among designated bodies, so no claim is made here about the manufacturer's freedom of choice.

Why it matters

The notified body concept sits at the center of how the European Union assures that certain regulated products meet applicable EU requirements before they reach the market. Rather than relying solely on a manufacturer's own attestation, EU product regulation for defined categories introduces an independent organization to perform conformity assessment. This structure matters because it separates the party with a commercial interest in placing a product on the market from at least part of the process that verifies compliance, adding an external check that supports the credibility of the EU's single market rules.

For compliance and risk professionals, understanding notified bodies is important because designation is scope-specific: a body is authorized to assess only the categories of products for which an EU member state has designated it. According to the evidence provided, this concept is documented most concretely in the context of product regulation such as medical devices, where a notified body may conduct conformity assessment under the applicable EU rules and issue related certification. Getting the scope right—knowing what a given body is and is not designated to assess—is a practical prerequisite to relying on any assessment or certification it issues.

A common misunderstanding is worth flagging directly: designation identifies which bodies are eligible to perform assessments for a given scope, but it does not mean a manufacturer has no say in the matter. In many EU frameworks a manufacturer is free to choose among the notified bodies designated for the relevant scope. The evidence provided does not establish the detailed rules governing that selection, so this entry makes no specific claim about the mechanics of choice beyond noting that designation and manufacturer selection are distinct questions and should not be conflated.

Who it's relevant to

Regulatory and compliance specialists working with EU product rules

Professionals responsible for placing regulated products on the EU market need to understand that conformity assessment for certain product categories may involve an independent notified body designated by a member state. Because designation is scope-specific, confirming that a body is designated for the relevant product category is a foundational compliance step before relying on its assessment or certification.

Medical device manufacturers and their quality teams

The evidence documents the notified body concept most concretely in the medical device context, where a notified body may conduct conformity assessment under the applicable EU rules and issue related certification. Teams in this sector should treat the designated scope of a given body as central to whether its assessment is applicable to their product.

AI governance and model risk professionals monitoring EU regulatory developments

Those tracking how EU conformity assessment concepts may intersect with AI regulation should note that the evidence here covers product conformity assessment generally and medical devices in particular. The extent to which the notified body concept has been incorporated into AI-specific EU regulation is out of scope of this evidence, and readers should not assume the product-regulation model transfers directly to AI systems without separate, authoritative confirmation.

Inside Notified Body

Conformity assessment body

A notified body is a conformity assessment organization that has been designated to assess whether certain products or systems meet the requirements set out in applicable EU legislation before they are placed on the market.

Designation for a defined scope

A notified body is designated by the relevant authority of an EU member state for a specific scope of assessment tasks. Its authority is limited to the categories of products, systems, and procedures for which it has been designated.

Manufacturer's choice among designated bodies

Where third-party conformity assessment is required, a manufacturer is generally free to select any notified body that has been designated for the relevant scope. Designation determines eligibility, but the manufacturer chooses which eligible body to engage.

Relationship to AI governance and conformity

In the context of certain high-risk AI systems, notified bodies may be involved in conformity assessment procedures. This is a compliance and market-access function distinct from an organization's internal AI governance structures or its model risk management practices, though it may interact with both.

Assessment versus internal validation

A notified body performs an external, third-party assessment. This is conceptually distinct from a manufacturer's own internal validation or verification activities, which remain the manufacturer's responsibility regardless of any external assessment.

Common questions

Answers to the questions practitioners most commonly ask about Notified Body.

Does a manufacturer have any choice in which notified body it uses, or is one assigned by a member state?

In the EU framework, notified bodies are designated (accredited and authorized) by member state authorities for specific scopes, but the manufacturer is typically free to choose among any of the notified bodies designated for the relevant scope. The member state role is to designate and oversee these bodies, not to assign a particular one to a given manufacturer. So the two ideas coexist: designation is a governmental function, while selection among designated bodies is generally the manufacturer's decision.

Is engaging a notified body always required to place a product or AI system on the market?

Not necessarily. Third-party conformity assessment through a notified body is required only where the applicable EU legislation calls for it, which typically depends on the product category or risk classification. In many cases the applicable law permits self-assessment by the manufacturer, and notified body involvement is only triggered for certain higher-risk or specified categories. Whether a notified body is needed should be determined by reference to the specific legal instrument and conformity assessment route that applies.

How does an organization identify which notified bodies are designated for its relevant scope?

Designation is scope-specific, so an organization should confirm that a candidate body is designated for the particular legislation and product or system category at issue. The EU publishes designation information through official channels that list bodies and their notified scopes; organizations commonly consult these to verify current designation status before engaging a body. Because scopes and designation status can change over time, this verification is typically treated as an ongoing check rather than a one-time confirmation.

What should be established contractually before engaging a notified body?

Organizations commonly define the assessment scope, the applicable conformity assessment route, deliverables, timelines, confidentiality arrangements, and the handling of technical documentation and evidence. Because the notified body's conclusions depend on the completeness of submitted documentation, clarity on what the manufacturer must provide and maintain is typically addressed up front. The engagement does not transfer responsibility for compliance away from the manufacturer; it provides an independent conformity assessment.

What happens if a notified body loses or changes its designation during an engagement?

Because designation can be suspended, restricted, or withdrawn by the designating authority, organizations should plan for continuity. In practice this can mean monitoring the body's designation status and understanding what arrangements apply to work already underway or certificates already issued if a designation changes. The specific consequences depend on the applicable legislation and the authority's decisions, so this is generally handled as a risk to be managed rather than a fixed outcome.

How does notified body involvement fit alongside an organization's internal governance and risk controls?

Notified body assessment is an external, independent conformity function and does not replace internal AI governance or model risk management activities. Organizations typically maintain their own documentation, validation, and oversight processes, which the notified body then reviews or relies upon as evidence. The external assessment reduces certain compliance and market-access risks but does not eliminate the manufacturer's ongoing accountability for the system's conformity throughout its lifecycle.

Common misconceptions

Manufacturers are assigned a notified body and cannot choose which one to use.

While notified bodies are designated by member state authorities, a manufacturer is generally free to select any notified body that has been designated for the relevant scope. Designation governs which bodies are eligible; it does not remove the manufacturer's freedom to choose among them.

Engaging a notified body means the AI system's risks have been eliminated and its performance guaranteed.

A conformity assessment addresses whether applicable requirements appear to be met at the point of assessment. It does not eliminate risk, guarantee ongoing performance, or replace the manufacturer's continuing obligations and internal controls.

A notified body's involvement is the same thing as an organization's AI governance or model risk management program.

A notified body provides external conformity assessment tied to market access under EU law. This is distinct from an organization's internal AI governance structures and from model risk management activities, even though these functions may interact.

Best practices

Confirm that a prospective notified body has been designated for the specific scope relevant to your product or system before engaging it, rather than assuming any notified body can perform the assessment.

Exercise your ability to compare and select among designated notified bodies, documenting the basis for your choice as part of your compliance record.

Maintain your own internal validation and verification activities independently of any third-party assessment, treating the notified body's role as external assessment rather than a substitute for internal controls.

Keep the notified body's conformity assessment function distinct in your documentation from your internal AI governance and model risk management processes, noting where they interact.

Do not represent a completed conformity assessment as eliminating risk or guaranteeing ongoing performance; describe it as a point-in-time assessment against applicable requirements.

Track the designated scope and status of your chosen notified body over time, since designation is specific and may change.