Art.28

Article 28 — Notifying Authorities

Governance SME Relevant ~2 min read · 461 words

Article 28 opens Section 4 of Chapter III, which deals with the governance of notified bodies — the independent organisations that carry out third-party conformity assessments of high-risk AI systems. Article 28 establishes the national notifying authorities responsible for overseeing and designating those bodies in each EU member state.

✓ Low compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

The national bodies that oversee AI conformity assessors

Article 28 requires each EU member state to designate or establish a notifying authority — the national body responsible for assessing, designating, and monitoring the conformity assessment bodies that audit high-risk AI systems. Notifying authorities are a governance infrastructure layer that most businesses will never deal with directly, but which underpin the entire third-party conformity assessment system.

WHAT IT SAYS

One per member state, independent, and expertise-equipped

Each member state must designate or establish at least one notifying authority responsible for the assessment, designation and monitoring of conformity assessment bodies
Member states may designate a national accreditation body to fulfil these functions
Notifying authorities must be legally distinct from the conformity assessment bodies they oversee — no conflicts of interest are permitted
They must operate with objectivity and impartiality and must not offer services that conformity assessment bodies provide, nor any commercial consultancy
Notifying authorities must have sufficient competent personnel with expertise in AI technology, law, and fundamental rights supervision
They must safeguard the confidentiality of information they obtain in performing their functions
Member states must notify the Commission of their designated notifying authority and any subsequent changes

WHO IS AFFECTED

Member states and conformity assessment bodies — not businesses directly

EU member state governments — obliged to designate or establish a notifying authority
Existing national accreditation bodies that may take on the notifying authority function
Conformity assessment bodies seeking designation as notified bodies — they deal directly with notifying authorities
Providers of high-risk AI systems requiring third-party conformity assessment — they choose from notified bodies designated by these authorities

WHAT IT MEANS FOR SMES

Background infrastructure — but relevant when you need a notified body

For the vast majority of SMEs, this article is background context rather than a direct compliance obligation
Where it becomes relevant: if your high-risk AI system requires third-party conformity assessment under Article 43, you will select a notified body from the official list — that list is maintained by notifying authorities under this article
The requirement for notifying authorities to be independent and conflict-free is a quality assurance mechanism that protects providers — it means the bodies assessing your conformity are genuinely independent
Check the NANDO database (the EU’s official register of notified bodies) when you need to select a conformity assessment body — this is the practical output of the notifying authority system
Your own national notifying authority is the body to contact if you have questions about which conformity assessment bodies are designated in your member state

Article 29 — Application for notification (how conformity assessment bodies apply to become notified)
Article 31 — Requirements for notified bodies (the standards notifying authorities assess against)
Article 43 — Conformity assessment (when providers must engage notified bodies)
Article 35 — Identification numbers and lists of notified bodies (the public register)

← Back to the Guide