Art.33

Article 33 — Subsidiaries of Notified Bodies and Subcontracting

Governance SME Relevant ~2 min read · 457 words

Article 33 addresses what happens when notified bodies do not carry out all their conformity assessment activities in-house. It sets strict conditions under which notified bodies may use subsidiaries or subcontractors — and makes clear that outsourcing does not reduce the notified body’s legal responsibility for the quality of the assessment.

✓ Low compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

Accountability when notified bodies outsource their work

Article 33 establishes the rules for subcontracting and subsidiary use by notified bodies. Given that conformity assessment of complex AI systems may require specialist expertise that no single organisation possesses in full, the Act permits notified bodies to bring in subcontractors or use subsidiaries — but imposes strict accountability requirements to prevent this from diluting the quality of the assessment.

WHAT IT SAYS

Full responsibility retained, provider consent required, records kept

Where a notified body subcontracts specific conformity assessment tasks or uses a subsidiary, it must ensure the subcontractor or subsidiary meets the requirements of Article 31
The notifying authority must be informed of any subcontracting arrangements
Notified bodies retain full responsibility for all tasks performed by subcontractors or subsidiaries — they cannot outsource their legal accountability
Subcontracting or use of subsidiaries may only occur with the agreement of the provider whose AI system is being assessed
Notified bodies must make a publicly available list of their subsidiaries
All documentation concerning the qualifications of subcontractors and the work they perform must be retained for five years after the subcontracting ends

WHO IS AFFECTED

Notified bodies, their subcontractors, and providers being assessed

Notified bodies that use specialist subcontractors for parts of their conformity assessment work
Subsidiary organisations of notified bodies carrying out assessment tasks on their behalf
Providers of high-risk AI systems whose consent is required before subcontracting can occur
Notifying authorities that must be informed of subcontracting arrangements and monitor compliance

WHAT IT MEANS FOR SMES

Your right to know who is assessing your system

The provider consent requirement is significant for SMEs: before your notified body can hand any part of your conformity assessment to a third party, they must ask your permission — you have the right to say no or to ask questions about the subcontractor’s qualifications
Ask your notified body upfront whether they intend to subcontract any part of your assessment and, if so, to whom — this is information you are entitled to
The publicly available list of subsidiaries is a transparency tool — check it before engaging a notified body to understand the full group of entities that may be involved in your assessment
The five-year record retention requirement means documentation from your assessment should remain accessible if questions arise about the quality of the work performed
Full accountability remaining with the notified body is the key protection for providers — even if a subcontractor makes an error, the notified body is legally responsible for it

Article 31 — Requirements for notified bodies (subcontractors must meet these same requirements)
Article 28 — Notifying authorities (must be informed of subcontracting arrangements)
Article 43 — Conformity assessment (the activity that may be subcontracted)
Article 44 — Certificates (issued by the notified body regardless of subcontracting)

← Back to the Guide