Art.44

Article 44 — Certificates

High-Risk Systems SME Relevant ~2 min read · 471 words

Article 44 governs the certificates issued by notified bodies following a successful third-party conformity assessment. It sets their validity periods, the conditions under which they can be extended, restricted, suspended or withdrawn, and the right of appeal. If your high-risk AI system requires notified body assessment, this article defines the lifecycle of the certificate you receive.

⚠ Medium compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

The validity, extension and withdrawal of notified body certificates

Article 44 establishes the rules governing the certificates that notified bodies issue following conformity assessments under Annex VII. It covers the full lifecycle of a certificate — from issuance to extension, restriction, suspension and withdrawal — and ensures providers have clear entitlements and protections throughout.

WHAT IT SAYS

Five years maximum, renewable, with appeal rights

Certificates must be drawn up in a language easily understood by the relevant authorities in the member state where the notified body is established
Certificates are valid for a maximum of five years for AI systems covered by Annex I harmonisation legislation, and four years for Annex III systems
At the provider’s request, validity may be extended for further periods of up to five years (Annex I) or four years (Annex III) based on re-assessment
Any supplement to a certificate remains valid as long as the main certificate is valid
Where a notified body finds the AI system no longer meets requirements, it must — taking account of proportionality — suspend, restrict or withdraw the certificate, unless the provider takes corrective action within a deadline set by the body
The notified body must give reasons for any adverse decision
An appeal procedure must be available against all notified body decisions, including on conformity certificates

WHO IS AFFECTED

Providers requiring notified body assessment and their certifying bodies

Providers of high-risk AI systems requiring third-party assessment — primarily biometric AI systems under Annex III point 1 and Annex I product safety systems
Notified bodies who issue, manage and may withdraw certificates
Importers and distributors who must verify certificate validity before market placement
Market surveillance authorities who may request certificate details during investigations

WHAT IT MEANS FOR SMES

Treat your certificate as a living document — not a one-time achievement

The validity period means your certificate will expire — diarise the renewal date from the moment you receive the certificate and build re-assessment into your product roadmap
The four-year validity for Annex III systems is relatively short — factor this into your business planning and budgeting for conformity assessment costs
The corrective action provision is a provider protection: if your notified body identifies a compliance gap, you have an opportunity to remedy it before the certificate is suspended — respond quickly and document your corrective actions
The appeal right is real and enforceable — if you believe a notified body decision is wrong, you have a formal mechanism to challenge it
Extensions require re-assessment — do not assume automatic renewal; plan ahead and initiate the re-assessment process before expiry to avoid market access gaps

Article 43 — Conformity assessment (the procedure that leads to certificate issuance)
Article 35 — NANDO register (where certificate information is reflected publicly)
Article 36 — Changes to notifications (how certificate status changes are communicated)
Article 47 — EU declaration of conformity (the provider’s own document that references the certificate)

← Back to the Guide