EU AI Act Explorer

• Determine if your AI system is high-risk based on these rules:
  • Condition 1 (Product Integration): An AI system is high-risk if it is intended to be used as a safety componentof a product, or is itself a product, covered by EU harmonisation legislation listed in Annex I, AND the product/AI system requires a third-party conformity assessment under that same Annex I legislation.
  • Condition 2 (Specific Use Cases): AI systems referred to in Annex III are considered high-risk.
• Exclusions from Annex III (Derogation): An AI system referred to in Annex III is not high-risk if it does not pose a significant risk of harm to health, safety, or fundamental rights (e.g., by not materially influencing decision-making outcomes), AND one of the following conditions is met:
  • It performs a narrow procedural task.
  • It improves the resultof a previously completed human activity.
  • It detects decision-making patterns without replacing or influencing human assessment, without proper human review.
  • It performs a preparatory task to an assessment relevant for Annex III use cases.
• Profiling Exception to Derogation: An AI system from Annex III that performs profiling of natural persons is always considered high-risk, regardless of the above derogation conditions.
• Provider Obligations for Derogation: If you consider an Annex III AI system not high-risk based on the derogation, you must:
  • Document your assessment before placing the system on the marketor putting it into service.
  • Register the system in the EU database (Article 49(2)).
  • Provide the documentation of the assessment to national competent authorities upon request.
• The Commission will provide guidelines and practical examples by 2 February 2026.

This article outlines the Commission's power to amend Annex III (the listof high-risk AI systems) through delegated acts:

• Adding or Modifying Use-Cases: The Commission can add or modify high-risk AI system use-cases if:
  • The AI systems are intended to be used in any of the areas listed in Annex III.
  • The AI systems pose a risk of harm to health and safety, or an adverse impacton fundamental rights, equivalent to or greater than existing Annex III systems. This assessment considers criteria such as intended purpose, extentof use, data processed (including special categories), autonomy, human override, past harm, potential harm magnitude, dependency of affected persons, power imbalance, correctability/reversibility of outcomes, benefits, and existing EU law for redress/risk prevention.
• Removing High-Risk AI Systems: The Commission can remove high-risk AI systems from Annex III if:
  • The system no longer poses significant risks tofundamental rights, health, or safety (considering the criteria above).
  • The deletion does not decrease the overall level of protection of health, safety, and fundamental rights under Union law.

• High-risk AI systems must comply with the requirements laid down in this Section (Chapter III, Section 2).
• Compliance must consider the AI system's intended purpose and the generally acknowledged state of the art in AI and AI-related technologies.
• The risk management system (Article 9) must be taken into account when ensuring compliance.
• For products containing AI systems that are also subject to other EU harmonisation legislation listed in Section A of Annex I, providers are responsible for ensuring full compliance with all applicable requirements.
• To ensure consistency, avoid duplication, and minimise burdens, providers may choose to integrate the necessary testing, reporting, information, and documentation for AI system compliance into existing documentation and procedures required under other EU harmonisation legislation.

• Establish, implement, document, and maintain a continuous, iterative risk management system for high-risk AI systems throughout their entire lifecycle. This system requires regular systematic review and updating.
• The risk management system must comprise the following steps:
  • Identify and analyse known and reasonably foreseeable risks to health, safety, or fundamental rights when the system is used as intended.
  • Estimate and evaluate risks that may emerge during intended use and under conditions of reasonably foreseeable misuse.
  • Evaluate other risks based on data gathered from the post-market monitoring system (Article 72).
  • Adopt appropriate and targeted risk management measures to address identified risks.
• Focus on mitigatable risks: Risks should concern only those reasonably mitigable or eliminable through development, design, or adequate technical information provision.
• Consider combined effects: Risk management measures must consider the effects and possible interaction resulting from the combined application of all requirements in this Section to minimise risks effectively and achieve balance.
• Achieve acceptable residual risk: Ensure the relevant residual risk associated with each hazard, and the overall residual risk of the high-risk AI system, is judged to be acceptable.
• Prioritise risk reduction measures:
  • Eliminate or reduce risks through adequate design and developmentof the high-risk AI system, as far as technically feasible.
  • Implement appropriate mitigation and control measures for risks that cannot be eliminated.
  • Provide information (Article 13) and, where appropriate, training to deployers.
• Consider deployer context: When reducing risks, give due consideration to the technical knowledge, experience, education, training expected of the deployer, and the presumable contextof use.
• Testing:
  • High-risk AI systems must be tested to identify the most appropriate and targeted risk management measures. Testing must ensure consistent performance for the intended purpose and compliance with requirements.
  • Testing procedures may include testing in real-world conditions (Article 60).
  • Testing must be performed throughout the development process and, in any event, prior to being placed on the marketor put into service.
  • Testing must be carried out against predefined metrics and probabilistic thresholds appropriate to the intended purpose.
• Vulnerable groups: Consider whether the AI system is likely to have an adverse impacton persons under 18 and, as appropriate, other vulnerable groups.
• Integration: If providers are subject to internal risk management processes under other Union law, these requirements may be partofor combined with those existing procedures.

• For AI systems using training data: Ensure training, validation, and testing data sets meet quality criteria whenever used.
• Implement data governance and management practices appropriate for the intended purpose, covering:
  • Relevant design choices.
  • Data collection processes and origin (and original purpose for personal data).
  • Data-preparation operations (annotation, labelling, cleaning, updating, enrichment, aggregation).
  • Formulation of assumptions regarding what the data is supposed to measure and represent.
  • Assessmentof data set availability, quantity, and suitability.
  • Examination for possible biases that may affect health/safety, fundamental rights, or lead to discrimination (especially if data outputs influence future inputs).
  • Appropriate measures to detect, prevent, and mitigate identified biases.
  • Identification and addressmentof relevant data gaps or shortcomings that prevent compliance.
• Data Set Quality: Training, validation, and testing data sets must be:
  • Relevant, sufficiently representative, and, to the best extent possible, free of errors and complete.
  • Possess appropriate statistical properties, including regarding persons/groups for whom the system is intended.
  • Account for characteristics particular to the specific geographical, contextual, behavioural, or functional setting of intended use.
• Processing of Special Categories of Personal Data (e.g., biometric, health, political opinions):
  • Only permitted if strictly necessary for bias detection and correction (Article 10(2)(f) and (g)).
  • Subject to appropriate safeguards for fundamental rights and freedoms.
  • All of the following conditions must be met:
    • Bias detection and correction cannot be effectively fulfilled by processing other data (e.g., synthetic or anonymised).
    • Subject to technical limitations on re-use and state-of-the-art security and privacy-preserving measures (including pseudonymisation).
    • Secured, protected, and subject to suitable safeguards, including strict access controls, documentation of access, and confidentiality obligations.
    • Not transmitted, transferred, or otherwise accessed by other parties.
    • Deleted once the bias is corrected or the retention period ends.
    • Records of processing activities must include reasons why special categories of personal data were strictly necessary and why the objective could not be achieved by other data.
• For AI systems *not* using training data: Paragraphs 2 to 5 apply only to testing data sets.

• Providers of high-risk AI systems must draw up and keep up-to-date technical documentation before placing the system on the marketor putting it into service.
• The documentation must demonstrate compliance with requirements setout in Section 2 and provide national competent authorities and notified bodies with clear, comprehensive information to assess compliance, containing, at a minimum, the elements setout in Annex IV.
• SMEs, including start-ups, may provide Annex IV elements in a simplified manner using the form to be established by the Commission. Notified bodies must accept this simplified form for conformity assessment.
• Where a high-risk AI system is related to a product covered by Union harmonisation legislation listed in Annex I, Section A, a single setof technical documentation combining all required information shall be drawn up.

• High-risk AI systems must technically allow for the automatic recording of events (logs) over the lifetime of the system.
• Logging capabilities must enable the recording of events relevant for:
  • Identifying situations that may result in a risk (Article 79(1)) or a substantial modification.
  • Facilitating post-market monitoring (Article 72).
  • Monitoring the operation of high-risk AI systems (Article 26(5)).
• For high-risk AI systems referred to in Annex III, point 1(a), logging capabilities must provide, at a minimum:
  • Recording of the period of each use of the system (start/end date and time).
  • The reference database against which input data has been checked.
  • The input data for which the search has led to a match.
  • The identification of natural persons involved in the verification of results (Article 14(5)).

• High-risk AI systems must be designed and developed to ensure their operation is sufficiently transparent, enabling deployers to interpret the system's output and use it appropriately.
• Systems must be accompanied by instructions for use, in an appropriate digital formator otherwise, that include concise, complete, correct, clear, relevant, accessible, and comprehensible information for deployers.
• The instructions for use must contain at least the following information:
  • Identity and contact details of the provider (and authorised representative, if applicable).
  • Characteristics, capabilities, and performance limitations, including intended purpose, accuracy levels (metrics, robustness, cybersecurity tested against), known/foreseeable circumstances impacting expected performance, technical capabilities for output explanation, performance regarding specific persons/groups, and input data specifications.
  • Changes to the system and its performance pre-determined by the provider at the initial conformity assessment.
  • Human oversight measures (Article 14).
  • Computational/hardware resources needed, expected lifetime, and necessary maintenance/care measures.
  • A description of mechanisms allowing deployers to properly collect, store, and interpret logs (Article 12), where relevant.

• High-risk AI systems must be designed and developed, including with appropriate human-machine interface tools, to allow effective oversight by natural persons during use.
• Human oversight aims to preventor minimise risks to health, safety, or fundamental rights, especially when other requirements are insufficient.
• Oversight measures must be commensurate with risks, autonomy, and contextof use, ensured through either (or both) of the following:
  • Measures identified and built into the system by the provider.
  • Measures identified by the provider for implementation by the deployer.
• Providers must ensure that natural persons assigned human oversight are enabled, as appropriate and proportionate, to:
  • Understand system capacities/limitations and monitor operation to detect anomalies.
  • Remain aware of automation bias.
  • Correctly interpret system output.
  • Decide not to use the system or to disregard, override, or reverse its output.
  • Intervene in or interrupt the system (e.g., via a 'stop' button).
• For high-risk AI systems referred to in Annex III, point 1(a) (e.g., biometric identification), any identification result must be separately verified and confirmed by at least two competent natural persons, unless Union or national law considers this disproportionate for law enforcement, migration, border control, or asylum purposes.

• High-risk AI systems must be designed and developed to achieve an appropriate level of accuracy, robustness, and cybersecurity, performing consistently throughout their lifecycle.
• The levels of accuracy and relevant accuracy metrics must be declared in the accompanying instructions for use.
• Systems must be as resilient as possible regarding errors, faults, or inconsistencies within the system or its operating environment (e.g., interaction with humans or other systems). Technical and organisational measures, including technical redundancy solutions (backup/fail-safe plans), must be taken.
• High-risk AI systems that continue to learn after being placed on the marketor put into service must be developed to eliminate or reduce the risk of biased outputs influencing future operations (feedback loops) and ensure such feedback loops are addressed with appropriate mitigation measures.
• Systems must be resilient against attempts by unauthorised third parties to alter their use, outputs, or performance by exploiting system vulnerabilities.
• Technical cybersecurity solutions must be appropriate to the circumstances and risks, including, where appropriate, measures to prevent, detect, respond to, resolve, and control attacks manipulating training data (data poisoning), pre-trained components (model poisoning), inputs causing mistakes (adversarial examples/model evasion), confidentiality attacks, or model flaws.

• Providers must ensure that their high-risk AI systems are compliant with the requirements setout in Section 2 (Articles 9-15).
• They must indicate their name, registered trade name/trademark, and contact address on the system, its packaging, or accompanying documentation.
• They must implement a quality management system compliant with Article 17.
• They must keep the documentation referred to in Article 18.
• They must keep automatically generated logs (Article 19) when under their control.
• They must ensure the system undergoes the relevant conformity assessment procedure (Article 43) before market placementor service.
• They must draw up an EU declaration of conformity (Article 47).
• They must affix the CE marking (Article 48) to indicate conformity.
• They must comply with registration obligations (Article 49(1)).
• They must take necessary corrective actions and provide information as required in Article 20.
• They must, upon a reasoned request, demonstrate the conformity of the system to national competent authorities.
• They must ensure the system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882.

• Providers of high-risk AI systems must establish and document a systematic quality management system (QMS) ensuring compliance with this Regulation, including written policies, procedures, and instructions.
• The QMS must cover, at a minimum, the following aspects:
  • Regulatory compliance strategy (including conformity assessment and modification management).
  • Techniques/procedures for design, design control, and verification.
  • Techniques/procedures for development, quality control, and quality assurance.
  • Examination, test, and validation procedures (before, during, after development) and their frequency.
  • Technical specifications/standards, and means to ensure compliance if harmonised standards are not fully applied or do not cover all requirements.
  • Data management systems/procedures (acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation, retention, etc.).
  • The risk management system (Article 9).
  • Setting up, implementation, and maintenance of a post-market monitoring system (Article 72).
  • Procedures related to reporting serious incidents (Article 73).
  • Handling communication with authorities, notified bodies, other operators, customers, or interested parties.
  • Systems/procedures for record-keeping of all relevant documentation.
  • Resource management, including security-of-supply measures.
  • An accountability framework setting out management and staff responsibilities.
• QMS implementation must be proportionate to the provider's organisation size, but always ensure the required rigour and protection for compliance.
• Providers subject to existing sectoral Union law on QMS may include these aspects within their existing systems.
• Financial institutions complying with internal governance rules under Union financial services law are deemed tofulfill QMS obligations, except for risk management, post-market monitoring, and serious incident reporting.

• Providers must keep the following documentation at the disposal of national competent authorities for a period ending 10 years after the high-risk AI system has been placed on the marketor put into service:
  • The technical documentation (Article 11).
  • The documentation concerning the quality management system (Article 17).
  • Documentation concerning changes approved by notified bodies (if applicable).
  • Decisions and other documents issued by notified bodies (if applicable).
  • The EU declaration of conformity (Article 47).
• Member States must determine conditions for documentation availability if a provider or its authorised representative goes bankruptor ceases activity prior to the end of the 10-year period.
• Financial institutions subject to Union financial services law shall maintain technical documentation as partof documentation kept under that relevant law.

• Providers of high-risk AI systems must keep the automatically generated logs referred to in Article 12(1) to the extent such logs are under their control.
• Without prejudice to applicable Union or national law, logs must be kept for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless otherwise provided by applicable Union or national law (e.g., on personal data protection).
• Financial institutions subject to Union financial services law shall maintain these logs as partof the documentation kept under that relevant law.

• Providers who consider or have reason to consider that a high-risk AI system they placed on the marketor put into service is not inconformity with this Regulation must immediately take necessary corrective actions (e.g., bring into conformity, withdraw, disable, or recall).
• They must inform distributors, deployers (where applicable), authorised representatives, and importers accordingly.
• If the high-risk AI system presents a risk (Article 79(1)) and the provider becomes aware of it, they must immediately investigate the causes, in collaboration with the reporting deployer (where applicable).
• They must inform the competent market surveillance authorities and, where applicable, the notified body that issued a certificate, detailing the nature of the non-compliance and any relevant corrective action taken.

• Providers of high-risk AI systems must, upon a reasoned request by a competent authority, provide all necessary information and documentation to demonstrate conformity with Section 2 requirements.
• Ensure this information is provided in an easily understandable official language of the Union, as indicated by the Member State.
• Upon a reasoned request, grant competent authorities access to automatically generated logs (referred to in Article 12(1)), to the extent such logs are under your control.
• Be aware that information obtained by competent authorities will be treated confidentially as per Article 78.

• For providers established in third countries: Prior to making high-risk AI systems available on the Union market, appoint an authorised representative established in the Union via a written mandate.
• Enable your authorised representative to perform the tasks specified in their mandate.
• For authorised representatives: Ensure your mandate empowers you to verify that the EU declaration of conformity (Art. 47) and technical documentation (Art. 11) have been drawn up and the appropriate conformity assessment procedure has been carried out.
• Keep at the disposal of competent authorities (for 10 years after market placement/service) the provider's contact details, a copy of the EU declaration of conformity, technical documentation, and, if applicable, the certificate issued by the notified body.
• Provide competent authorities, upon a reasoned request, with all necessary information and documentation, including access to logs (Art. 12(1)) if under provider control, to demonstrate conformity.
• Cooperate with competent authorities in any action to reduce and mitigate risks posed by the high-risk AI system.
• Comply with registration obligations (Art. 49(1)) or ensure the correctness of information if the provider carries out registration.
• Ensure your mandate allows competent authorities to address you on all compliance issues, in addition to or instead of the provider.
• Terminate the mandate immediately if you consider the provider to be acting contrary to their obligations, and inform the relevant market surveillance authority (and notified body, if applicable) of the termination and reasons.

• Before placing a high-risk AI system on the market: Verify that:
  • The relevant conformity assessment procedure (Art. 43) has been carried out by the provider.
  • The provider has drawn up the technical documentation (Art. 11 and Annex IV).
  • The system bears the required CE marking and is accompanied by the EU declaration of conformity (Art. 47) and instructions for use.
  • The provider has appointed an authorised representative (Art. 22(1)).
• Do not place a high-risk AI system on the market if you have sufficient reason to believe it is not in conformity, is falsified, or accompanied by falsified documentation, until it is brought into conformity.
• If the system presents a risk (Art. 79(1)), inform the provider, authorised representative, and market surveillance authorities.
• Indicate your name, registered trade name or trademark, and contact address on the high-risk AI system, its packaging, or accompanying documentation.
• Ensure that storage or transport conditions under your responsibility do not jeopardise the system's compliance with Section 2 requirements.
• Keep a copy of the notified body certificate (if applicable), instructions for use, and the EU declaration of conformity (Art. 47) for 10 years after market placementor service.
• Provide relevant competent authorities, upon a reasoned request, with all necessary information and documentation (including records from paragraph 5) to demonstrate conformity, ensuring technical documentation can be made available.
• Cooperate with competent authorities in any action they take, particularly to reduce and mitigate risks.

• Before making a high-risk AI system available on the market: Verify that it bears the required CE marking, is accompanied by an EU declaration of conformity (Art. 47) and instructions for use, and that the provider and importer (if applicable) have complied with their obligations as laid down in Article 16(b) and (c) and Article 23(3).
• If you have reason to consider a high-risk AI system is not inconformity with Section 2 requirements, do not make it available until it has been brought into conformity.
• If the system presents a risk (Art. 79(1)), inform the provider or importer.
• Ensure that storage or transport conditions under your responsibility do not jeopardise the system's compliance with Section 2 requirements.
• If a non-conformant high-risk AI system has been made available, take necessary corrective actions (bring into conformity, withdraw, or recall) or ensure the provider, importer, or relevantoperator takes such actions.
• If a high-risk AI system presents a risk (Art. 79(1)), immediately inform the provider or importer and the competent authorities, detailing the non-compliance and corrective actions taken.
• Provide relevant competent authorities, upon a reasoned request, with all information and documentation regarding your actions pursuant to paragraphs 1 to 4 to demonstrate conformity.
• Cooperate with relevant competent authorities in any action they take, particularly to reduce or mitigate the risk posed by the system.

• Be aware of re-classification as a provider: Any distributor, importer, deployer, or other third party will be considered a provider (and subject to Article 16 obligations) if they:
  • Put their name or trademark on an already placed/serviced high-risk AI system (unless contractual arrangements stipulate otherwise).
  • Make a substantial modification to an already placed/serviced high-risk AI system, such that it remains high-risk.
  • Modify the intended purpose of a non-high-risk AI system (including GPAI) already placed/serviced, making it a high-risk AI system per Article 6.
• If you are an initial provider whose system is re-classified: Cooperate closely with the new provider and make available necessary information, technical access, and assistance for compliance, unless you clearly specified the AI system is not to be changed into a high-risk system.
• For product manufacturers: If your high-risk AI system is a safety componentof a product covered by Union harmonisation legislation (Annex I, Section A), you will be considered the provider (and subject to Article 16 obligations) if the AI system is placed on the marketor put into service with/under your name or trademark.
• Establish written agreements: Providers of high-risk AI systems and third parties supplying AI systems, tools, services, components, or processes used/integrated into a high-risk AI system must, by written agreement, specify the necessary information, capabilities, technical access, and assistance to enable the provider tofully comply with the Regulation (does not apply tofree and open-source tools/services/components other than general-purpose AI models).
• Observe and protect intellectual property rights, confidential business information, and trade secrets in accordance with Union and national law.

• Take appropriate technical and organisational measures to use high-risk AI systems in accordance with their instructions for use.
• Assign human oversight to natural persons with necessary competence, training, authority, and support.
• If you exercise control over input data, ensure it is relevant and sufficiently representative for the intended purpose of the high-risk AI system.
• Monitor the operation of the high-risk AI system based on instructions for use. Where relevant, inform providers in accordance with Article 72.
• If you have reason to consider that using the system according to instructions may lead to a risk (Art. 79(1)), promptly inform the provider or distributor and the relevant market surveillance authority, and suspend the use of the system.
• Immediately inform the provider (then importer or distributor) and relevant market surveillance authorities of any serious incident identified. If the provider is unreachable, Article 73 applies.
• For financial institutions, monitoring obligations are met by complying with internal governance rules under relevant financial services law.
• Keep automatically generated logs (if under your control) for a period appropriate to the intended purpose, of at least six months (unless other Union or national law, especially data protection law, provides otherwise).
• For financial institutions, maintain logs as partof the documentation kept pursuant to relevant Union financial services law.
• For employers: Before putting into service or using a high-risk AI system at the workplace, inform workers' representatives and affected workers in accordance with Union and national law and practice.
• For public authorities or Union institutions/bodies/offices/agencies: Comply with registration obligations (Art. 49). If the high-risk AI system you envisage using has not been registered in the EU database (Art. 71), do not use it and inform the provider or distributor.
• Use information provided under Article 13 to comply with Data Protection Impact Assessment (DPIA) obligations under GDPR (Art. 35) or Directive (EU) 2016/680 (Art. 27).
• For deployers of high-risk AI systems for post-remote biometric identification in law enforcement investigations: Request ex ante (or without undue delay, no later than 48 hours) authorisation by a judicial or administrative authority for use, except for initial identification of a potential suspect based on objective and verifiable facts. Each use must be strictly necessary for the investigation.
• If authorisation is rejected, stop use immediately and delete personal data related to the requested authorisation.
• Do not use such systems for untargeted law enforcement purposes, without any link to a criminal offence, criminal proceeding, genuine threat, or search for a specific missing person. Ensure no adverse legal decision is taken solely based on the system's output.
• Document each use in the relevant police file and make it available to market surveillance and national data protection authorities upon request (excluding sensitive operational data related to law enforcement).
• Submit annual reports to relevant market surveillance and national data protection authorities on the use of post-remote biometric identification systems (excluding sensitive operational data related to law enforcement).
• For Annex III high-risk AI systems making/assisting decisions related to natural persons: Inform the natural persons that they are subject to the use of the high-risk AI system (for law enforcement, Art. 13 of Directive (EU) 2016/680 applies).
• Cooperate with relevant competent authorities in any action they take to implement this Regulation.

• Perform a Fundamental Rights Impact Assessment (FRIA): Before deploying a high-risk AI system (except those in Annex III, point 2), if you are a body governed by public law, a private entity providing public services, or a deployer of systems referred to in Annex III, points 5(b) and (c), conduct an assessmentof the impacton fundamental rights.
• The FRIA must include:
  • A description of the deployer's processes where the high-risk AI system will be used, aligned with its intended purpose.
  • A description of the period and frequency of the system's intended use.
  • The categories of natural persons and groups likely to be affected by its use in the specific context.
  • Specific risks of harm likely to impact those identified persons/groups, taking into account information from the provider (Art. 13).
  • A description of the implementation of human oversight measures, according to instructions for use.
  • Measures to be taken if risks materialise, including internal governance and complaint mechanisms.
• This obligation applies to the first use of the high-risk AI system. For similar cases, you may rely on previously conducted FRIAs or existing impact assessments by the provider.
• Update the FRIA if any elements of the assessment change or become outdated during the use of the system.
• Notify the market surveillance authority of the FRIA results by submitting the filled-out template (to be developed by the AI Office) as partof the notification, unless exempted by Article 46(1).
• Ensure the FRIA complements any Data Protection Impact Assessment (DPIA) already conducted pursuant to GDPR (Art. 35) or Directive (EU) 2016/680 (Art. 27), covering any overlapping obligations.
• Utilize the template/automated tool developed by the AI Office to simplify compliance with your FRIA obligations.

• For Member States: Designate or establish at leastone notifying authority responsible for setting up and carrying out procedures for the assessment, designation, notification, and monitoring of conformity assessment bodies.
• Develop these procedures in cooperation with notifying authorities of all other Member States.
• You may decide that a national accreditation body (under Regulation (EC) No 765/2008) carries out the assessment and monitoring.
• Ensure notifying authorities are established, organised, and operated to avoid conflicts of interest with conformity assessment bodies and to safeguard objectivity and impartiality.
• Organize notifying authorities such that decisions on notification are taken by competent persons distinct from those who assessed the bodies.
• Notifying authorities shall notoffer or provide conformity assessment activities or commercial/competitive consultancy services.
• Safeguard the confidentiality of information obtained, in accordance with Article 78.
• Ensure notifying authorities have an adequate number of competent personnel with necessary expertise (e.g., IT, AI, law, fundamental rights supervision) for proper performance of their tasks.

• For conformity assessment bodies: Submit an application for notification to the notifying authority of the Member State in which you are established.
• Your application must be accompanied by:
  • A description of the conformity assessment activities, modules, and types of AI systems for which you claim competence.
  • An accreditation certificate (if available) issued by a national accreditation body, attesting to your fulfillmentof Article 31 requirements.
  • Any valid documents related to existing designations under other Union harmonisation legislation.
• If an accreditation certificate is not available, provide the notifying authority with all necessary documentary evidence for verification, recognition, and regular monitoring of your compliance with Article 31 requirements.
• For notified bodies designated under other Union harmonisation legislation, update your documentation (from paragraphs 2 and 3) whenever relevant changes occur, to enable continuous monitoring of Article 31 compliance.

• For notifying authorities: Only notify conformity assessment bodies that have satisfied the requirements laid down in Article 31.
• Notify the Commission and other Member States of each approved conformity assessment body using the electronic notification tool managed by the Commission.
• The notification must include full details of the conformity assessment activities, modules, types of AI systems concerned, and the relevant attestation of competence.
• If a notification is not based on an accreditation certificate (Art. 29(2)), provide the Commission and other Member States with documentary evidence of the body's competence and the arrangements for its regular monitoring and continuous compliance with Article 31.
• For conformity assessment bodies: You may only perform the activities of a notified body if no objections are raised by the Commission or other Member States within:
  • Two weeks of notification, if an accreditation certificate (Art. 29(2)) is included.
  • Two months of notification, if documentary evidence (Art. 29(3)) is included.
• If objections are raised, the Commission will consult with relevant Member States and the conformity assessment body, then decide on the authorisation and inform the Member State and body.