Article 30: Requirements Relating to Notified Bodies

Article 30 sets the bar for notified bodies. It is the most detailed article in Chapter IV because it defines every quality, competence, and organisational criterion a body must meet. The requirements include:

(a) Legal personality — The body must be established under the national law of a Member State and possess legal personality.

(b) Independence — The body must be organisationally and functionally independent from the providers whose AI systems it assesses. Senior management and assessment staff must not be involved in the design, development, manufacture, marketing, installation, use, or maintenance of the AI systems they assess. This extends to any parent company, subsidiary, or affiliated entity.

(c) Competence — The body must demonstrate the ability to carry out conformity assessment activities competently, with AI-specific expertise appropriate to the tasks. This includes knowledge of AI technologies, data and data computing, fundamental rights, health and safety risks, and the existing standards and regulatory framework.

(d) Staffing — Sufficient personnel with the requisite technical knowledge and experience, including understanding of: - AI technologies and how they work - Data and data governance - Computing infrastructure - Fundamental rights risks - Health and safety risks - Existing harmonised standards and common specifications

(e) Documented procedures — Transparent, reproducible assessment procedures that enable the body to carry out third-party conformity assessment appropriately.

(f) Liability insurance — Appropriate professional indemnity insurance for conformity assessment activities.

(g) Timeliness — The ability to fulfil tasks and provide results within defined timeframes.

Staff must maintain confidentiality regarding information obtained during assessment. The notified body must also participate in relevant standardisation activities and coordination groups. Verify every point on EUR-Lex Article 30.

The independence requirement in Article 30 is designed to prevent any situation where a notified body's commercial interests or relationships could compromise its assessment objectivity. Key points:

• The body's top-level management and assessment staff must be free from commercial, financial, or other pressures that could influence their judgement.
• The body must not have been involved in the design, development, or marketing of the AI system being assessed, either directly or through related entities.
• The body must ensure that the activities of its subsidiaries or subcontractors (Article 32) do not impair its independence.
• Remuneration of assessment staff must not depend on the number of assessments performed or their results.

Unlike existing New Legislative Framework notified body requirements, Article 30 explicitly demands AI-domain expertise. This reflects the unique nature of AI systems, where traditional product testing (e.g., mechanical stress tests) is insufficient.

Notified bodies must demonstrate competence in: - AI technologies — understanding of machine learning paradigms, neural networks, symbolic AI, and hybrid systems. - Data governance — ability to evaluate training data quality, bias, representativeness, and privacy compliance. - Fundamental rights — knowledge of how AI systems can impact non-discrimination, privacy, freedom of expression, and human dignity. - Cybersecurity — understanding of adversarial attacks, model robustness, and data poisoning risks.

This means existing notified bodies under Annex I product legislation (e.g., MDR, Machinery Regulation) will typically need to augment their teams with AI specialists.

• Article 28 — The notifying authority verifies compliance with Article 30.
• Article 29 — The application process for bodies claiming to meet Article 30 requirements.
• Article 31 — Harmonised standards that trigger a presumption of conformity with Article 30.
• Article 32 — Subsidiaries and subcontractors must also meet Article 30 requirements.
• Article 43 — Conformity assessment procedures that notified bodies carry out.
• Annex VI — Internal control conformity assessment procedure.
• Annex VII — Conformity assessment procedure based on assessment of the QMS and technical documentation.
• Article 113 — Application dates and staged entry into force.