Article 37: Challenge to the Competence of Notified Bodies
Article 37 creates a mechanism for the Commission or any Member State to formally challenge the competence of a notified body. Where doubts arise about whether a body still meets the requirements of Article 30 or fulfils its responsibilities, the notifying authority that designated the body must investigate, take remedial action if necessary (including restricting, suspending, or withdrawing the notification), and inform the Commission and other Member States of the outcome.
Who does this apply to?
- -The Commission or any Member State raising competence concerns about a notified body
- -Notifying authorities that must investigate challenged bodies and take remedial action where warranted
- -Notified bodies subject to competence review and potential restriction, suspension, or withdrawal of their notification
Scenarios
The Commission receives reports that a notified body has issued certificates for high-risk AI systems without conducting the technical documentation assessment required by Article 43. The Commission challenges the body's competence under Article 37.
A Member State's market surveillance authority discovers that a notified body located in another Member State lacks sufficient AI expertise — key staff listed in the accreditation file have left, and replacements do not meet Article 30 competence requirements.
How the challenge mechanism works
Article 37 establishes a structured process:
1. Trigger — The Commission or any Member State may raise doubts about whether a notified body continues to meet the requirements of Article 30 or fulfils its responsibilities under the AI Act.
2. Investigation — The notifying authority that originally designated the body must investigate the concerns. This may involve document review, on-site assessment, or requesting the body to demonstrate competence.
3. Remedial action — If the investigation confirms deficiencies, the notifying authority must take appropriate action, which can include restricting, suspending, or withdrawing the notification.
4. Notification of outcome — The notifying authority informs the Commission and all other Member States of the investigation outcome and any remedial measures taken.
Why Article 37 matters for providers
Providers holding certificates from a challenged notified body face potential disruption. If a body's notification is restricted, suspended, or withdrawn:
- Certificates already issued may need to be reassessed by another body
- Ongoing assessment processes may be interrupted
- Providers should monitor the NANDO database for changes to their notified body's status
As a risk-mitigation measure, providers of high-risk systems should consider maintaining awareness of their notified body's accreditation status and having contingency plans for engaging an alternative body.
Relationship to the broader oversight framework
- Article 30 — The competence, independence, and resource requirements that notified bodies must meet. Article 37 challenges are measured against these benchmarks.
- Article 33 — Notifying authorities and their ongoing monitoring responsibilities.
- Article 34 — The original notification process, which establishes the baseline against which competence is later evaluated.
- Article 36 — Operational obligations whose breach may trigger a competence challenge.
- Article 113 — Application dates.
Compliance checklist
- Monitor the NANDO database for any changes to the notification status of the notified body you have engaged.
- Establish a contingency plan for engaging an alternative notified body if your current body's notification is suspended or withdrawn.
- Retain copies of all certificates, audit reports, and correspondence from your notified body for traceability.
- If you become aware of competence concerns about your notified body, assess the validity of certificates it has issued for your systems.
- Consider whether your conformity-assessment contracts include provisions for what happens if the body loses its notification.
Verify your conformity assessment readiness — start the free assessment.
Start Free AssessmentRelated Articles
Frequently asked questions
Who can challenge a notified body's competence?
The Commission or any Member State. This means a challenge can originate from a country other than the one that designated the body, enabling cross-border oversight.
What happens to certificates already issued by a body whose notification is withdrawn?
The AI Act does not explicitly void previously issued certificates upon withdrawal, but providers should expect market surveillance authorities to scrutinise the validity of assessments performed by a body found incompetent. Engaging a replacement body for reassessment is prudent.
Can a Member State or the Commission challenge a notified body's competence?
Yes. Article 37(3) allows the Commission and any Member State to challenge the competence of a notified body. The notifying authority must investigate the challenge and may restrict, suspend, or withdraw the notification if the body no longer meets the requirements of Articles 31-34.