Selecting your AIA notified body

Selecting a notified body for your medical device that includes an EU AI Act high risk AI system: act with urgency

Manufacturers/providers of medical devices that, according to the EU AI Act, include a high risk AI system (HRAIS) that require a notified body assessment of their technical documentation and/or quality management system should urgently consider which notified body to appoint. The one they select will depend on the ability of any current notified body to undertake the EU AI Act assessment and the dates by which the manufacturer/provider, both legally and commercially, requires their certificate(s). 

Which medical devices require an additional notified body review for the HRAIS?

The use of a notified body is optional for medical devices that solely fall within Annex III and are defined as high risk pursuant to Article 6(2).

However, most medical devices that are defined as high risk will be so defined under Article 6(1). For these, the use of a notified body to review their quality management system and technical documentation for EU AI Act compliance is compulsory.

Consider your current notified body

In the first instance, manufacturers/providers should consider working with the notified body which has already certified their product under the EU medical device or in vitro medical device regulations. That notified body ought to be able to provide the most efficient service given that they already know the device(s). All notified bodies who intend to provide certificates under the EU AI Act must be additionally certified under the EU AI Act. Manufacturers/providers should, therefore, ask their current notified body if they intend to apply for certification and the anticipated timing for that certification.

Manufacturers/providers will need to consider this information alongside the market timelines for their product(s) and the timelines for compliance in the EU AI Act. The relevant timelines for their decision as required by the AI Act are:

Examples

If we consider a medical device which is already or will be on the market by 2 August 2026 and if we allow 12 months for the process, if there are going to be significant changes to that device before 2 August 2027, or significant changes which will be made in, say, the 12 months thereafter, the manufacturer/provider is likely to require a notified body that is able to accept applications for certifications by at least August 2026. This timing takes account of the fact that everyone, both the manufacturer/provider and the notified body, will be on a learning curve with respect to EU AI Act requirements.

Similar considerations apply to any manufacturer/provider intending to place a new HRAIS medical device on the market requiring a notified body where the launch date is planned for a date that is close to 2 August 2027. Even if the current plan is for launch six to 12 months ahead of that date, given that timelines often slip, they would be well advised to apply the same logic as above. Manufacturers/providers or new HRAIS medical devices which will or might be coming to market after 2 August 2027 would, therefore, also want to find a notified body ready to accept applications under the EU AI Act by August 2026.

Changing from the notified body already certified under the medical device regulations? 

The first preference should always be to continue with the same notified body because changing is a time-consuming, complex and costly exercise and requires product relabelling. As between the EU medical device regulations and the EU AI Act, there are potentially contradictory provisions and at worst conflicting requirements as well as scope for different interpretations. Manufacturers/providers might find that they are unable on the same regulatory facts to satisfy requirements of both notified bodies if they instruct two different notified bodies.

If time permits, and the current notified body is unable to certify under both sets of regulations to fit the manufacturer/provider timelines, this might be a situation that warrants a change of notified body to one which can also certify devices including HRAIS under the EU AI Act to meet the manufacturer/provider legal and commercial timelines.