Article 36 — Changes to notifications (EU AI Act)

Article 36 of Regulation (EU) 2024/1689 — Changes to notifications. Official text, practical interpretation, key obligations and compliance implications.

Official Text Summary

Article 36 of Regulation (EU) 2024/1689 (the EU AI Act) establishes the obligations that apply when a notified body's situation changes after the initial notification has been granted. It sits within Title III, Chapter 4, which governs the framework for notifying authorities and notified bodies involved in the conformity assessment of high-risk AI systems.

The article requires notified bodies to promptly inform their respective notifying authority of any change that is relevant to their notified status. Such changes include alterations to legal form or ownership, modifications to the organisational structure or key personnel responsible for conformity assessment activities, changes in the technical scope for which the body was notified, and any circumstance that might affect the body's continued ability to fulfil the requirements set out in Article 33.

Upon receiving notification of such changes, the notifying authority must assess whether the notified body continues to meet the applicable requirements. Where the assessment reveals non-compliance, the notifying authority is empowered to restrict, suspend, or withdraw the notification, proportionate to the severity of the deficiency identified. The notifying authority must also keep the Commission and other Member States informed through the established notification channels, ensuring that up-to-date information is accessible Union-wide. This continuous oversight mechanism is designed to guarantee that only capable and compliant bodies exercise conformity assessment responsibilities throughout their period of designation.

What This Means in Practice

Article 36 creates a live, ongoing compliance obligation for notified bodies — the duty to notify does not end at the moment a body receives its designation. Any organisation holding notified body status under the EU AI Act must maintain internal processes capable of detecting and escalating material changes in its circumstances, and must act on those processes without delay.

In practical terms, a notified body should establish internal triggers that automatically flag reportable changes: for example, a merger or acquisition affecting ownership, the departure of a lead assessor holding key technical qualifications, the addition or removal of AI system categories from the body's operational scope, or the emergence of a conflict of interest with a conformity assessment client.

Compliance teams at notified bodies should map these trigger events and assign clear internal responsibility for reporting to the notifying authority. The reporting should be timely — not retrospective — meaning that bodies cannot wait until an annual review cycle to disclose a change that occurred months earlier.

For notifying authorities — typically national market surveillance or accreditation bodies — Article 36 demands that they have a structured intake process for change notifications and a documented assessment procedure to evaluate continued compliance. Where a notified body fails to self-report a material change, the notifying authority retains the right to investigate and act upon information received from other sources, including the Commission or peer Member States.

Providers of high-risk AI systems who rely on a given notified body for their conformity assessment should monitor the NANDO database for any restriction or suspension affecting their chosen body, as such changes could interrupt or invalidate their certification pathway.

Key Obligations

• Notified bodies must immediately inform their notifying authority of any change in circumstances that could affect their compliance with the requirements of Article 33, including changes to legal status, ownership, organisational structure, technical scope, or key personnel.
• Notifying authorities must reassess the notified body upon receiving a change notification and determine whether the body continues to satisfy all applicable requirements.
• Notifying authorities must restrict, suspend, or withdraw the notification where reassessment reveals that the body no longer meets the conditions under which it was designated, applying measures proportionate to the gravity of the non-compliance.
• Notifying authorities must communicate any changes to a body's notification — including restrictions, suspensions, and withdrawals — to the European Commission and to the other Member States without undue delay.
• The Commission's notification database (NANDO) must be kept current to reflect the actual and valid scope of each notified body's designation, ensuring transparency and legal certainty across the Single Market.
• Notified bodies must maintain internal governance arrangements sufficient to identify and escalate reportable changes on a continuous basis, rather than treating notification as a one-time event.

Relationship to Other Articles

Article 36 cannot be read in isolation; it forms part of a coherent framework established across Chapter 4 of Title III. The foundational requirements that a notified body must continue to satisfy are set out in Article 33 (Requirements relating to notified bodies), which defines the baseline against which any change is assessed. The initial notification procedure — against which Article 36 represents the change-management counterpart — is established by Article 34 (Notification procedure) and Article 35 (Identification numbers and lists of notified bodies).

Article 36 also connects to Article 37 (Challenge to the competence of notified bodies), which provides the mechanism by which the Commission or Member States may raise concerns about a body's competence or compliance — a process that may be triggered precisely when a change disclosed under Article 36 raises doubts. More broadly, it supports the market surveillance and enforcement architecture of Articles 74 to 83, since a notified body operating outside its valid notification scope could undermine the integrity of the conformity assessments it has issued.

Compliance Timeline

The EU AI Act entered into force on 1 August 2024, twenty days after publication in the Official Journal of the European Union. Article 36, as part of the institutional and governance framework for conformity assessment, falls within the provisions that apply from 2 August 2026 — the general date of application for the majority of the Regulation's obligations, including those governing high-risk AI systems in Annex III.

The obligations on notified bodies and notifying authorities under Chapter 4 are therefore active from that date, meaning that any body designated as a notified body under the EU AI Act from August 2026 onwards is immediately subject to the change-notification requirements of Article 36. Bodies notified under earlier sector-specific legislation that are transitioning to EU AI Act designation should integrate Article 36 compliance into their transition planning well in advance of the August 2026 deadline.

For high-risk AI systems covered by Annex I (product safety legislation), the relevant conformity assessment infrastructure — including Article 36 obligations — aligns with the August 2027 phased application date applicable to those product categories. Providers relying on notified bodies for Annex I system certification should verify the continued validity of their notified body's designation as that deadline approaches.