Article 39 — Conformity assessment bodies of third countries (EU AI Act)

Article 39 of Regulation (EU) 2024/1689 — Conformity assessment bodies of third countries. Official text, practical interpretation, key obligations and compliance implications.

Official Text Summary

Article 39 of Regulation (EU) 2024/1689 (the EU AI Act) addresses the conditions under which conformity assessment bodies established in third countries — that is, countries outside the European Union — may be recognised and notified for the purposes of carrying out conformity assessments of high-risk AI systems under the Regulation.

The article establishes a narrow but important gateway: third-country conformity assessment bodies may be notified only where a bilateral or multilateral international agreement between the Union and the third country in question expressly provides for such recognition. In the absence of a qualifying international agreement, no third-country body may act as a notified body under the EU AI Act.

Where a valid international agreement exists, third-country bodies wishing to be notified must satisfy the same requirements imposed on EU-established conformity assessment bodies under Chapter 4 of Title III. This means they must demonstrate technical competence, organisational impartiality, and operational independence equivalent to that required of European notified bodies. Notification is processed through the competent notifying authority of a Member State in accordance with the standard notification procedure set out in the preceding articles of Chapter 4. The article thus ensures that any extension of the conformity assessment framework beyond EU borders preserves the integrity, equivalence, and enforceability of the system established by the Regulation.

What This Means in Practice

Article 39 is primarily relevant to providers of high-risk AI systems who operate across jurisdictions covered by EU trade or mutual recognition agreements, and to conformity assessment bodies established in third countries that seek to offer EU AI Act certification services.

In practical terms, the article means that a testing laboratory or certification body based in, for example, the United Kingdom, Japan, or another country with which the EU has concluded a relevant international agreement could, in principle, be designated as a notified body for EU AI Act purposes — provided the agreement expressly covers AI Act conformity assessments and the body meets all applicable requirements. At the time of the Regulation's entry into force, no such AI-Act-specific mutual recognition agreements were yet in place, meaning the provision operates prospectively: it creates the legal basis for future recognition without itself activating any specific third-country body.

For providers of high-risk AI systems, this has a concrete implication: until qualifying international agreements are concluded and bodies are formally notified, they cannot rely on assessments conducted by a third-country body to satisfy their conformity assessment obligations under Articles 43 and 44. Any certificate or audit report issued by a body that has not been validly notified under the Article 39 pathway will not satisfy EU AI Act requirements, regardless of the technical quality of the assessment.

Compliance teams should therefore monitor EU trade agreement developments and the NANDO (New Approach Notified and Designated Organisations) database for any future notifications of third-country bodies under this provision.

Key Obligations

• Third-country conformity assessment bodies may only be notified where an international agreement between the European Union and the relevant third country expressly provides for such notification — no agreement, no recognition.
• Bodies seeking notification under Article 39 must meet the full set of requirements applicable to EU-established conformity assessment bodies under Chapter 4 of Title III, including technical competence, impartiality, and independence criteria.
• Notification of third-country bodies must follow the standard notification procedure applicable under the Regulation, routed through a Member State notifying authority.
• Providers of high-risk AI systems must verify that any conformity assessment body they engage is validly notified — whether EU-based or third-country — before relying on that body's assessment to demonstrate compliance.
• Member States and the Commission must ensure that any international agreement underpinning third-country body notification maintains the equivalence and enforceability of the EU AI Act conformity assessment framework.

Relationship to Other Articles

Article 39 sits within Title III, Chapter 4 (Notifying Authorities and Notified Bodies) and must be read in conjunction with the surrounding articles of that chapter. Articles 33 and 34 establish the general requirements and obligations applicable to notified bodies; Article 35 governs the notification procedure itself; and Articles 36 and 37 address changes to notifications and challenges to notified body competence. Because Article 39 applies those same requirements wholesale to third-country bodies, it cannot be interpreted in isolation from them.

Beyond Chapter 4, Article 39 connects to Article 43, which specifies the conformity assessment procedures applicable to high-risk AI systems, and Article 44, which governs the certificates issued by notified bodies. Any third-country body notified under Article 39 must issue certificates that satisfy Article 44 in full. The article also intersects with the broader framework of EU international trade law and the Union's bilateral and multilateral agreement-making competences under the Treaty on the Functioning of the European Union.

Compliance Timeline

The EU AI Act entered into force on 1 August 2024, twenty days after publication in the Official Journal. The Regulation applies in phased stages:

• February 2, 2025 — Prohibitions on unacceptable-risk AI practices (Title II) became applicable.
• August 2, 2025 — Provisions on general-purpose AI models (Title VIII) and governance structures became applicable.
• August 2, 2026 — The majority of obligations for high-risk AI systems listed in Annex III, including conformity assessment requirements under Title III, become applicable. This is the primary applicability date for Article 39 in practice, as it governs the notified body framework that underpins those assessments.
• August 2, 2027 — Extended deadline for high-risk AI systems covered by Annex I (safety-component systems regulated under existing Union harmonisation legislation) to comply.

Article 39 itself has been legally in force since August 2024, but its operational relevance crystallises from August 2026 onwards, when providers of high-risk AI systems must have completed conformity assessments through validly notified bodies. Organisations should begin identifying suitable notified bodies — and monitoring any qualifying international agreements that may activate third-country bodies under Article 39 — well in advance of that date.