Skip to content

Regulation Tracker / EU AI Act / Chapter III · Section 4

Article 36
Changes to notifications

Chapter III — Classification rules for high-risk AI systems, Section 4 — Notifying authorities. 9 distinct duties, powers or definitions are coded from this article, applying from 2025-08-02.

Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 2026-07-27 — about 113 words changed. The text below is the consolidated version of 27 July 2026; the 2024 text and the amending regulation are on EUR-Lex.

official text: EUR-Lex (consolidated 27 Jul 2026) · text © European Union (Decision 2011/833/EU) · coding CC BY 4.0 · data: obligations.json · Hugging Face · GitHub

The text

1. The notifying authority shall notify the Commission and the other Member States of any relevant changes to the notification of a notified body via the electronic notification tool referred to in Article 30(2).

2. The procedures laid down in Articles 29 and 30 shall apply to extensions of the scope of the notification.

3. Where a notified body decides to cease its conformity assessment activities, it shall inform the notifying authority and the providers concerned as soon as possible and, in the case of a planned cessation, at least one year before ceasing its activities. The certificates of the notified body may remain valid for a period of nine months after cessation of the notified body’s activities, on condition that another notified body has confirmed in writing that it will assume responsibilities for the high-risk AI systems covered by those certificates. The latter notified body shall complete a full assessment of the high-risk AI systems affected by the end of that nine-month-period before issuing new certificates for those systems. Where the notified body has ceased its activity, the notifying authority shall withdraw the designation.

4. Where a notifying authority has sufficient reason to consider that a notified body no longer meets the requirements laid down in Article 31, or that it is failing to fulfil its obligations, the notifying authority shall without delay investigate the matter with the utmost diligence. In that context, it shall inform the notified body concerned about the objections raised and give it the possibility to make its views known. If the notifying authority comes to the conclusion that the notified body no longer meets the requirements laid down in Article 31 or that it is failing to fulfil its obligations, it shall restrict, suspend or withdraw the designation as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations. It shall immediately inform the Commission and the other Member States accordingly.

5. Where its designation has been suspended, restricted, or fully or partially withdrawn, the notified body shall inform the providers concerned within 10 days.

6. In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall take appropriate steps to ensure that the files of the notified body concerned are kept, and to make them available to notifying authorities in other Member States and to market surveillance authorities at their request.

7. In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall:

  1. (a)assess the impact on the certificates issued by the notified body;
  2. (b)submit a report on its findings to the Commission and the other Member States within three months of having notified the changes to the designation;
  3. (c)require the notified body to suspend or withdraw, within a reasonable period of time determined by the authority, any certificates which were unduly issued, in order to ensure the continuing conformity of high-risk AI systems on the market;
  4. (d)inform the Commission and the Member States about certificates the suspension or withdrawal of which it has required;
  5. (e)provide the national competent authorities of the Member State in which the provider has its registered place of business with all relevant information about the certificates of which it has required the suspension or withdrawal; that authority shall take the appropriate measures, where necessary, to avoid a potential risk to health, safety or fundamental rights.

8. With the exception of certificates unduly issued, and where a designation has been suspended or restricted, the certificates shall remain valid in one of the following circumstances:

  1. (a)the notifying authority has confirmed, within one month of the suspension or restriction, that there is no risk to health, safety or fundamental rights in relation to certificates affected by the suspension or restriction, and the notifying authority has outlined a timeline for actions to remedy the suspension or restriction; or
  2. (b)the notifying authority has confirmed that no certificates relevant to the suspension will be issued, amended or re-issued during the course of the suspension or restriction, and states whether the notified body has the capability of continuing to monitor and remain responsible for existing certificates issued for the period of the suspension or restriction; in the event that the notifying authority determines that the notified body does not have the capability to support existing certificates issued, the provider of the system covered by the certificate shall confirm in writing to the national competent authorities of the Member State in which it has its registered place of business, within three months of the suspension or restriction, that another qualified notified body is temporarily assuming the functions of the notified body to monitor and remain responsible for the certificates during the period of suspension or restriction.

9. With the exception of certificates unduly issued, and where a designation has been withdrawn, the certificates shall remain valid for a period of nine months under the following circumstances:

  1. (a)the national competent authority of the Member State in which the provider of the high-risk AI system covered by the certificate has its registered place of business has confirmed that there is no risk to health, safety or fundamental rights associated with the high-risk AI systems concerned; and
  2. (b)another notified body has confirmed in writing that it will assume immediate responsibility for those AI systems and completes its assessment within 12 months of the withdrawal of the designation.

What it requires, coded

SafeLegalAI's reading of each duty in this article: who, what, from when, under which fine tier, and whether it reaches a firm, chambers, court or legal-AI vendor. Descriptive, not advice; the quoted words are the Regulation's.

  1. Art. 36(1)Cooperation with authoritiesNot tier-specific

    A notifying authority must notify the Commission and other Member States of relevant changes to notified-body notifications through the Article 30(2) electronic notification tool.

    "The notifying authority shall notify the Commission and the other Member States of any relevant changes to the notification of a notified body via the electronic notification tool referred to in Article 30(2)."
    Who
    Notifying authority
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.
    See
    Art. 30(2)

  2. Art. 36(2)RequirementNot tier-specific

    Extensions of a notified body’s notification scope must follow the procedures in Articles 29 and 30.

    "The procedures laid down in Articles 29 and 30 shall apply to extensions of the scope of the notification."
    Who
    Notifying authority, Notified body
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.
    See
    Art. 29 · Art. 30

  3. Art. 36(3)Cooperation with authoritiesNot tier-specific

    A notified body ceasing conformity assessment activity must inform the authority and providers, certificates may remain valid for nine months if another notified body assumes responsibility and completes assessment, and the authority must withdraw designation.

    "Where a notified body decides to cease its conformity assessment activities, it shall inform the notifying authority and the providers concerned as soon as possible and, in the case of a planned cessation, at least one year before ceasing its activities. The certificates of the notified body may remain valid for a period of nine months after cessation of the"
    Who
    Notified body, Notifying authority
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.

  4. Art. 36(4)Enforcement powerNot tier-specific

    A notifying authority with sufficient reason to doubt Article 31 compliance or obligation fulfilment must investigate, hear the body and restrict, suspend or withdraw designation as appropriate, informing the Commission and Member States.

    "Where a notifying authority has sufficient reason to consider that a notified body no longer meets the requirements laid down in Article 31, or that it is failing to fulfil its obligations, the notifying authority shall without delay investigate the matter with the utmost diligence. In that context, it shall inform the notified body concerned about the objections raised and"
    Who
    Notifying authority
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.
    See
    Art. 31

  5. Art. 36(5)Information to personsNot tier-specific

    A notified body whose designation is suspended, restricted or fully or partly withdrawn must inform concerned providers within 10 days.

    "Where its designation has been suspended, restricted, or fully or partially withdrawn, the notified body shall inform the providers concerned within 10 days."
    Who
    Notified body
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.

  6. Art. 36(6)Record keepingNot tier-specific

    When designation is restricted, suspended or withdrawn, the notifying authority must ensure the notified body’s files are kept and made available to other notifying authorities and market surveillance authorities on request.

    "In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall take appropriate steps to ensure that the files of the notified body concerned are kept, and to make them available to notifying authorities in other Member States and to market surveillance authorities at their request."
    Who
    Notifying authority
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.

  7. Art. 36(7)Enforcement powerNot tier-specific

    After designation restriction, suspension or withdrawal, the notifying authority must assess certificate impacts, report to the Commission and Member States, require undue certificates to be suspended or withdrawn, and provide certificate information for risk measures.

    "In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall:"
    Who
    Notifying authority, National competent authority
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.

  8. Art. 36(8)Derogation or exemptionNot tier-specific

    Except for unduly issued certificates, certificates remain valid after suspension or restriction only where Article 36(8) no-risk, remediation, monitoring or temporary-assumption conditions are met.

    "With the exception of certificates unduly issued, and where a designation has been suspended or restricted, the certificates shall remain valid in one of the following circumstances:"
    Who
    Notifying authority, Notified body, Provider
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.

  9. Art. 36(9)Derogation or exemptionNot tier-specific

    Except for unduly issued certificates, certificates remain valid for nine months after designation withdrawal only where the national competent authority confirms no risk and another notified body assumes responsibility and completes assessment within 12 months.

    "With the exception of certificates unduly issued, and where a designation has been withdrawn, the certificates shall remain valid for a period of nine months under the following circumstances:"
    Who
    National competent authority, Notified body
    From
    (Art. 113(b) as amended by Reg. (EU) 2026/1744)
    Legal practice
    Institutional — Institutional notified-body governance; legal-AI providers may be affected indirectly if a notified body’s status changes during conformity assessment.

Cite

Regulation (EU) 2024/1689, Article 36 (Changes to notifications), as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026, https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_36 — text © European Union; only the Official Journal is authentic. Coding: SafeLegalAI (published by Cognesio LLP), "EU AI Act, structured", safelegalai.com/regulation/eu-ai-act/article-36, accessed 2026-09-08, CC BY 4.0.