sota.io
2026-04-23·15 min read·

EU AI Act Art.29 Changes to Notifications: Suspension, Restriction, and Withdrawal of Notified Body Status (2026)

Article 29 of the EU AI Act governs the dynamic enforcement side of the notified body framework. While Art.27 defines the eligibility requirements and Art.28 establishes the formal notification procedure, Art.29 answers a different question: what happens when a notified body no longer meets the standards it was assessed against, or when it fails to perform its conformity assessment functions properly?

The answer is a graduated intervention mechanism with three tools — suspension, restriction of scope, and withdrawal — each calibrated to the severity and nature of the non-compliance. Art.29 also includes urgency provisions for situations where immediate action is necessary to protect health, safety, or fundamental rights.

For AI system providers, Art.29 carries direct commercial significance. Conformity assessment certificates issued by notified bodies are the gateway to CE marking for Annex I and Annex III high-risk AI systems. If the notified body that issued a certificate is subsequently suspended, restricted, or has its notification withdrawn, the provider must understand which certificates remain valid, which require remediation, and how to manage ongoing assessments that are disrupted mid-process.

The Position of Art.29 in the Notified Body Lifecycle

The notified body framework distributes obligations across a sequence of articles:

Art.29 therefore operates downstream of Art.28. Notification creates legal status; Art.29 modifies or terminates that status. The three Art.29 mechanisms have different legal effects, different procedural requirements, and different implications for certificates and assessments in progress.

Understanding the Art.29 lifecycle matters not only for notified bodies, which must maintain Art.27 compliance throughout their operational existence, but also for providers who depend on those bodies for certificate validity, and for national market surveillance authorities coordinating enforcement across Member States.

The Investigation Trigger: When Art.29 Becomes Active

Art.29(1) establishes that the notifying authority must investigate a notified body where it has concerns as to whether the body continues to satisfy the requirements set out in Art.27 or whether it is fulfilling its obligations.

The trigger is a concern — not a confirmed finding. This is deliberately broad. It encompasses:

Concerns arising from ongoing supervision. Notifying authorities maintain continuing oversight of the bodies they have notified, as required under the broader notified body regulation framework. Periodic reviews, documentation audits, and re-assessments can surface indicators of non-compliance before any specific incident occurs.

Concerns arising from complaints. Manufacturers, importers, distributors, deployers, or individuals may lodge complaints about a notified body's conduct — asserting that assessments were insufficiently rigorous, that the body failed to detect non-conformities, or that it exceeded its designated scope. Notifying authorities are required to take such complaints seriously.

Concerns arising from market surveillance findings. If national market surveillance authorities discover high-risk AI systems with defective certificates, or if a pattern of non-conformities appears in systems assessed by a particular body, this triggers investigation of the body itself.

Concerns arising from information shared by other Member States or the Commission. Under Art.29(4), notifying authorities that take action under Art.29 must inform the Commission and other Member States. This information flow also works in reverse: the Commission and Member States that become aware of problems with a notified body are expected to alert the relevant notifying authority.

Concerns arising from changes within the body. Where a notified body undergoes structural changes — key personnel departures, changes in ownership, loss of accreditation, reduction in financial stability, or changes to quality management arrangements — these can independently trigger the notifying authority's investigation obligation.

The investigation obligation is not optional. The word "shall" in Art.29(1) means that once a concern exists, the notifying authority is legally required to investigate. Failure to investigate known concerns creates both regulatory and liability exposure for the notifying authority.

The Three Intervention Mechanisms

Suspension of Notification

Suspension is a temporary measure. It removes the notified body's authority to carry out new conformity assessment activities in the suspended scope, but it does not invalidate the body's legal status as a notified body during the suspension period.

Suspension is appropriate where:

During suspension, the NANDO database entry is updated to reflect the suspended status and the scope affected. Other notified bodies, providers, and market surveillance authorities can see the suspension in real time. Providers who were relying on the suspended body for ongoing assessments must pause those assessments or transfer them to another notified body.

The suspension period is not open-ended. The notifying authority must establish a remediation timeline or transition to restriction or withdrawal if the root cause cannot be addressed within a reasonable period. Extended suspension without resolution is itself a form of regulatory inaction that the Commission can scrutinise.

If the notified body remedies the identified non-compliances during the suspension period, the notifying authority can lift the suspension and restore the body's full operational status. The NANDO database is updated to reflect reinstatement.

Restriction of Scope

Restriction is a permanent or indefinite reduction of the notified body's designated scope. Unlike suspension, restriction does not temporarily remove authority across a scope — it permanently removes authority for the restricted categories or activities.

Restriction is appropriate where:

A restriction of scope requires a new NANDO entry or modification of the existing entry. The body's notification ID and number remain the same, but the scope column is amended. Certificates issued within the restricted scope before the restriction became effective retain their validity under the transitional provisions discussed below.

Restriction is procedurally similar to a partial withdrawal: the body can no longer issue new certificates for systems falling within the restricted categories. Providers planning to use the body for new assessments in those categories must identify an alternative notified body.

Withdrawal of Notification

Withdrawal is the most drastic intervention: the complete termination of the body's notified status. After withdrawal, the body ceases to be a notified body for EU AI Act purposes entirely. Its NANDO number is deactivated. It cannot carry out any EU AI Act conformity assessments, cannot issue new certificates, and cannot renew or extend existing certificates.

Withdrawal is appropriate where:

Withdrawal triggers the most complex transitional consequences, because it affects not only ongoing assessments but also all certificates previously issued by the body that remain within their validity period. The Art.29 framework addresses these consequences through its transitional provisions.

Urgency Measures

Art.29 also provides for urgency measures in situations where the normal investigation-and-decision process is too slow to protect against immediate risks to health, safety, or fundamental rights. Where a notifying authority has reasonable grounds to believe that a notified body poses an immediate risk — for example, where it has issued certificates for systems that are demonstrably unsafe or where it is actively obstructing an investigation — the notifying authority may take interim protective action without waiting for the full procedure.

The urgency regime is available where:

Urgency measures are subject to notification to the Commission and other Member States and are subject to review if the body challenges them. They are temporary by nature: the full investigation and decision procedure must proceed in parallel.

The Rights-of-Defence Procedure

Art.29 does not permit the arbitrary suspension, restriction, or withdrawal of a notified body's status without procedural safeguards. The notified body has rights of defence: it must be given an opportunity to be heard before a decision adversely affecting its status becomes final.

This procedural requirement has several practical implications:

Notice of investigation. When a notifying authority opens an Art.29 investigation, it must inform the notified body. The body has the right to know the basis for the investigation, the specific Art.27 requirements or Art.31 obligations at issue, and the evidence the notifying authority has gathered.

Response period. The body must be given a meaningful opportunity to respond — to provide its own evidence, to contest factual findings, to present remediation plans, or to dispute the legal characterisation of the non-compliance.

Decision with reasons. The decision to suspend, restrict, or withdraw must be issued with a statement of reasons that engages with the body's response. A decision that ignores substantive arguments creates grounds for challenge.

Suspension pending appeal. Depending on national administrative procedure law, the body may be able to seek interim suspension of the Art.29 decision while a formal challenge proceeds. However, where urgency measures are in place, courts typically apply a high bar for interim relief.

The rights-of-defence requirement creates a tension with urgency: where a body poses an immediate risk, waiting for the full procedure before acting could allow harm to materialise. Art.29 resolves this by separating urgency measures (which can precede rights of defence) from the final decision on status change (which requires it).

NANDO Update Obligations

Art.29(4) establishes that where a notifying authority suspends, restricts, or withdraws a notification, it must inform the Commission and all other Member States. The Commission is then responsible for ensuring that the NANDO database is updated to reflect the change.

The NANDO update creates a Union-wide effect. All actors who rely on NANDO to verify notified body status — providers checking the validity of bodies before engaging them, market surveillance authorities conducting enforcement checks, importers verifying certificates — will see the change in real time once the NANDO entry is updated.

The NANDO entry for a suspended body shows:

The NANDO entry for a withdrawn body shows the body as no longer active. Its historical entries remain visible for audit and enforcement purposes, allowing market surveillance authorities to trace certificates back to the body even after its status is terminated.

Providers who maintain NANDO verification as part of their supplier due diligence — checking body status before engaging them for assessments and periodically re-verifying body status during long assessment processes — will receive earliest warning of Art.29 developments affecting their chosen body.

Transitional Provisions: Certificates and Ongoing Assessments

The most operationally significant aspect of Art.29 for providers is the transitional regime governing certificates and assessments affected by a status change.

Certificates Issued Before the Art.29 Decision

Certificates issued before the suspension, restriction, or withdrawal decision may remain valid for a defined transitional period. The rationale is that a provider who obtained a certificate in good faith from a properly-notified body should not face immediate invalidation of that certificate simply because the body subsequently lost its status. This would create unjustifiable disruption to the supply chain and could result in sudden CE marking withdrawals for products that actually conform to the AI Act requirements.

The transitional period allows providers to:

The national market surveillance authority and the Commission monitor the transition period to ensure that providers do not simply wait out the transitional period without taking remedial action.

Where the Art.29 decision was triggered by fraud or misrepresentation by the notified body itself — for example, where the body issued certificates without performing genuine assessments — the transitional period may be shortened or eliminated, because the certificates themselves lack integrity.

Assessments in Progress at the Time of the Art.29 Decision

Where a provider has an assessment underway with a notified body at the time a suspension or withdrawal decision takes effect, the assessment is disrupted. The provider has several options:

Transfer to another notified body. The most common path: the assessment file is transferred to a new body, which reviews the work already done and completes the assessment. The new body may accept some prior work but is not required to do so — it bears responsibility for its own certification decisions.

Await lifting of suspension. Where the disruption is a temporary suspension and the provider expects the body to be reinstated within an acceptable timeframe, waiting may be commercially preferable to transferring the assessment.

Commence fresh assessment. Where the prior body's conduct during the partial assessment is in question, commencing a fresh assessment with a new body may be the lowest-risk path, even though it involves duplicate cost and delay.

The provider must factor in CE marking timelines, regulatory deadlines, and customer commitments when choosing among these options. In sectors where deployment dates are contractually fixed, transfer is typically the only commercially viable option.

from dataclasses import dataclass
from enum import Enum
from datetime import date
from typing import Optional

class NotificationStatus(Enum):
    ACTIVE = "active"
    SUSPENDED = "suspended"
    RESTRICTED = "restricted"
    WITHDRAWN = "withdrawn"

class Art29ActionType(Enum):
    SUSPENSION = "suspension"
    SCOPE_RESTRICTION = "scope_restriction"
    WITHDRAWAL = "withdrawal"
    URGENCY_MEASURE = "urgency_measure"
    REINSTATEMENT = "reinstatement"

@dataclass
class NotificationChangeEvent:
    nando_number: str
    action_type: Art29ActionType
    effective_date: date
    affected_scope: Optional[list[str]]  # None = full scope
    transitional_period_end: Optional[date]
    reason: str
    decision_reference: str

@dataclass
class ProviderCertificateExposure:
    certificate_id: str
    nando_number: str
    issued_date: date
    valid_until: date
    assessment_scope: str
    product_slug: str

class Art29ImpactAssessor:
    """Assess the impact of an Art.29 decision on a provider's certificate portfolio."""

    def __init__(
        self,
        change_event: NotificationChangeEvent,
        certificates: list[ProviderCertificateExposure]
    ):
        self.event = change_event
        self.certificates = certificates

    def affected_certificates(self) -> list[ProviderCertificateExposure]:
        """Return certificates issued by the affected body in the affected scope."""
        return [
            c for c in self.certificates
            if c.nando_number == self.event.nando_number
            and (
                self.event.affected_scope is None
                or c.assessment_scope in self.event.affected_scope
            )
        ]

    def certificates_requiring_transfer(self, assessment_date: date) -> list[ProviderCertificateExposure]:
        """Return certificates that will not outlast the transitional period."""
        affected = self.affected_certificates()
        if self.event.action_type == Art29ActionType.REINSTATEMENT:
            return []
        if self.event.transitional_period_end is None:
            return affected  # No transitional period — all require immediate action
        return [
            c for c in affected
            if c.valid_until > self.event.transitional_period_end
        ]

    def urgency_level(self) -> str:
        """Classify urgency for provider response planning."""
        if self.event.action_type == Art29ActionType.URGENCY_MEASURE:
            return "CRITICAL"
        if self.event.action_type == Art29ActionType.WITHDRAWAL:
            return "HIGH"
        if self.event.action_type == Art29ActionType.SUSPENSION:
            return "MEDIUM"
        if self.event.action_type == Art29ActionType.SCOPE_RESTRICTION:
            return "LOW_TO_MEDIUM"
        return "LOW"

    def recommended_action(self) -> str:
        """Return recommended provider action based on impact assessment."""
        urgency = self.urgency_level()
        affected = self.affected_certificates()
        if not affected:
            return "NO_ACTION_REQUIRED"
        if urgency == "CRITICAL":
            return "IMMEDIATE_TRANSFER_TO_ALTERNATIVE_NB"
        if urgency == "HIGH":
            return "INITIATE_TRANSFER_WITHIN_TRANSITIONAL_PERIOD"
        if urgency == "MEDIUM":
            return "MONITOR_SUSPENSION_STATUS_PLAN_TRANSFER_IF_PROLONGED"
        return "VERIFY_SCOPE_ASSESS_FUTURE_CERTIFICATION_NEEDS"

Interaction Between Art.29 and Art.28: The Notification Cycle

Art.29 closes the loop that Art.28 opens. Art.28 creates notification; Art.29 modifies or ends it. The two articles together define the full lifecycle of a notification.

Where a notified body is suspended under Art.29, the Art.28 notification remains technically in existence but is operationally inactive for the suspended scope. If the suspension is resolved and the body reinstated, no new Art.28 notification procedure is required — the original notification is restored.

Where a body is withdrawn under Art.29 and later seeks to re-enter the market as a notified body, it must go through the full Art.28 procedure again from scratch. Prior notification status does not persist through withdrawal. The body must satisfy Art.27 requirements as if for the first time, undergo the notifying authority's assessment, and complete the two-week information period before NANDO registration.

This means that withdrawal, unlike suspension, permanently resets the body's position in the lifecycle. A withdrawn body cannot claim continuity of prior certificates or prior assessment experience for legal purposes under the new notification.

Art.29 Interaction with Art.30: Challenge of Competence

Art.29 and Art.30 address different types of problems with notified bodies. Art.29 addresses systemic issues — failures that affect the body's overall qualification or operational reliability. Art.30 addresses instance-specific issues — situations where a party believes a particular notified body lacks the competence to carry out a specific conformity assessment.

The two articles can interact. Evidence gathered in an Art.30 challenge — for example, demonstrating that a body lacks expertise in a particular AI system domain — can form the factual foundation for an Art.29 scope restriction targeting that domain. Conversely, where an Art.29 investigation is already underway, the outcome of an Art.30 challenge relating to the same body may be relevant to the investigation.

For providers, the distinction matters because the remedies are different. Art.30 can result in the body being required to justify its assessment approach in a specific case, or in a re-assessment being ordered. Art.29 affects the body's legal status and therefore all assessments and certificates across its scope.

Art.29 Interaction with Art.31: Operational Obligations as Triggers

Art.29 applies not only when Art.27 requirements are no longer met, but also when the body fails to fulfil its obligations — which are set out in Art.31. Art.31 imposes operational duties including:

Where a notified body systematically fails to perform any of these duties — for example, by outsourcing assessments to unqualified subcontractors, by accepting bribes, or by failing to report non-conformities — the notifying authority is obligated under Art.29 to investigate and take proportionate action.

This means that Art.31 failures are effectively enforced through Art.29. Providers who become aware of conduct by their notified body that appears to violate Art.31 should consider whether to report this to the notifying authority, both as a matter of regulatory compliance and as a risk management measure (given that an Art.29 decision could affect certificates issued by that body).

Art.29 Compliance Framework for Providers

Providers can structure their notified body management to reduce Art.29 exposure.

Pre-Engagement Due Diligence

Before engaging a notified body for a conformity assessment:

  1. Verify NANDO status. Access the NANDO database and confirm the body's status is active, its scope covers the relevant AI system category, and no suspension or restriction is in effect.
  2. Check accreditation status. Confirm the body's national accreditation is current and covers the relevant scope. Accreditation withdrawal is often a leading indicator of an Art.29 process.
  3. Review publicly available information. Check for any press coverage, industry reports, or regulatory announcements about problems with the body.
  4. Assess contract terms. Ensure the assessment contract includes provisions for assessment transfer in the event of an Art.29 decision, including file transfer obligations and cooperation with a replacement body.

Ongoing Monitoring During Assessment

For long-running assessments (which can span months for complex high-risk AI systems):

  1. Re-verify NANDO status at key milestones. Check before submitting technical documentation, before the on-site audit, and before certificate issuance.
  2. Track accreditation renewal cycles. If you know the body's accreditation expires at a specific date, verify renewal well before that date.
  3. Monitor notifying authority communications. Some notifying authorities publish notices about investigations or status changes that precede the formal NANDO update.

Post-Certificate Management

After certificate issuance:

  1. Calendar validity periods. Certificates have defined validity periods. Calendar reminders for renewal assessments must account for notified body availability, which could be disrupted by an Art.29 event.
  2. Include Art.29 scenarios in business continuity planning. Identify alternative notified bodies for each certificate scope. Confirm that alternative bodies have capacity and that assessment file transfer is contractually possible.
  3. Review certificates when Art.29 actions are published. When NANDO shows a status change for any body, confirm whether any of your certificates were issued by that body and assess transitional period implications.

Compliance Matrix: Art.29 Obligations by Actor

ObligationNotifying AuthorityNotified BodyProvider
Investigate concerns about Art.27 complianceRequired (Art.29(1))Submit to investigationMonitor NANDO
Provide rights of defenceMust give opportunityExercise rights proactivelyN/A
Implement suspension / restriction / withdrawalDecision-makerCease affected activitiesIdentify alternatives
Update NANDO databaseInitiate NANDO changeN/AMonitor NANDO
Notify Commission and Member States (Art.29(4))RequiredN/AN/A
Manage transitional certificatesSet transitional periodCooperate with file transferTransfer assessments within period
Urgency measuresTake where immediate riskN/ARespond immediately
Cooperation with ongoing assessmentsOversightTransfer file on requestEngage new body
Post-withdrawal re-entryNew Art.28 procedureApply freshN/A

Provider Checklist: Responding to an Art.29 Decision

Immediate Response (within 48 hours of learning of Art.29 action):

Short-Term (within 2 weeks):

Medium-Term (within the transitional period):

Systemic:

See Also