EU AI Act Art.39: Conformity Assessment Bodies in Third Countries — MRA Frameworks, Brexit Impact, and Third-Country CAB Recognition for High-Risk AI Systems (2026)
Article 39 of the EU AI Act addresses a structural question that matters to any provider whose product certification ecosystem involves conformity assessment bodies located outside the European Union: under what circumstances can a third-country CAB perform a conformity assessment that satisfies the EU AI Act's requirements, and what legal framework governs that recognition?
The question is not abstract. Since Brexit, the United Kingdom's notified bodies — which had for decades certified products across the full range of EU harmonised legislation — lost their EU-wide recognition status and became UK Conformity Assessed (UKCA) bodies with no automatic standing in the EU market. Switzerland's bilateral MRA with the EU covers certain product sectors but was never designed with the EU AI Act in mind. Japan, Canada, and Australia have sector-specific MRAs with the EU that similarly predate the AI Act. As the EU AI Act enters enforcement, providers in global supply chains need to know whether their existing certification relationships with non-EU CABs will remain valid for AI Act purposes, or whether they must migrate to EU-based notified bodies.
Art.39 establishes the legal framework for answering that question: third-country CABs may be authorised to carry out AI Act conformity assessments only through international agreements between the Union and the relevant third country, and only where those agreements establish that the third country's oversight of its CABs meets conditions equivalent to the requirements in Art.33. The article also empowers the Commission to adopt implementing acts specifying the conditions for third-country CAB recognition, giving the EU a structured mechanism to expand or restrict third-country participation as its MRA relationships evolve.
The Third-Country CAB Problem
The EU AI Act's conformity assessment framework for high-risk AI systems, set out in Art.43, requires that certain categories of high-risk AI system — specifically those listed in Annex III that are not covered by the Annex I legislation displacement rule in Art.38, and for which the provider does not rely on harmonised standards or common specifications — must undergo third-party conformity assessment by a notified body. Notified bodies, as defined and governed by Arts.28–37 (establishment, notification procedure, requirements, operational obligations, subsidiaries and subcontracting, and penalties), are conformity assessment bodies that member states notify to the Commission as meeting the requirements of Art.33. The notification system is EU-internal: a CAB becomes a notified body by being approved by a national competent authority within a member state and notified to the Commission via NANDO.
This creates an immediate structural problem for providers whose supply chains or business relationships involve CABs located outside the EU. A Japanese CAB that is accredited by a Japanese accreditation body under Japanese law, or a UK CAB that is now an UKCA body under the UK Conformity Assessed system, or a Swiss CAB accredited under SECO oversight, does not automatically qualify as an EU notified body. Without Art.39, such CABs would have no legal pathway to perform EU AI Act conformity assessments regardless of their technical competence or existing relationships with providers.
Art.39 solves this by creating a treaty-based exception: where the EU has concluded an international agreement with a third country that establishes MRA conditions meeting Art.39's equivalence requirements, CABs in that third country may be designated to carry out AI Act conformity assessments on the same legal footing as EU notified bodies for products exported to the EU market.
The MRA Mechanism Under Art.39
Art.39 identifies two conditions that an international agreement must satisfy to provide a valid legal basis for third-country CAB recognition under the AI Act.
Equivalence of oversight requirements: The agreement must provide that the conditions under which bodies in the third country are authorised to carry out conformity assessment activities are equivalent to the conditions applicable in the Union — specifically the conditions in Art.33 governing the requirements for notified bodies. Art.33 sets out the detailed criteria that CABs must meet: legal status and liability, independence from providers and importers, technical competence and sector expertise, impartiality and confidentiality procedures, insurance, organisational structure, quality management system, record-keeping obligations, and subcontracting controls. An MRA that simply lists which third-country sectors are covered without demonstrating that the oversight system for CABs in that country matches these requirements would not meet Art.39's equivalence condition.
Commission notification and implementing acts: Art.39 empowers the Commission to adopt implementing acts establishing the conditions under which a specific international agreement satisfies the equivalence requirement, and identifying which third-country CABs are authorised to carry out AI Act conformity assessments under that agreement. This implementing act mechanism gives the Commission control over the pace and scope of third-country CAB recognition. A broad MRA at treaty level does not automatically result in recognised third-country CABs — the Commission must affirmatively identify which bodies are authorised, giving the EU a tool to exclude specific CABs even within MRA partner countries if their individual compliance with the Art.33 equivalence standard is questionable.
The practical effect is a two-stage gate: first, the international agreement must exist and must satisfy Art.39's equivalence standard at the systemic level; second, the Commission must adopt an implementing act identifying the specific CABs within that third country that are authorised under the agreement. Only after both stages are complete can a third-country CAB legally perform EU AI Act conformity assessments.
Existing MRAs and Their Scope for AI Act Purposes
The EU has concluded Mutual Recognition Agreements on conformity assessment with several partners, each with different sector coverage and different implications for the AI Act.
United Kingdom: The EU-UK Trade and Cooperation Agreement (TCA, 2021) does not include a mutual recognition arrangement for conformity assessment bodies. The TCA's Annex on technical barriers to trade contains only aspirational language about cooperation, not binding MRA provisions. This means that UK-based CABs — formerly notified bodies that lost their EU status at the end of the Brexit transition period on 31 December 2020 — have no treaty-based pathway under the TCA to regain recognition as authorised AI Act conformity assessment bodies under Art.39. A UK CAB wishing to perform EU AI Act conformity assessments would need either to establish a subsidiary or branch within an EU member state and seek national notification as an EU notified body in its own right, or wait for a bilateral agreement that would meet Art.39's requirements. As of 2026, no such agreement has been concluded. This is the most practically significant gap in the Art.39 landscape for the post-Brexit supply chain.
Switzerland: The EU-Switzerland Agreement on Mutual Recognition in Relation to Conformity Assessment (MRA, 1999, updated regularly) is one of the EU's deepest bilateral MRA relationships. The Swiss MRA covers a substantial number of product sectors including medical devices (MDR/IVDR), machinery, pressure equipment, electrical equipment, radio equipment, gas appliances, construction products, and personal protective equipment. Within these sectors, Swiss conformity assessment bodies designated under the Swiss MRA have historically operated as effectively equivalent to EU notified bodies for EU market access purposes. However, the Swiss MRA is a sector-specific agreement: it lists covered sectors in its Annexes, and new EU legislation is not automatically covered — it must be incorporated into the MRA through bilateral negotiations updating the relevant Annex. The EU AI Act is new legislation that was not part of the Swiss MRA when it was designed. Until the EU and Switzerland negotiate and conclude an amendment to the Swiss MRA incorporating the AI Act into the scope of the agreement — and until the Commission adopts the implementing act identifying specific Swiss CABs as authorised — Swiss CABs cannot perform EU AI Act conformity assessments under Art.39. As of early 2026, negotiations on AI Act incorporation into the Swiss MRA are ongoing but not concluded.
Canada: The Comprehensive Economic and Trade Agreement (CETA, provisionally applied since 2017) includes provisions on regulatory cooperation and mutual recognition but does not contain a conformity assessment MRA for the product sectors most relevant to the EU AI Act's high-risk AI system categories. CETA's Annex on conformity assessment has a narrow sector scope focused primarily on telecommunications equipment, and does not provide a general framework for recognising Canadian CABs across the range of sectors covered by the EU AI Act's Annex III high-risk AI categories. Canadian providers whose AI systems require third-party conformity assessment under the AI Act must currently use EU-based notified bodies.
Japan: The EU-Japan Economic Partnership Agreement (EPA, 2019) includes regulatory cooperation provisions and cross-recognition arrangements in certain sectors, notably pharmaceuticals and medical devices to a limited extent, but does not provide a broad MRA framework for conformity assessment bodies covering the AI Act's high-risk AI system categories. Japanese providers must use EU notified bodies for EU AI Act third-party conformity assessments unless a new agreement meeting Art.39's conditions is concluded.
Australia and New Zealand: The Australia-EU Agreement on Mutual Recognition of Conformity Assessment (MRASAA, 1998) covers specific sectors including medical devices, telecommunications equipment, and electrical equipment. Like the Swiss and Japanese agreements, its sector scope predates the EU AI Act and does not automatically extend to AI Act conformity assessment obligations.
The practical conclusion for providers in 2026 is stark: for the vast majority of global supply chain scenarios, Art.39 does not yet provide a functioning pathway for third-country CAB recognition for EU AI Act purposes. The existing MRA relationships either exclude the UK (no TCA MRA), have not yet been amended to incorporate the AI Act (Switzerland in progress), or have sector scopes that do not cover the AI Act's high-risk categories (Canada, Japan, Australia). Providers that need third-party conformity assessment under Art.43 must engage EU-based notified bodies.
Brexit Impact: The UK Gap in AI Act Certification
The Brexit implications for EU AI Act certification deserve particular attention because the UK had, before Brexit, one of the largest and most experienced concentrations of notified bodies in the EU — particularly in sectors with high AI penetration like medical devices, machinery, and telecommunications. UK bodies including BSI, Lloyd's Register, LRQA, SGS, TÜV SÜD UK, and others lost their EU notified body status on 31 December 2020. Many established EU-subsidiary operations to continue serving EU market access needs, but UK-based resources without EU subsidiaries are no longer available as EU notified bodies.
For high-risk AI systems embedded in medical devices — where MDR/IVDR conformity assessment is the primary certification track under Art.38 — the UK gap is particularly sharp. UK notified bodies that were designated under the MDR before Brexit lost that designation; EU market access for Class IIa, IIb, and III devices now requires certification from one of the remaining EU-designated MDR notified bodies, a group that has been significantly smaller than the pre-Brexit pool and has faced capacity constraints since 2020.
Under Art.39, this situation is not resolved without a new bilateral agreement. The TCA's technical barriers to trade chapter does not meet the Art.39 equivalence standard. UK providers, UK subsidiaries of global companies, and providers that historically relied on UK-based bodies for pan-EU certification must plan AI Act conformity assessment using EU-based notified bodies, regardless of their existing relationships with UK bodies.
Art.39 × Art.33: The Equivalence Requirement in Detail
For any international agreement to qualify as an Art.39 basis for third-country CAB recognition, it must demonstrate that the third country's system for overseeing its conformity assessment bodies is equivalent to what Art.33 requires of EU notified bodies. Understanding what Art.33 requires clarifies what "equivalence" means in practice.
Art.33 sets out requirements across several dimensions:
Structural requirements: The CAB must be a legal entity and carry adequate liability insurance. It must be independent of providers, authorised representatives, importers, distributors, and any body representing commercial interests in AI systems. Personnel involved in conformity assessment must not be designers, manufacturers, suppliers, investors, owners, or users of the AI systems they assess.
Technical competence requirements: The CAB must have the necessary technical knowledge and sufficient experience in the field of AI systems, including knowledge of the applicable requirements and the conformity assessment procedures specified in the AI Act. It must have access to all equipment and facilities required to perform its tasks, and its staff must have professional integrity and sufficient technical competence.
Operational requirements: The CAB must be able to carry out all the conformity assessment tasks assigned to it, even where those tasks are subcontracted or carried out by subsidiaries. It must participate in the coordination activities of the European AI Board's relevant working groups and keep records of its assessments.
For an MRA partner country to meet the Art.39 equivalence standard, its national accreditation and oversight system for CABs must impose requirements that, taken as a whole, produce the same substantive outcome across all these dimensions. This is a high bar — particularly for countries whose conformity assessment infrastructure has developed in regulatory ecosystems that did not previously need to address AI-specific competence requirements, logging capacity, and technical documentation review for AI systems.
Provider Strategy Under Art.39's Current Landscape
Given the limited functioning scope of Art.39 in 2026, providers designing their AI Act conformity assessment strategy face a clear practical framework.
Tier 1 — EU-based CABs (always valid): Providers that engage CABs designated as EU notified bodies by member states under Arts.28–33 have no Art.39 issues. EU notified bodies are the default track. The practical questions are capacity, sector expertise, and timeline.
Tier 2 — Swiss CABs (potential near-term): If the EU-Switzerland MRA is amended to incorporate the AI Act before a provider's conformity assessment deadline, and the Commission adopts the relevant implementing act, Swiss CABs may become available. Providers with existing Swiss CAB relationships should monitor MRA negotiation progress and include a Swiss CAB option in their contingency planning — but should not assume Swiss CAB availability in 2025-2026 timelines.
Tier 3 — UK CABs (no pathway without new agreement): Providers that have relied on UK-based bodies historically must identify and engage EU-based notified bodies for AI Act third-party conformity assessments. There is no workaround under current law. UK bodies that have established EU subsidiaries can be engaged through those subsidiaries as EU notified bodies.
Tier 4 — Other third-country CABs (no current pathway): For Canadian, Japanese, Australian, and most other third-country CABs, there is no current Art.39 pathway. EU-based notified bodies are required.
Monitoring obligation: The Art.39 landscape will evolve as the Commission negotiates MRA amendments and adopts implementing acts. Providers should designate a regulatory affairs function to monitor Commission implementing acts under Art.39 and update their CAB strategy as new third-country authorisations become available.
The Commission Implementing Act Mechanism
Art.39's empowerment of the Commission to adopt implementing acts serves two functions. First, it creates a structured mechanism for expanding third-country CAB recognition as MRA relationships develop: the Commission can move quickly to authorise specific CABs within an MRA partner country once an agreement meets the equivalence standard, without requiring a legislative amendment to the AI Act itself. Second, it allows the Commission to limit recognition to specific CABs within an MRA partner country, maintaining quality control even within a broadly qualifying MRA framework.
The implementing act mechanism also means that Art.39 creates a dynamic regulatory environment rather than a static one. A provider that selects a third-country CAB based on a current implementing act authorisation must monitor whether that authorisation remains in force — the Commission can update, restrict, or withdraw implementing acts as the oversight quality of third-country CABs changes. This is analogous to how the Commission manages the NANDO database for EU notified bodies, suspending or withdrawing notification when bodies no longer meet requirements.
For providers, the practical implication is that third-country CAB selection under Art.39 requires not just a one-time verification of current authorisation status, but an ongoing monitoring obligation to ensure the authorisation remains valid through the product's lifecycle.
Interaction with Art.43 and the Conformity Assessment Procedures
Art.39 operates at the structural level — defining which CABs may perform conformity assessments — while Art.43 defines which conformity assessment procedures apply to which high-risk AI system categories. The two articles interact in that Art.39 determines the pool of eligible assessors; Art.43 determines the assessment procedure they must follow.
A third-country CAB authorised under Art.39 performs the same conformity assessment procedure as an EU notified body would: it reviews the provider's technical documentation under the procedure specified in Art.43(1)(b) or, for AI systems in specific Annex III categories that overlap with Annex I legislation, the subsumed assessment procedure under Art.38. The third-country CAB's authorisation under Art.39 does not modify the substantive requirements; it only establishes the third-country body's legal standing to conduct the assessment.
This also means that Art.39-authorised third-country CABs are subject to the same post-market surveillance and oversight obligations as EU notified bodies under Arts.31–37 (operational obligations, annual surveillance, extraordinary assessments, subsidiaries and subcontracting controls, penalties, and suspension or withdrawal of designation). The Commission and member state market surveillance authorities retain their oversight powers over third-country CABs operating under Art.39 MRA arrangements.
Python Tool: Third-Country CAB Jurisdiction Analyser
from enum import Enum
from dataclasses import dataclass, field
class CabJurisdiction(Enum):
EU_MEMBER_STATE = "eu_member_state"
SWITZERLAND = "switzerland"
UNITED_KINGDOM = "united_kingdom"
CANADA = "canada"
JAPAN = "japan"
AUSTRALIA_NZ = "australia_nz"
OTHER_THIRD_COUNTRY = "other_third_country"
class Art39Status(Enum):
FULLY_VALID = "fully_valid" # EU notified body
MRA_PENDING = "mra_pending" # MRA exists but not yet AI-Act-incorporated
NO_PATHWAY = "no_pathway" # No qualifying MRA
MONITOR_DEVELOPMENTS = "monitor" # MRA negotiations ongoing
@dataclass
class CabAnalysis:
jurisdiction: CabJurisdiction
art39_status: Art39Status
can_perform_ai_act_assessment: bool
mra_exists: bool
ai_act_incorporated: bool
recommendation: str
contingency: str
monitoring_notes: str
def analyse_cab_jurisdiction(jurisdiction: CabJurisdiction) -> CabAnalysis:
analyses = {
CabJurisdiction.EU_MEMBER_STATE: CabAnalysis(
jurisdiction=jurisdiction,
art39_status=Art39Status.FULLY_VALID,
can_perform_ai_act_assessment=True,
mra_exists=True,
ai_act_incorporated=True,
recommendation="Proceed — EU notified body is the standard track. Verify "
"NANDO designation status and sector scope before engagement.",
contingency="N/A — EU notified bodies are the primary track.",
monitoring_notes="Monitor NANDO for suspension/withdrawal of specific body's notification.",
),
CabJurisdiction.SWITZERLAND: CabAnalysis(
jurisdiction=jurisdiction,
art39_status=Art39Status.MRA_PENDING,
can_perform_ai_act_assessment=False,
mra_exists=True,
ai_act_incorporated=False,
recommendation="Do NOT rely on Swiss CAB for AI Act assessments until Commission "
"implementing act confirms AI Act incorporation into EU-CH MRA. "
"Identify EU-based notified body as primary path.",
contingency="If Swiss CAB is preferred partner, check quarterly for MRA Annex "
"amendment progress and Commission implementing act publication.",
monitoring_notes="Track EU-Switzerland bilateral MRA negotiations on AI Act scope. "
"Monitor EUR-Lex for Commission implementing acts under Art.39.",
),
CabJurisdiction.UNITED_KINGDOM: CabAnalysis(
jurisdiction=jurisdiction,
art39_status=Art39Status.NO_PATHWAY,
can_perform_ai_act_assessment=False,
mra_exists=False,
ai_act_incorporated=False,
recommendation="UK-based CABs (UKCA bodies) have NO Art.39 pathway under current "
"law. TCA does not include conformity assessment MRA. Use EU notified "
"body. Check if UK body has EU subsidiary with separate NANDO listing.",
contingency="Identify EU subsidiary of UK body if one exists and is EU-notified. "
"Alternatively, engage independent EU-based notified body.",
monitoring_notes="Monitor UK-EU trade relationship for potential future MRA "
"agreement covering conformity assessment. No timeline confirmed "
"as of 2026.",
),
CabJurisdiction.CANADA: CabAnalysis(
jurisdiction=jurisdiction,
art39_status=Art39Status.NO_PATHWAY,
can_perform_ai_act_assessment=False,
mra_exists=True,
ai_act_incorporated=False,
recommendation="CETA's conformity assessment provisions do not cover AI Act "
"high-risk categories. Canadian CABs cannot perform EU AI Act "
"assessments. Use EU-based notified body.",
contingency="EU-based notified body required. CETA renegotiation to extend "
"CAB MRA scope to AI Act categories is not in current agenda.",
monitoring_notes="Monitor CETA Annex on conformity assessment for any extension "
"to AI Act categories via Joint Committee decision.",
),
CabJurisdiction.JAPAN: CabAnalysis(
jurisdiction=jurisdiction,
art39_status=Art39Status.NO_PATHWAY,
can_perform_ai_act_assessment=False,
mra_exists=True,
ai_act_incorporated=False,
recommendation="EU-Japan EPA conformity assessment provisions do not cover "
"AI Act high-risk categories. Use EU-based notified body.",
contingency="EU-based notified body required.",
monitoring_notes="Monitor EU-Japan bilateral regulatory dialogues for any "
"AI Act-specific conformity assessment arrangement.",
),
CabJurisdiction.AUSTRALIA_NZ: CabAnalysis(
jurisdiction=jurisdiction,
art39_status=Art39Status.NO_PATHWAY,
can_perform_ai_act_assessment=False,
mra_exists=True,
ai_act_incorporated=False,
recommendation="MRASAA sector scope does not cover AI Act categories. "
"Use EU-based notified body.",
contingency="EU-based notified body required.",
monitoring_notes="Monitor MRASAA sector extension discussions.",
),
CabJurisdiction.OTHER_THIRD_COUNTRY: CabAnalysis(
jurisdiction=jurisdiction,
art39_status=Art39Status.NO_PATHWAY,
can_perform_ai_act_assessment=False,
mra_exists=False,
ai_act_incorporated=False,
recommendation="No Art.39 basis exists for this jurisdiction. "
"EU-based notified body required for all Art.43 assessments.",
contingency="EU-based notified body required.",
monitoring_notes="Monitor EUR-Lex for new international agreements "
"including conformity assessment provisions.",
),
}
return analyses[jurisdiction]
def check_art39_compliance(
cab_jurisdiction: str,
ai_act_scope_requires_third_party: bool,
timeline_months: int = 12,
) -> dict:
try:
jurisdiction = CabJurisdiction(cab_jurisdiction)
except ValueError:
jurisdiction = CabJurisdiction.OTHER_THIRD_COUNTRY
analysis = analyse_cab_jurisdiction(jurisdiction)
urgency = "LOW"
if not analysis.can_perform_ai_act_assessment and ai_act_scope_requires_third_party:
if timeline_months <= 6:
urgency = "CRITICAL"
elif timeline_months <= 12:
urgency = "HIGH"
else:
urgency = "MEDIUM"
return {
"jurisdiction": jurisdiction.value,
"art39_status": analysis.art39_status.value,
"can_perform_assessment": analysis.can_perform_ai_act_assessment,
"action_required": not analysis.can_perform_ai_act_assessment and ai_act_scope_requires_third_party,
"urgency": urgency,
"recommendation": analysis.recommendation,
"contingency": analysis.contingency,
"monitoring_notes": analysis.monitoring_notes,
}
# Example
result = check_art39_compliance(
cab_jurisdiction="united_kingdom",
ai_act_scope_requires_third_party=True,
timeline_months=8,
)
print(result)
# {jurisdiction: united_kingdom, art39_status: no_pathway,
# can_perform_assessment: False, action_required: True, urgency: HIGH,
# recommendation: UK-based CABs (UKCA bodies) have NO Art.39 pathway ...}
Provider Checklist: CAB Selection Under Art.39
- Identify whether your AI system requires third-party conformity assessment under Art.43 — self-assessment (internal control + registration) applies to some Annex III categories; not all high-risk AI systems need a notified body.
- If third-party assessment is required, confirm whether your system falls under an Annex I legislation sector that triggers Art.38 displacement — if yes, the NLF conformity assessment procedure applies and the CAB question is governed by that legislation, not Art.39.
- Identify the jurisdiction of your preferred CAB — is it an EU member state, Switzerland, UK, or another third country?
- For EU-based CABs: Verify current NANDO designation status and AI Act sector scope at nando.ec.europa.eu before engagement.
- For Swiss CABs: Confirm whether the EU-CH MRA has been amended to incorporate the AI Act and whether a Commission implementing act under Art.39 has been published. Do not assume availability.
- For UK-based bodies: Identify whether the body has established and notified an EU subsidiary. If yes, verify the EU subsidiary's NANDO listing and that its designation covers the relevant AI Act category. If no EU subsidiary, the body cannot perform EU AI Act assessments.
- For all other third-country CABs: Confirm no Art.39 implementing act covers your jurisdiction and plan EU-based notified body engagement.
- Verify notified body sector competence: Not all NANDO-listed notified bodies have designated scope for all AI Act high-risk categories — check the specific notified body's technical scope for your product category.
- Assess notified body capacity: AI Act demand has created capacity constraints among EU notified bodies, particularly those specialised in Annex III categories (biometrics, critical infrastructure, employment). Engage early.
- Confirm ongoing monitoring procedure: Assign a regulatory affairs function to monitor NANDO for changes to your chosen notified body's designation status throughout the product lifecycle.
- Build Art.39 MRA monitoring into compliance calendar: Review quarterly for Commission implementing acts under Art.39 that might expand third-country CAB availability relevant to your preferred bodies.
- Document CAB selection rationale: Record why a specific CAB was selected and the Art.39 status of its jurisdiction at the time of engagement — this is part of your technical documentation under Art.11.
- For multi-market products: If certifying for both EU and UK markets, coordinate EU notified body engagement for EU market access with UK Approved Body engagement for UKCA requirements — these are now separate parallel tracks with separate bodies.
- For subcontracting situations (Art.34): If your chosen EU notified body subcontracts assessment work, verify that any subcontracted body is also EU-based or, if third-country, covered by a qualifying Art.39 MRA.
- Include CAB jurisdiction risk in supply chain risk register: Brexit, potential future MRA changes, or Commission implementing act updates could affect CAB availability mid-product-cycle. Plan contingency notified body options.
- For Annex I sectors (Art.38 displacement): Verify that the existing NLF-designated notified body for your sector (MDR, Machinery Regulation, etc.) has expanded competence for AI Act assessment under the displaced procedure — this is not automatic for all existing NLF notified bodies.
- Monitor EU-UK trade relationship: A future UK-EU agreement including conformity assessment MRA provisions would change the Art.39 landscape for UK bodies significantly. This is the most likely structural change to watch.
- For ongoing surveillance obligations (Art.31): Confirm that your chosen notified body's ongoing surveillance programme under Art.31 is structured for AI systems, not just physical product inspection — many NLF notified bodies are adapting their surveillance procedures for AI-specific requirements.
- Check substantial modification trigger: If you modify a certified AI system to a degree that constitutes a substantial modification under Art.6(3), re-engage your notified body — the Art.39 status of the body must be current at the time of the new assessment.
- Brief procurement and sourcing: Ensure that procurement teams engaging third-party AI system components understand the Art.39 constraint — a component certified by a non-Art.39-authorised third-country body does not satisfy the AI Act's conformity assessment requirements even if it satisfied other technical standards.
- For successors to Brexit-affected certifications: If you hold certificates issued by a UK body before Brexit that have been transitioned to a UKCA certificate, confirm separately with an EU notified body what is required for EU AI Act conformity — the transitioned certificate is UK-domestic only.
- Confirm timeline against Art.39 MRA development: If your preferred third-country CAB is in a jurisdiction where MRA negotiations are ongoing (Switzerland), assess whether the MRA will likely be incorporated before your conformity assessment deadline. If uncertain, proceed with an EU-based notified body to avoid timeline risk.
Art.39 currently functions primarily as a future-proofing mechanism: it establishes the legal framework for third-country CAB recognition in anticipation of MRA developments, while in practice the post-Brexit, pre-amendment landscape means that EU-based notified bodies are the only reliable option for the vast majority of providers requiring third-party AI Act conformity assessment. The most actionable near-term development to track is the EU-Switzerland MRA amendment incorporating the AI Act, which would be the first functioning Art.39 pathway for a jurisdiction with significant existing CAB expertise. The UK pathway remains structurally absent without a new bilateral agreement.