EU AI Act Art.39 Conformity Assessment Bodies of Third Countries: Developer Guide (2026)

EU AI Act Article 39 addresses a practical gap in the global compliance landscape: what happens when the conformity assessment body best positioned to assess your AI system is established outside the European Union? For multinational AI developers, this question is not theoretical. Major conformity assessment bodies — UL, SGS North America, BSI Group UK, TÜV SÜD Japan — operate global networks, and the most technically qualified assessors for a specific AI domain may sit in a third country.

Art.39 creates the legal basis for the European Commission to conclude international agreements that permit third-country conformity assessment bodies (CABs) to perform EU AI Act assessments under conditions of equivalence. Without such agreements, a third-country CAB has no legal standing to issue an EU AI Act certificate — even if its technical competence exceeds that of any EU-based notified body. Art.39 is therefore the article that determines whether your global CAB relationships translate into valid EU conformity evidence.

For cloud infrastructure providers, Art.39 has a second-order implication: assessment records produced by a third-country CAB — in particular a US-headquartered body — may be subject to the US CLOUD Act and compellable by US federal agencies regardless of where the records are physically stored. This creates a parallel compliance exposure to the one the EU AI Act itself generates, and must be factored into body selection even when Art.39 recognition is technically available.

This guide covers the Art.39 framework in detail, explains the recognition pathway, analyzes intersection with the broader conformity chain, and provides Python tooling for managing third-country CAB relationships at scale.

Art.39 in the EU AI Act Framework

The EU AI Act creates a comprehensive conformity infrastructure for high-risk AI systems:

• Arts.28–38: Notified bodies — requirements, designation, operational obligations, coordination, and cross-recognition with Union harmonisation legislation
• Art.39: Third-country conformity assessment bodies — the international extension of the notified body framework
• Arts.40–42: Standards and common specifications — the technical content assessed
• Art.43: The conformity assessment procedure — which track applies and who performs it
• Arts.44–49: The output chain — certificates, EU declaration of conformity, CE marking, registration

Art.39 sits at the boundary between the notified body framework and the international trade dimension of the EU AI Act. It is the legal gateway through which third-country bodies enter the conformity system — but only under Commission-negotiated agreements, not through unilateral recognition by member states.

Art.39(1): Commission Authority to Conclude International Agreements

The Core Provision

Art.39(1) grants the European Commission authority to conclude international agreements with third countries regarding the recognition of conformity assessment bodies established in those countries. These agreements permit designated third-country bodies to perform conformity assessments for high-risk AI systems intended to be placed on the EU market.

This is not a mutual recognition arrangement under which any third-country accredited body gains automatic standing. The mechanism requires:

1. A specific international agreement — bilateral or multilateral, negotiated by the Commission
2. Scope limitation — the agreement specifies which product categories, AI system types, or conformity assessment procedures the third-country body may perform
3. Equivalence determination — the agreement requires a finding that the third country's requirements for conformity assessment bodies are equivalent to those in Arts.29–34

Practical Status (2026)

As of 2026, the Commission has not yet concluded Art.39 agreements with any third country. The EU AI Act entered into force in August 2024, with the main obligations applying from August 2026. The Commission is in preliminary discussions with several trading partners, but no agreements have been finalized. This means that currently, only EU-based notified bodies can perform EU AI Act conformity assessments under Art.43.

Developers relying on third-country CABs should:

1. Verify continuously whether an agreement covering your jurisdiction and product category has been concluded
2. Maintain parallel relationships with EU-based notified bodies as a contingency
3. Structure assessment scopes so that third-country technical assessments can feed into an EU notified body's final determination even absent an Art.39 agreement

Expected Agreements

The Commission is most likely to prioritize agreements with:

Art.39(2): Equivalence Requirements

What Equivalence Means

For a third-country body to be recognized under an Art.39 agreement, the relevant international agreement must establish that the body meets requirements equivalent to those in Arts.29–34:

The Accreditation Pathway

The most viable route to equivalence is through the International Laboratory Accreditation Cooperation (ILAC) and International Accreditation Forum (IAF) multilateral recognition arrangements. Bodies accredited under ISO/IEC 17065 by an IAF-recognized national accreditation body can demonstrate technical competence equivalence to the EU's requirements under Art.29(2). The EU's EA (European co-operation for Accreditation) is an IAF member, creating a de facto bridge.

Art.39(3): Scope Limitation and Registration

Defined Scope

Art.39(3) requires that international agreements specify the scope of the third-country body's authorization. This scope must correspond to specific:

• Product categories covered by Annex III (high-risk AI categories)
• Conformity assessment procedures (Annex VI internal control, Annex VII notified body assessment, or both)
• Standards or common specifications the body is competent to assess against

A third-country body recognized under an Art.39 agreement is not automatically authorized for all EU AI Act conformity assessments. The scope is defined by the agreement and may be more limited than a fully designated EU notified body.

Registration in the NANDO Database

Once an international agreement is concluded and a third-country body is recognized, it will be registered in the NANDO (New Approach Notified and Designated Organisations) database with a notation that its authority derives from an Art.39 agreement. Developers should verify NANDO registration before treating a third-country body's assessment as valid EU conformity evidence.

Key NANDO fields for third-country bodies:

• Country: third-country jurisdiction
• Agreement: reference to the specific international agreement
• Product scope: specific Annex III categories covered
• Assessment procedures: which Annex procedures the body may apply
• Validity: term of the recognition (subject to renewal)

Art.39(4): Suspension and Withdrawal

Withdrawal of Recognition

Art.39(4) mirrors the suspension mechanism in Art.36 for EU notified bodies. The Commission can suspend, restrict, or withdraw a third-country body's recognition if:

1. The body no longer meets the equivalence requirements
2. The third country's regulatory framework has changed and equivalence can no longer be established
3. The body has failed to comply with the agreement's reporting obligations
4. Systemic failures in the body's assessment process are identified through market surveillance

Developer Risk

If a third-country body's recognition is suspended after it has issued a certificate for your AI system, your certificate remains valid for its existing term — but you cannot renew it with the same body (you must transition to an EU notified body or a remaining recognized third-country body). This creates a contingency planning requirement analogous to the one in Art.36 for EU notified body suspension.

The CLOUD Act Problem for US-Based CABs

Why This Matters

If the Commission concludes an Art.39 agreement with the United States and your developer entity engages a US-headquartered CAB (e.g., UL Solutions, Intertek North America), the assessment records — technical documentation, test results, audit findings — are created, processed, or stored by a US person under 18 U.S.C. § 2713 (the CLOUD Act).

The CLOUD Act requires US-domiciled entities to produce records held anywhere in the world in response to a valid US government order. This means:

EU-Native Assessment as Risk Mitigation

For AI systems containing competitive IP, the CLOUD Act risk argues strongly for using EU-based notified bodies (designated under Arts.28–37) rather than US-headquartered third-country bodies recognized under Art.39 — even if both are technically equivalent. An EU-based notified body operating solely under EU law has no CLOUD Act exposure, and assessment records stored on EU-resident infrastructure under a single EU regulatory regime cannot be compelled by foreign governments.

This is directly analogous to the sovereign infrastructure argument for deploying AI systems on EU-resident cloud platforms: consolidating regulatory exposure to a single, known jurisdiction reduces both legal risk and compliance overhead.

Art.39 Intersection Matrix

Practical Implications for AI Developers

The Current State (2026): No Active Agreements

Until the Commission concludes Art.39 agreements, the practical rule is simple: only EU-based notified bodies have standing to perform EU AI Act conformity assessments. Third-country technical assessments (even from ISO/IEC 17065-accredited bodies) cannot substitute for an EU notified body assessment under Art.43(1)(b) (Annex VII).

What to Do While Waiting for Art.39 Agreements

1. Identify your candidate notified bodies: Use NANDO to find EU-based bodies with the right AI and product-category scope
2. Leverage Art.38 cross-designation: If your AI system is also covered by MDR, Machinery Regulation, or RED, your existing notified body may already be Art.38-eligible for EU AI Act assessment
3. Monitor Commission agreement negotiations: Follow DG GROW and DG TRADE publications for Art.39 agreement progress
4. Structure third-country assessments as pre-work: Engage your US/UK/Swiss CAB for technical pre-assessment that your EU notified body can rely on as supplementary evidence — but the EU body must conduct its own assessment and issue the certificate

Preparing for Post-Agreement Scenarios

If your preferred third-country CAB is likely to be recognized under a future Art.39 agreement, prepare by:

1. Engaging the CAB now for a gap assessment against EU AI Act Art.29–34 equivalence
2. Requesting the CAB's accreditation scope documentation (ISO/IEC 17065 certificate)
3. Confirming the CAB's data processing policies for assessment records — specifically whether records can be stored on EU-resident infrastructure

Python Implementation

ThirdCountryCABRecord

from dataclasses import dataclass, field
from datetime import date
from typing import Optional
from enum import Enum

class CABRecognitionStatus(Enum):
    NOT_RECOGNIZED = "not_recognized"       # No Art.39 agreement exists
    AGREEMENT_PENDING = "agreement_pending" # Commission negotiations in progress
    RECOGNIZED = "recognized"              # Art.39 agreement in force, NANDO registered
    SUSPENDED = "suspended"                # Recognition suspended under Art.39(4)
    WITHDRAWN = "withdrawn"                # Recognition withdrawn

class CloudActExposure(Enum):
    NONE = "none"              # EU-based body, no CLOUD Act exposure
    LOW = "low"                # Third-country, non-US jurisdiction
    HIGH = "high"              # US-headquartered entity, CLOUD Act applies

@dataclass
class ThirdCountryCABRecord:
    """
    Records an Art.39-recognized (or candidate) third-country conformity assessment body.
    """
    body_name: str
    country: str
    accreditation_body: str          # e.g. "UKAS", "ANAB", "SAS"
    iso_17065_certificate_number: str
    recognition_status: CABRecognitionStatus
    cloud_act_exposure: CloudActExposure
    nando_registration_number: Optional[str] = None
    agreement_reference: Optional[str] = None    # e.g. "EU-UK MRA 2025/42"
    recognized_annex_iii_categories: list[str] = field(default_factory=list)
    recognized_assessment_procedures: list[str] = field(default_factory=list)
    recognition_valid_until: Optional[date] = None
    records_eu_resident: bool = False    # Whether assessment records are EU-resident
    notes: str = ""

    def is_valid_for_eu_ai_act(self) -> bool:
        return self.recognition_status == CABRecognitionStatus.RECOGNIZED

    def cloud_act_risk_summary(self) -> str:
        if self.cloud_act_exposure == CloudActExposure.HIGH:
            if self.records_eu_resident:
                return "HIGH exposure: US entity can be compelled to produce records regardless of storage location (18 U.S.C. § 2713)"
            return "HIGH exposure: US entity, records not confirmed EU-resident"
        if self.cloud_act_exposure == CloudActExposure.LOW:
            return "LOW exposure: Non-US third-country, verify bilateral legal assistance treaty"
        return "NONE: EU-based body, single EU regulatory jurisdiction"

RecognitionAgreementChecker

@dataclass
class AgreementScope:
    agreement_id: str
    third_country: str
    in_force_date: Optional[date]
    annex_iii_categories: list[str]
    assessment_procedures: list[str]    # "annex_vi", "annex_vii", or both
    renewal_date: Optional[date]

class RecognitionAgreementChecker:
    """
    Checks whether a given AI system's conformity assessment can be performed by
    a third-country CAB under an active Art.39 agreement.
    """
    def __init__(self, active_agreements: list[AgreementScope]):
        self.agreements = active_agreements

    def check_coverage(
        self,
        third_country: str,
        annex_iii_category: str,
        procedure: str,
        assessment_date: date
    ) -> dict:
        relevant = [
            a for a in self.agreements
            if a.third_country == third_country
            and annex_iii_category in a.annex_iii_categories
            and procedure in a.assessment_procedures
            and a.in_force_date is not None
            and a.in_force_date <= assessment_date
            and (a.renewal_date is None or a.renewal_date >= assessment_date)
        ]
        if relevant:
            return {
                "covered": True,
                "agreement": relevant[0].agreement_id,
                "valid_until": relevant[0].renewal_date,
                "action": "Verify NANDO registration of specific CAB under this agreement"
            }
        return {
            "covered": False,
            "reason": f"No active Art.39 agreement for {third_country} covering {annex_iii_category} / {procedure}",
            "action": "Use EU-based notified body under Arts.28-37 or Art.38 cross-designation"
        }

# Current state: no active agreements
checker = RecognitionAgreementChecker(active_agreements=[])
result = checker.check_coverage("US", "biometric_identification", "annex_vii", date(2026, 8, 1))
# → covered: False → use EU notified body

Art39ComplianceTracker

@dataclass
class Art39ComplianceStatus:
    """
    Full compliance status for a developer relying on or preparing for Art.39 bodies.
    """
    ai_system_id: str
    preferred_cab: ThirdCountryCABRecord
    fallback_eu_notified_body: str
    annex_iii_category: str
    assessment_procedure: str
    current_agreement_status: CABRecognitionStatus
    cloud_act_risk_accepted: bool = False
    eu_native_records_storage: bool = False
    last_nando_check: Optional[date] = None

    def compliance_verdict(self) -> dict:
        if self.current_agreement_status != CABRecognitionStatus.RECOGNIZED:
            return {
                "verdict": "BLOCKED",
                "reason": "No active Art.39 agreement — third-country CAB cannot issue EU AI Act certificate",
                "action": f"Use fallback EU notified body: {self.fallback_eu_notified_body}"
            }
        if self.preferred_cab.cloud_act_exposure == CloudActExposure.HIGH and not self.cloud_act_risk_accepted:
            return {
                "verdict": "FLAG",
                "reason": "US-headquartered CAB: CLOUD Act exposure for assessment records",
                "action": "Consider EU-based notified body or confirm EU-resident record storage + legal assessment"
            }
        return {
            "verdict": "PASS",
            "cab": self.preferred_cab.body_name,
            "cloud_act_note": self.preferred_cab.cloud_act_risk_summary()
        }

Art.39 vs Art.38: Key Differences

Five Common Mistakes

Mistake 1: Treating ISO/IEC 17065 accreditation as Art.39 equivalence
An Art.39 agreement requires a Commission-level international agreement finding equivalence. A third-country body's ISO/IEC 17065 accreditation is evidence of technical competence but does not substitute for the Commission agreement. Without the agreement, the body has no standing.

Mistake 2: Assuming UK CABs are automatically recognized post-Brexit
The UK's departure from the EU means that UK CABs (BSI Group, LRQA, Intertek UK) are no longer EU notified bodies and cannot perform EU AI Act assessments unless covered by a future Art.39 agreement. An EU-UK mutual recognition agreement for EU AI Act purposes does not yet exist (2026).

Mistake 3: Using Art.38 and Art.39 interchangeably
Art.38 applies to bodies already notified under other EU harmonisation legislation (e.g., MDR). Art.39 applies to third-country bodies. An EU-based body notified under MDR can use Art.38 for AI Act assessments immediately. A UK-based body notified under UK MDR cannot — it needs Art.39.

Mistake 4: Ignoring CLOUD Act exposure in body selection
Developers often select a CAB based on technical competence and geographic proximity. The CLOUD Act analysis — does the CAB have US nexus? Are assessment records subject to US compelled disclosure? — is routinely omitted. For IP-sensitive AI systems, this is a material compliance gap.

Mistake 5: Not monitoring NANDO for Art.39 recognition changes
Art.39(4) allows suspension or withdrawal. A certificate issued by an Art.39 body remains valid after suspension, but the developer cannot renew it with the same body. Regular NANDO monitoring (quarterly at minimum) is required to detect changes before they affect the renewal timeline.

30-Item Art.39 Compliance Checklist

Awareness and Monitoring

• 1. Subscribed to Commission notifications for new Art.39 international agreements
• 2. NANDO monitored quarterly for third-country body registrations
• 3. Art.39 agreement landscape reviewed at each product release cycle
• 4. Legal team briefed on Art.39 vs Art.38 distinction
• 5. Fallback EU notified body identified for each high-risk AI system

Third-Country CAB Due Diligence

• 6. Preferred third-country CAB's country confirmed (EU, UK, US, Swiss, etc.)
• 7. ISO/IEC 17065 accreditation certificate reviewed and in scope
• 8. CAB's national accreditation body is IAF member
• 9. CAB's NANDO registration verified (if recognized under Art.39 agreement)
• 10. NANDO recognition scope confirms your Annex III category is covered
• 11. NANDO recognition scope confirms applicable assessment procedure (Annex VI/VII)
• 12. Agreement validity period and renewal date noted in compliance calendar

CLOUD Act Analysis

• 13. CAB's place of incorporation confirmed (EU vs non-EU vs US)
• 14. CLOUD Act applicability assessed (US entity = high exposure)
• 15. Assessment record storage location confirmed
• 16. Legal assessment of CLOUD Act compellability documented
• 17. EU-native record storage option evaluated and documented
• 18. IP-sensitivity of assessment records assessed (architecture, training data, test results)
• 19. CLOUD Act risk acceptance documented with legal sign-off if proceeding with US CAB

Assessment Scoping

• 20. Assessment scope aligned with recognized Annex III categories under agreement
• 21. Assessment procedure (Annex VI or VII) confirmed within Art.39 scope
• 22. Substantial modification protocol defined (new assessment required under Art.3(23))
• 23. Art.38 cross-designation possibility evaluated (if AI system subject to MDR/Machinery/RED)
• 24. Third-country pre-assessment scope defined as supplementary evidence for EU body

Certificate and Documentation Chain

• 25. Certificate reference includes NANDO registration number and agreement reference
• 26. EU declaration of conformity (Art.48) references Art.39 body certificate correctly
• 27. CE marking affixed after certificate issued (Art.49)
• 28. EU database registration completed post-CE marking (Art.32)
• 29. 10-year record retention plan covers Art.39 body assessment records (Art.18)
• 30. Suspension contingency plan documented (alternative EU notified body + transition timeline)

Key Takeaways

1. Art.39 is not yet operational (2026): No Commission international agreements have been concluded. Only EU-based notified bodies (Arts.28–37) and Art.38-eligible cross-designated bodies can perform EU AI Act assessments today.

2. US-headquartered CABs carry CLOUD Act risk: Even when Art.39 agreements are concluded, assessment records held by US entities remain subject to US CLOUD Act compellability. For IP-sensitive AI systems, EU-based bodies are preferable.

3. Art.38 is the practical alternative now: If your AI system is subject to MDR, Machinery Regulation, or RED, the body notified under those regulations may already qualify for EU AI Act assessment via Art.38 cross-designation — no Art.39 agreement required.

4. Monitor NANDO actively: Future Art.39 agreements will register recognized third-country bodies in NANDO. Quarterly monitoring ensures you detect new options and suspension events before they impact your compliance timeline.

5. Prepare pre-assessments now: Engage your preferred third-country CAB for technical pre-assessments that can be incorporated as supplementary evidence into an EU notified body's formal assessment — reducing duplication when Art.39 agreements are eventually concluded.