The Notified Body Bottleneck: Why Waiting Lists Threaten Your August Deadline
A shortage of AI Act-designated notified bodies means waiting lists are forming just as the August 2026 deadline arrives. Here is which high-risk systems can self-assess under Article 43(2), which need a third party, and what to do when you cannot get a slot.
A Capacity Crisis Nobody Planned For
The EU AI Act requires certain high-risk AI systems to undergo third-party conformity assessment by a designated notified body before they can carry CE marking and be placed on the market. The problem: as of mid-2026, the number of notified bodies actually designated for AI Act conformity assessment under Article 31 is a fraction of what the market needs. Designation is slow, accreditation scopes are narrow, and demand is spiking as August 2 approaches.
First: Do You Even Need a Notified Body?
This is the most important — and most misunderstood — question. For the majority of Annex III high-risk systems, the AI Act permits conformity assessment based on internal control under Article 43(2) — meaning you can self-assess against Annex VI without engaging a notified body at all. Third-party assessment (Annex VII) is generally reserved for biometric identification and categorisation systems (unless harmonised standards are fully applied), and AI that is a safety component under sectoral product law follows that legislation's own procedure. The practical takeaway: many organizations panicking about notified body slots do not actually need one.
The Harmonised Standards Wrinkle
Internal control under Annex VI is only fully available when you can demonstrate conformity — most cleanly by applying harmonised standards that confer a presumption of conformity. Several key AI Act harmonised standards have been delayed, so where standards are not yet available, providers must document conformity against the Act's requirements directly and justify their technical choices.
Strategies When You Cannot Get a Slot
Re-confirm you actually need a notified body; cast a wider geographic net, since bodies designated in one Member State can serve providers across the EU; book provisionally now and refine your documentation later, because queue position is the scarce resource; prepare an impeccable technical file to shorten the engagement; and document your good-faith position — application dates, waiting-list confirmations, and interim risk controls — as your defence in an inspection.
What Happens If the Assessment Isn't Done by August 2?
Strictly, a high-risk system requiring third-party assessment cannot be lawfully placed on the market without it. But enforcement is exercised by market surveillance authorities under Article 74, and a provider caught in a documented notified body backlog — with a booked slot and robust interim controls — presents a very different enforcement profile than one that never engaged the process. Evidence of diligence is everything.
The Bottom Line
The notified body bottleneck is real, but for most providers it is also avoidable. Confirm your route under Article 43, apply harmonised standards where you can, and — if you genuinely need a third party — get into the queue immediately and document every step.
Unsure whether your system needs a notified body? Search our directory for conformity assessment specialists who can confirm your route.