Source: OJ L, 2024/1689, 12.7.2024

Current language: EN

Article 33 Subsidiaries of notified bodies and subcontracting


Summary What does Article 33 of the AI act regulation say?

This article governs how notified bodies may delegate conformity assessment tasks to subcontractors or subsidiaries.

It builds directly on Article 31, which sets out the requirements that notified bodies themselves must meet, by extending those same standards to any third parties a notified body brings in to assist with its work.

The core thrust is that outsourcing does not dilute accountability — the notified body remains fully responsible for whatever its subcontractors or subsidiaries do.

Important points:

  • Notified bodies retain full responsibility for all conformity assessment tasks, even when subcontracted or delegated to a subsidiary.
  • Subcontracting or use of a subsidiary requires the agreement of the provider, and notified bodies must make a public list of their subsidiaries.
  • Relevant qualification and work documents for subcontractors or subsidiaries must be kept available for the notifying authority for five years from the end of the subcontracting arrangement.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements laid down in Article 31, and shall inform the notifying authority accordingly.

    1. Notified bodies shall take full responsibility for the tasks performed by any subcontractors or subsidiaries.

    1. Activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. Notified bodies shall make a list of their subsidiaries publicly available.

    1. The relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation shall be kept at the disposal of the notifying authority for a period of five years from the termination date of the subcontracting.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod