In late January 2027 a Series-D medtech provider building an Annex III biometric-categorisation system for clinical-trial recruitment opened the engagement letter from the third-largest notified body designated under EU AI Act Article 31 and read a single line that compressed the rest of its quarter: "Available Module H slot: Q1 2028, earliest." Eleven months. Past the Dec 2, 2027 Annex III deadline. The provider had started the conversation in October 2026, fifteen months out, by their reckoning early. They were wrong by ten months. By Q1 2027 every Article 31 notified body in Europe had a waitlist measured in quarters, the four largest had stopped quoting on inbound for biometric and critical-infrastructure scope. This lesson is the playbook the medtech provider should have run from Q2 2026: select a designated notified body under Article 31, prepare for the Annex VII Module H quality-management-system and technical-documentation review, walk Day 1-5 of the on-site audit, manage critical / major / minor findings, close the conformity loop through the Article 47 declaration, Article 71 EU database registration, and CE marking, and pair the engagement with ISO 42001 Stage 2 so one binder serves both. The cost of getting this right in 2026-2027 is an audit slot. The cost of getting it wrong is a deployment ban under Article 99 and a market the competition reaches first.

Why Notified Body Capacity Is the 2026-2027 Bottleneck - Article 31 Designations and the Omnibus VII Deadline Compression

The notified-body capacity squeeze is the single most under-priced operational risk facing Annex III high-risk providers in 2026. Article 43(1) requires conformity assessment with notified-body involvement for two pathways: Annex III point 1 (remote biometric identification, emotion-recognition, biometric categorisation) by default; and any Annex III system where the provider has not fully applied harmonised standards (Annex VII Module H mandatory). For Annex I-listed product-AI under Article 43(3) (machinery, medical devices, IVDs, lifts, pressure equipment, radio equipment), the existing sectoral notified-body framework applies with AI Act overlays. Both routes funnel into the same finite pool.

The supply problem is structural. As of May 2026 the European Commission's NANDO database lists approximately ten notified bodies formally designated under Article 31 for AI Act scope: TÜV SÜD, TÜV Rheinland, DEKRA, BSI Assurance UK (operating EU subsidiary), DNV, Bureau Veritas, KIWA, SGS, AFNOR Certification, plus sector-specific bodies designated under product-legislation overlap. The same firms dominate the Medical Device Regulation (MDR), Machinery Regulation, Radio Equipment Directive, and Construction Products Regulation. AI Act work is additive to existing MDR / MR / RED backlog, not a replacement market.

Demand has compressed onto two cliffs. Omnibus VII (political agreement May 7, 2026) moved Article 6/Annex III high-risk enforcement to Dec 2, 2027 for the stand-alone Annex III categories. The Annex I product-extension wave was pushed to Aug 2, 2028. First-wave audit-demand peak Q3-Q4 2027; second peak Q2-Q3 2028. Article 50(2) transparency-marking enforcement accelerated to Dec 2, 2026 (Omnibus VII); GPAI Article 50 enforcement remains Aug 2, 2026 unchanged.

The numbers compound. A single Module H audit for a high-risk Annex III system requires ~15-25 auditor-days for first-time certification at a mid-size provider. With ten designated bodies and ~20 senior AI Act-competent auditors per body in 2026 (the supply of auditors with combined ISO/IEC 17021-1 / ISO/IEC 17065 conformity-assessment experience and meaningful AI / ML / data-governance depth is the binding constraint), the EU has capacity for ~3,000-4,500 first-time certifications per year. The European Commission's May 2024 impact-assessment estimate put the Annex III high-risk population at 5,000-15,000 systems. A 3x demand overhang against a 12-month window arriving Dec 2, 2027 is the math providers face.

Three operational consequences follow. First, slot scarcity is worsening monotonically. Providers engaging in Q1 2026 are quoting Stage 2 audits Q2-Q3 2027, slots that close certification before the deadline. Providers engaging in Q4 2026 are quoting Stage 2 audits Q1-Q2 2028, past the deadline. Second, scope match is non-negotiable. A notified body designated for Annex III point 4 (employment) cannot certify against Annex III point 5 (essential services) without supplementary designation; NANDO verification before engagement is mandatory. Third, fees are conditional on scope, sector, and language. Mid-market initial-certification fees for a single Annex III Module H engagement run €120K-€350K in 2026 (vs. ~€60K-€180K for ISO 42001 alone), with surveillance at 30-50% annually. Operating evidence in the notified-body home language avoids translation surcharges of €15K-€40K.

The playbook operationalizes early engagement, the medtech provider in the opening should have started Q2 2026, not Q4 2026. The first three months (T-18 to T-15) are the difference between a Q2 2027 slot and a Q1 2028 slot.

The 18-Month Notified Body Engagement Timeline - From Selection to CE Marking

Notified-body engagement is not a procurement transaction; it is an 18-month operating sequence that braids selection, contracting, documentation readiness, pre-audit, ISO 42001 Stage 2, the Annex VII Module H audit itself, findings management, the conformity loop, and surveillance scheduling. The sequence below is the playbook a 2026-2027 provider should run to land certification before the Dec 2, 2027 Annex III deadline.

T-18 Months - Notified Body Selection (Q2 2026 for Dec 2, 2027 Deadline)

Selection is the highest-leverage decision. Five criteria. Designation scope: verify against NANDO that the body is designated for the specific Annex III point or Annex II-section-A category in scope. A body designated for Annex III point 1 (biometric ID) cannot certify Annex III point 6 (law enforcement) without separate designation. Sector competence: lead auditors must combine ISO/IEC 17021-1, ISO/IEC 17065, and meaningful AI / ML / data-governance depth: verifiable by CVs, references, and Annex VII point 2.3 designation evidence. Availability: written confirmation of Stage 1 and Stage 2 slot dates closing certification before the deadline. Language and geography: home country and working language drive translation cost and review efficiency. Fee and surveillance schedule: written proposal covering Stage 1, Stage 2, certificate issuance, surveillance Years 1-2, recertification Year 5. The 2026 mid-market range is €120K-€350K initial, 30-50% surveillance.

The selection artifact is a comparison matrix scoring three-to-five candidate bodies across the five criteria, signed by the Responsible AI Officer, Head of Quality / Regulatory Affairs, and General Counsel. A defensible matrix names each body, NANDO designation number, scope-match assessment, lead-auditor CV summary, earliest Stage 2 slot, fee range, surveillance cadence, and language/geography fit. Filed as evidence the selection was deliberate.

T-15 Months - Pre-Engagement (NDA, Scope Discussion, Fee Proposal)

Pre-engagement converts shortlist to contracted engagement. The provider issues a mutual NDA, shares an engagement-scope summary (system identification, intended purpose under Article 3(1), risk classification rationale, Annex III point or Annex II section, deployment geography, expected user population), and requests a formal fee proposal. The body conducts initial scope review (1-2 hours auditor time) to validate fit and quote. The written engagement proposal names Stage 1 / Stage 2 dates, scope, deliverables, fees, surveillance cadence, dispute-resolution, certificate-scope template, and termination terms. Negotiate slot dates aggressively; once counter-signed the slot is held.

T-12 Months - Formal Contract Signing and Pre-Audit Findings on Documentation Readiness

Contract signing binds the commitment. The engagement letter names the system in scope, the conformity-assessment route (Annex VII Module H for stand-alone Annex III; sectoral module for Annex I product-extension), Annex IV §1-§9 documentation expectations, Article 17 ten-sub-area QMS expectations, Stage 1 / Stage 2 dates, deliverables, fee schedule, and certificate scope. The body then conducts a pre-audit documentation-readiness review: paper assessment of the technical-file draft, QMS documentation, and SoA. Outputs are an early-findings report identifying gaps to close before Stage 1. The provider gets six months to close gaps before the formal audit cycle, a buffer most first-time providers underestimate.

T-9 Months - Documentation Readiness Drive (ISO 42001 Stage 1 in Parallel)

T-9 months is the documentation-readiness drive. The provider closes pre-audit findings and completes: Annex IV technical file v0.9; Article 17 QMS documentation v0.9; ISO 42001 SoA for 38 Annex A controls; Article 9 AI risk assessment and risk-treatment plan; Article 27 FRIA where applicable; Article 72 post-market monitoring plan; Article 73 incident-response procedure. ISO 42001 Stage 1 documentation review runs in parallel: Schellman, A-LIGN, BSI, or KPMG audit the AIMS against ISO/IEC 42001:2023 Clauses 4-10 and Annex A. Cross-walked documentation means Annex IV and the ISO 42001 SoA share substantial overlap (A.6.1.6 documentation, A.7 data, A.8 user information), a single binder serves both if cross-references are explicit.

T-6 Months - Technical-File Submission v0.9 and Notified-Body Pre-Audit

T-6 months is the technical-file submission. The provider submits Annex IV v0.9 to the notified body for pre-audit review: auditors paper-review the technical file, AIMS/QMS documentation, SoA, FRIA, risk assessment, post-market plan, and incident procedure. Outputs are a pre-audit findings memo. The provider has three months to close gaps before on-site Stage 2. This is the last formal gate; gaps not closed here become Stage 2 findings.

T-3 Months - ISO 42001 Stage 2 + Annex VII Module H Audit (Coordinated)

T-3 months is the coordinated audit window. ISO 42001 Stage 2 (8-15 days auditor effort over 3-6 weeks elapsed) runs first, producing the ISO 42001 certificate. Annex VII Module H follows immediately or in parallel: many notified bodies offer combined engagement when the same firm holds both designations (BSI, DEKRA, TÜV SÜD's certified-management-systems and product-certification arms). Cross-walked evidence is key (A.6.1.5 ↔ Article 72; A.6.1.6 ↔ Annex IV; A.6.1.7 ↔ Article 12). A single binder, clearly cross-referenced, halves preparation effort vs. parallel binders.

T-0 (Deployment): Article 47 Declaration, Article 71 Registration, CE Marking

T-0 is the deployment moment. The notified body issues the certificate (typically 30-90 days post-Stage 2, longer if findings remediation needed). The provider signs the Article 47 Declaration of Conformity by an authorized person (typically CEO or Chief Quality Officer) referencing the certificate number, Annex IV technical file, QMS, FRIA, and harmonised-standard cross-walks (CEN-CENELEC JTC 21 finalization expected Q4 2027 / Q1 2028). Registers the system in the Article 71 EU database for high-risk AI systems: public-facing entry naming provider, system, intended purpose, certificate, deployment geography. Applies the CE marking. Article 47 declaration retained for ten years; Article 71 entry kept current via Article 43(4) substantial-modification updates.

The Annex VII Module H Audit Walk - Day-by-Day Through the On-Site Sequence

Annex VII Module H ("full quality assurance") combines QMS audit (Article 17 + ISO 42001) with technical-documentation audit (Annex IV §1-§9). It is the most demanding conformity-assessment module and the default for Annex III stand-alone high-risk systems where the provider has not fully applied harmonised standards. The on-site phase runs five days for a mid-size first-time provider.

Day 1-2 - QMS Audit (Article 17 Ten Sub-Areas)

Days 1-2 cover the QMS audit. The lead auditor and co-auditors interview the Responsible AI Officer, Head of Quality / Regulatory Affairs, AI Risk Officer, engineering leads, and the designated Article 17(1)(k) QMS person. The audit walks all ten Article 17 sub-areas: (a) compliance strategy; (b) design and development procedures, SDLC, responsible-AI-by-design checklist, design-review records; (c) examination, test, and validation procedures, V&V plan, evaluation suites, accuracy/robustness/bias results, sign-off; (d) data governance (Article 10), training-data inventory, source, quality framework, provenance, bias-examination; (e) post-market monitoring (Article 72), monitoring dashboard, drift-detection, performance monitoring, review cadence; (f) incident-reporting (Article 73), classification rubric (15-day standard / 2-day critical-infrastructure widespread / 10-day serious-and-irreversible disruption), workflow, templates; (g) communication with regulators, designated point of contact, log, regulator-engagement evidence; (h) record-keeping, Article 12 logging architecture, retention, integrity; (i) resource management, AI-role headcount, AI-literacy records (Article 4 deployer literacy), competency, budget; (j) accountability, Responsible AI Officer designation, reporting line, halt authority.

Day 3-4 - Technical-File Audit (Annex IV §1 through §9)

Days 3-4 cover the technical-documentation audit, walking Annex IV section-by-section. §1 General description: system identification, intended purpose, version, provider details, hardware/software environment. §2 Detailed description: (a) methods and steps for development; (b) design specifications including general logic, key design choices, rationale, assumptions, trade-offs; (c) system architecture; (d) data requirements covering data sets, design choices, provenance, scope, characteristics, collection, labelling, cleaning; (e) human oversight measures and interpretation aids; (f) predetermined changes and performance metrics; (g) validation and testing procedures with metrics for accuracy, robustness, and Articles 9-15 compliance; (h) cybersecurity measures. §3 Monitoring, functioning, control: capability and performance, accuracy metrics, foreseeable unintended outcomes, human oversight, output interpretation, input-data specifications. §4 Description of changes. §5 Harmonised standards applied. §6 Declaration of conformity preparation. §7 Post-market monitoring plan: Article 72 with collection methodology, analysis, corrective-action triggers. §8 Cross-walked frameworks. §9 GPAI model integrated: model card, Annex XII receivable, Article 53/55 obligations. Deepest sampling: §2(b), §2(d), §2(e), §2(g), §3, §7.

Day 5 - Findings Review with Provider

Day 5 is the findings-review session. The lead auditor presents preliminary findings classified as critical / major / minor / OFI with the Responsible AI Officer, Head of Quality, and General Counsel present. The provider clarifies, presents additional evidence, and contests classifications. Outputs are the preliminary findings memo (formalized within 2-4 weeks) and remediation timeline. The audit closes; certification decision follows findings closure.

Common Annex VII Module H Findings - The Six Patterns Auditors Flag Most

By Q4 2026 the first wave of completed Module H audits (~50-150 providers globally) has produced a recognizable pattern. The six most common findings, mapped to Annex IV sections and remediation approach:

Finding 1 - Annex IV §2(b) Design Specification Gaps (Model Card Depth Insufficient)

The most common Module H finding is shallow design-specification documentation. The auditor expects the technical file to justify why each design choice was made, general logic, key design choices, rationale, assumptions, trade-offs, not just describe what the system does. A model card listing architecture (transformer, layers, parameters) without rationale fails. Remediation: expand the model card with a rationale-and-trade-offs section per design decision; reference design-review records and ARB minutes; cite ISO 42001 A.6.1.2 evidence as cross-walk support.

Finding 2 - Annex IV §2(d) Data Governance Gaps (Bias Examination Weak)

The second-most-common finding is weak data governance, particularly insufficient bias examination under Article 10(2)(f) and 10(3). The auditor expects documented bias-examination methodology, results across protected attributes (where collectable), mitigation steps, and residual-risk acceptance. Generic "we tested for bias" without methodology, sample sizes, or statistical tests fails. Remediation: bias-examination report with named methodology (disparate-impact ratio, equal-opportunity-difference, equalized-odds), sample sizes, statistical tests, results, mitigation, residual-risk acceptance signed by the Responsible AI Officer; cross-walk to ISO 42001 A.7.4 and A.5.4.

Finding 3 - Annex IV §2(e) Human Oversight Gaps (Vague Oversight Design)

The third pattern is vague human oversight under Article 14. The auditor expects specific measures: who oversees, what, how, with what tools, how to intervene, what training, what sample rate. "Human-in-the-loop" without specification fails. Remediation: oversight-design document naming roles, scope, tools, intervention pathway, training, sample rate, escalation; cross-walk to ISO 42001 A.9.2 and Article 26.

Finding 4 - Annex IV §2(g) Validation Gaps (Red-Team Coverage Thin)

The fourth pattern is thin validation, particularly for adversarial robustness and red-team coverage. The auditor expects evaluation suites covering accuracy (Article 15), robustness (adversarial inputs, distribution shift, edge cases), and cybersecurity. Red-team evidence is expected for generative or interactive systems; OWASP LLM Top 10 and MITRE ATLAS are the de facto reference. Remediation: V&V report covering accuracy on test set, robustness on perturbation suite (1,000+ adversarial examples), red-team report covering OWASP LLM Top 10 with named attack categories, success rates, mitigations; cross-walk to ISO 42001 A.6.1.3 and NIST AI RMF Measure 2.

Finding 5 - Article 9 Risk Management Gaps (Residual Risk Acceptance Vague)

The fifth pattern is vague residual-risk acceptance under Article 9. The auditor expects the risk register to identify residual risks (post-mitigation), classify by severity and likelihood, document acceptance rationale, and name the accepting authority. "Risk accepted" without rationale and signatory fails. Remediation: risk register naming each residual risk, classification, mitigation history, acceptance rationale, signatory (Responsible AI Officer for medium; CEO or board for high); cross-walk to ISO 42001 Clauses 6.1.2/6.1.3 and ISO/IEC 23894:2023.

Finding 6 - Article 72 Post-Market Monitoring Gaps (Drift Detection Incomplete)

The sixth pattern is incomplete post-market monitoring, particularly drift detection. The auditor expects a plan covering data collection, performance monitoring, drift detection (input, prediction, concept drift), incident detection, corrective-action triggers, and review cadence. A plan without drift methodology fails. Remediation: post-market monitoring plan with metrics, thresholds, detection methodology (KS test for input drift; PSI for prediction drift; performance-decay tracking for concept drift), triggers, escalation, review cadence (monthly engineering; quarterly executive); cross-walk to ISO 42001 A.6.1.5 and NIST AI RMF Measure 3 + Manage 4.

Findings Management - Critical / Major / Minor Classification and Remediation

Module H findings are classified at the audit closure. The classification drives the deployment timeline, remediation effort, and certificate conditionality. Understanding the classification system is essential to managing the conformity loop.

Critical Findings - Deployment Blocked Until Remediated

Critical findings ("blocking nonconformities") indicate failure of a fundamental Article 16 requirement; the system cannot be deployed. Examples: prohibited-use-case overlap with Article 5; systemic failure of Article 9 risk management; absence of Article 14 oversight for a system that requires it; complete absence of an Annex IV §2 design specification. Remediation: full redesign or feature removal; re-audit required; no certificate until closed and verified. Timeline: 3-12 months depending on scope.

Major Findings - Remediation Plan Required; Certificate Conditional

Major findings are significant gaps that materially affect conformity but do not block deployment outright. Examples: shallow §2(b) rationale; weak §2(d) bias; vague §2(e) oversight; thin §2(g) red-team; vague Article 9 residual-risk acceptance; incomplete Article 72 drift detection. Remediation: documented plan with milestones, 30-90 day window before certificate issuance; certificate issued conditionally on remediation evidence verified at first surveillance.

Minor Findings - Corrective Action with Timeline

Minor findings indicate gaps that do not materially affect conformity but require improvement. Examples: documentation formatting; cross-reference inconsistencies; missing audit-trail entries on edge cases; outdated regulator-contact details. Remediation: corrective-action plan with named owner and timeline (typically 90-180 days); verified at first annual surveillance audit. Does not affect certificate issuance. The provider should treat minor findings as a backlog to manage between surveillance audits, not as an immediate deployment blocker.

Opportunity for Improvement (OFI) - Optional Enhancement

OFIs are auditor observations that fall short of nonconformity but suggest enhancement. The provider can address or defer; OFIs do not affect certification but accumulate into improvement debt over surveillance cycles. A defensible practice is to treat OFIs as a Year-1 surveillance backlog and close 70%+ by Year 2.

Closing the Conformity Loop - Article 47, Article 71, CE Marking, Surveillance Schedule

Certificate issuance is the start of the conformity loop, not the end. Five operational steps close the loop and establish the ongoing conformity posture.

Step 1 - Remediation Evidence Delivery and Re-Audit (If Required)

For any critical or major findings, the provider delivers remediation evidence (updated documentation, new test results, signed acceptance memos, training records, process updates) per the agreed timeline. Critical findings trigger a re-audit (typically 3-10 auditor-days on-site, focused on remediated areas). Major findings are verified by paper review of the remediation evidence package and confirmation at the first surveillance audit. Minor findings are recorded for verification at surveillance. The notified body issues a remediation acceptance memo confirming the conditional certificate becomes unconditional (or remains conditional pending surveillance verification).

Step 2 - Certificate Issued (30-90 Days Post-Audit)

The certificate is issued in the notified body's standard format, naming the provider, the system, the certificate number, the conformity-assessment route (Annex VII Module H), the scope, the issue date, the validity period (typically 3-5 years), the surveillance cadence, and the conditions (if any). The certificate is the artifact the provider then uses to support Article 47 declaration and Article 71 registration.

Step 3 - Article 47 Declaration of Conformity Signed by Authorized Person

Article 47 requires the provider to draw up a written EU declaration of conformity for each high-risk AI system, kept at the disposal of national competent authorities for ten years post-placement. The declaration names the system, intended purpose, conformity-assessment procedure followed (Module H), reference to harmonised standards applied (where applicable), reference to common specifications applied (where applicable), name and address of the notified body, certificate number, place and date of issue, and signature of the authorized person. The authorized person is typically the CEO, Chief Quality Officer, or designated regulatory-affairs lead with explicit authority to bind the company on conformity. The declaration is held; it does not need to ship with the system but must be available on request.

Step 4 - Article 71 EU Database Registration

Article 71 requires the provider to register the high-risk AI system in the EU database for high-risk AI systems before placing the system on the market or putting it into service. The registration is a public-facing entry naming the provider, the system identifier, the intended purpose, the certificate, the deployment geography, and the status. The EU database is operated by the European Commission and accessible to national competent authorities, the AI Office, and (in part) the public. The registration must be kept current, substantial modifications under Article 43(4) trigger registration update.

Step 5 - CE Marking Application

Article 48 requires the CE marking to be affixed visibly, legibly, and indelibly to the high-risk AI system (or, where this is not possible due to system characteristics, to its packaging and accompanying documentation). The CE marking signals conformity with the AI Act and any applicable harmonised standards. The notified body identification number must accompany the CE marking. For embedded AI in regulated products (Annex I), the existing CE marking under the relevant sectoral legislation incorporates AI Act conformity.

Step 6 - Surveillance Audit Schedule Established (Typically Annual)

The certificate validity period is supported by annual surveillance audits (typically 30-50% of Stage 2 effort), focused on continued operating effectiveness, prior-finding remediation verification, and any substantial modifications under Article 43(4). At the end of the validity period (Year 3-5 depending on the body), a recertification audit (60-80% of Stage 2 effort) renews the certificate for the next cycle. The surveillance cadence is a contractual commitment; missing a surveillance window invalidates the certificate.

Coordinating ISO 42001 Stage 2 with Module H - One Binder, Two Audits

The most operationally consequential decision in the 18-month sequence is whether to coordinate the ISO 42001 Stage 2 audit with the Module H audit. Coordination produces cross-walked evidence efficiency that halves preparation effort and reduces auditor-day cost by 20-35%. The mechanics are straightforward; the discipline required to execute is real.

Firms That Do Both - Schellman, A-LIGN, BSI, KPMG, Plus DEKRA / TÜV SÜD Subsidiaries

Four ISO 42001 certification bodies (Schellman, A-LIGN, BSI, KPMG) hold or are pursuing Article 31 notified-body designation in EU subsidiaries. BSI Assurance UK operates a designated EU subsidiary in the Netherlands. Schellman and A-LIGN are pursuing designation through European partnerships. DEKRA and TÜV SÜD operate large ISO 42001 practices alongside their notified-body designations, for a German-headquartered medtech provider, engaging DEKRA or TÜV SÜD for both is the natural consolidation. KPMG's Big-4 model offers advisory-to-certification-to-notification integration in markets where it holds notified-body designation. For a U.S. tech provider with EU customer base, the typical 2026-2027 consolidation is BSI for both ISO 42001 and Module H; for a European medtech, DEKRA or TÜV SÜD for both. Engaging different firms for each audit is operationally viable but loses the cross-walk efficiency.

Audit-Walk Efficiency Through Cross-Walked Evidence

The cross-walks that drive the efficiency:

• ISO 42001 A.6.1.5 operation and monitoring ↔ Article 72 post-market monitoring plan: same dashboard, same drift methodology, same review cadence.
• ISO 42001 A.6.1.6 technical documentation ↔ Annex IV §1-§9 technical file: same model card, system card, data card.
• ISO 42001 A.6.1.7 event logs ↔ Article 12 automatic logging: same logging architecture, retention, integrity.
• ISO 42001 A.7 data ↔ Article 10 data and data governance: same training-data inventory, quality framework, provenance, bias examination.
• ISO 42001 A.8.4 communication of incidents ↔ Article 73 serious-incident reporting: same incident-classification rubric, notification workflow, regulator-contact log.
• ISO 42001 A.5 impact assessment ↔ Article 27 FRIA, same impact-assessment artifact (where deployer-also-provider).
• ISO 42001 A.10 third-party and customer ↔ Article 25 value chain + Annex XII GPAI receivable: same supplier inventory, due-diligence, contractual flow-down.
• ISO 42001 Clauses 6.1.2 / 6.1.3 ↔ Article 9 risk management: same risk register, methodology (ISO/IEC 23894:2023), treatment plan.

Single Binder Architecture - Write Once, Cite Twice

A defensible single-binder architecture stores each cross-walked artifact once in a master AIMS / QMS portal with explicit dual-framework cross-references. The Annex IV technical file is the master technical document; the ISO 42001 SoA references Annex IV sections as evidence. The Article 72 post-market monitoring plan is the master monitoring document; ISO 42001 A.6.1.5 references the plan. The Article 73 incident-response procedure is the master incident document; ISO 42001 A.8.4 references the procedure. The auditor for either framework pulls evidence from the same binder; cross-references make the dual-framework structure visible. The discipline required: when an artifact is updated, both framework cross-references must be re-validated. Operationally this is a quarterly walk-through of the cross-reference matrix by the AIMS / QMS owner.

Six Common Notified Body Engagement Mistakes

Mistake 1 - Late Notified Body Engagement (Hitting the Capacity Wall)

The most common and most consequential mistake is engaging the notified body too late. Providers engaging in Q4 2026 for a Dec 2, 2027 deadline are quoting Stage 2 audits Q1 2028 / Q2 2028, past the deadline. The capacity wall is real; demand will not magically materialize the supply. Fix: engage Q2 2026 for a Q3 2027 Stage 2 audit and Q4 2027 certificate. The 6-month early-engagement premium is the difference between meeting the deadline and missing it. Treat notified-body slot reservation as the binding constraint in the program plan; everything else can be re-sequenced around it.

Mistake 2 - Wrong Notified Body Scope (Designation Mismatch)

The second mistake is engaging a body whose designation does not cover the in-scope Annex III point or Annex II section. A body designated for Annex III point 1 (biometric ID) cannot certify Annex III point 4 (employment) without separate designation. The provider discovers the mismatch at Stage 1 or worse, at Stage 2 closure when the certificate cannot be issued. Fix: download the body's NANDO entry as the first selection artifact; verify scope match line-by-line; obtain written scope confirmation in the engagement letter. The provider's General Counsel should sign off on scope match before contract signing.

Mistake 3 - Weak Pre-Audit (Skipping the T-6 Month Gate)

The third mistake is treating the T-6 month pre-audit as optional and going into Stage 2 with unaddressed gaps. The pre-audit is the last formal gate to surface findings before they become Stage 2 nonconformities. Skipping it or rushing through it converts manageable pre-audit observations into critical / major findings that block or condition the certificate. Fix: invest in the pre-audit; treat it as a 30-day intensive remediation window; close every gap before Stage 2.

Mistake 4 - Siloing Module H from ISO 42001 Stage 2

The fourth mistake is running Module H and ISO 42001 Stage 2 as independent programs with separate binders, separate cross-references, and separate auditors. The result is double evidence cost, duplicate auditor effort, and inconsistent cross-references that the auditor for each framework flags. Fix: design the binder as a single AIMS / QMS portal with explicit dual-framework cross-references; engage a firm that does both where possible; coordinate the audit windows to back-to-back or parallel; produce a single set of artifacts that the auditors for both frameworks pull from.

Mistake 5 - Missing the Surveillance Schedule

The fifth mistake is treating certificate issuance as the finish line and de-prioritizing surveillance. The certificate is conditional on annual surveillance audits; missing a surveillance window invalidates the certificate. Providers that ramp down compliance investment post-certification discover at Year 1 surveillance that the prior 12 months of operating evidence is thin. Fix: schedule the Year 1 surveillance audit at the same time the initial certificate issues; budget for surveillance at 30-50% of initial annually; maintain operating cadence (quarterly committee, monthly control-evidence review, annual internal audit) from Day 1.

Mistake 6 - Weak Closure Documentation (Article 47 / 71 / CE Marking Gaps)

The sixth mistake is rushing the closure steps, Article 47 declaration, Article 71 registration, CE marking, after certificate issuance. A declaration signed by an unauthorized person, a registration entry that does not match the certificate scope, or a CE marking without the notified body identification number creates downstream regulator-facing exposure. Fix: treat closure as a formal sub-project with a named owner (typically Head of Regulatory Affairs); produce a closure checklist covering Article 47 signatory authority, Article 71 registration content match, CE marking placement and notified-body number; verify each item before deployment; retain Article 47 declaration for ten years; keep Article 71 entry current through substantial-modification updates.

Key Takeaways

• Notified-body capacity is the 2026-2027 binding constraint for Annex III high-risk providers. ~10 Article 31-designated bodies (TÜV SÜD, TÜV Rheinland, DEKRA, BSI EU, DNV, Bureau Veritas, KIWA, SGS, AFNOR, plus sector-specific overlap) face ~3,000-4,500 first-time-certification capacity vs. 5,000-15,000 high-risk system population. Demand compresses on Dec 2, 2027 (Annex III stand-alone, post-Omnibus VII) and Aug 2, 2028 (Annex I product-extension). Early engagement wins slots.
• The 18-month engagement timeline runs T-18 selection → T-15 pre-engagement → T-12 contract signing → T-9 documentation readiness (ISO 42001 Stage 1 parallel) → T-6 technical-file submission v0.9 + notified-body pre-audit → T-3 ISO 42001 Stage 2 + Annex VII Module H audit → T-0 Article 47 declaration + Article 71 registration + CE marking + deployment.
• NB selection has five criteria: NANDO-verified designation scope match; sector competence (ISO/IEC 17021-1 + ISO/IEC 17065 + AI / ML / data depth); availability (Stage 2 slot dates closing before deadline); language and geography (translation cost); fee and surveillance schedule (€120K-€350K initial, 30-50% surveillance). The selection matrix is a defensible artifact in itself.
• Annex VII Module H audit walk runs five days on-site: Day 1-2 QMS audit (Article 17 ten sub-areas); Day 3-4 technical-file audit (Annex IV §1-§9 with deep sampling in §2(b) design, §2(d) data, §2(e) oversight, §2(g) validation, §3 monitoring, §7 post-market); Day 5 findings review with provider.
• Six most-common Module H findings: §2(b) design specification gaps (model-card depth insufficient); §2(d) data governance gaps (bias examination weak); §2(e) human oversight gaps (vague oversight design); §2(g) validation gaps (red-team coverage thin); Article 9 risk management gaps (residual-risk acceptance vague); Article 72 post-market monitoring gaps (drift detection incomplete).
• Findings classification drives the deployment timeline: critical findings block deployment until remediated and re-audited (3-12 month timeline); major findings require documented remediation plan with 30-90 day window and conditional certificate; minor findings require corrective action with 90-180 day timeline verified at first surveillance; OFIs are optional enhancements.
• Closing the conformity loop has six steps: remediation evidence + re-audit if needed; certificate issued; Article 47 Declaration of Conformity signed by authorized person (CEO / Chief Quality Officer; held for ten years); Article 71 EU database registration before market placement; CE marking with notified body identification number; surveillance audit schedule established (typically annual, 30-50% of Stage 2 effort; recertification at Year 3-5 at 60-80%).
• Coordinating ISO 42001 Stage 2 with Module H halves preparation effort through cross-walked evidence: A.6.1.5 ↔ Article 72; A.6.1.6 ↔ Annex IV; A.6.1.7 ↔ Article 12; A.7 ↔ Article 10; A.8.4 ↔ Article 73; A.5 ↔ Article 27 FRIA; A.10 ↔ Article 25 + Annex XII; Clauses 6.1.2/6.1.3 ↔ Article 9 (ISO/IEC 23894:2023 methodology). Schellman, A-LIGN, BSI, KPMG, plus DEKRA / TÜV SÜD subsidiaries can do both.
• Single-binder architecture: master Annex IV technical file referenced by ISO 42001 SoA; master Article 72 monitoring plan referenced by A.6.1.5; master Article 73 procedure referenced by A.8.4. Write once, cite twice; quarterly cross-reference walk-through by AIMS / QMS owner.
• Six common engagement mistakes: late engagement (capacity wall); wrong NB scope (designation mismatch); weak pre-audit (skipping T-6 gate); siloing Module H from ISO 42001 (duplicate cost); missing surveillance schedule (certificate invalidation); weak closure documentation (Article 47 / 71 / CE marking gaps).