In mid-April 2026 Acme Health Solutions's newly appointed CAIO sat with two RFI responses and a decision matrix that refused to resolve. TÜV SÜD's reply quoted a four-month queue for Annex VII Module H first-cycle assessment of Acme.MedAssist v1.0, a clinical-summarization assistant scoped under both Annex III §5 (essential services, healthcare adjacency) and the Medical Device Regulation overlay that pulls Annex I into the conformity-assessment picture. BSI Group's reply quoted a six-month queue, but cited two named lead auditors with prior CE-MDR experience on clinical-decision-support software and a documented ML-competence framework benchmarked against the AI Office's Article 33 designation guidance. Four months earlier, twelve weeks slower, deeper AI competence. Acme.MedAssist v1.0 had a target market entry of Q1 2027; either path closed it in time, but only one closed it defensibly. This lesson is the L4 leadership playbook for notified-body engagement at the organizational tier: when notified-body involvement is mandatory under Article 43(1) + Annex VI Module H, the 2026 designation landscape, the ten-point selection criteria the CAIO defends in board review, the eight-phase engagement lifecycle from prequalification through Article 71 registration, the twelve-document submission package, Stage 1 / Stage 2 mechanics distinct from ISO 42001's stages, the four-tier findings classification and 30-60-90 day closure workflow, surveillance posture, cost and timeline reality, and the worked Acme.MedAssist judgment trail. Lesson 052 walks the practitioner-tier audit week-by-week; this lesson is the leadership decision frame above it.

When Notified-Body Involvement Is Mandatory - Article 43(1), Annex VI Module H, and the 2026 Designation Landscape

Notified-body involvement under the EU AI Act is mandatory in two structurally distinct lanes, and getting the lane wrong is the most expensive selection mistake an organization can make. Lane 1 - Annex III stand-alone high-risk systems. Article 43(1) routes Annex III point 1 (remote biometric identification, emotion-recognition, biometric categorisation) to notified-body involvement by default, and routes Annex III points 2-8 (critical infrastructure, education, employment, essential services, law enforcement, migration, justice) to internal control under Annex VI Module A only where the provider has fully applied harmonised standards or common specifications. Where harmonised standards are not fully applied, the system reverts to Annex VII Module H (full quality assurance) with mandatory notified-body involvement. The shorthand: Annex III point 1 always involves a notified body; Annex III points 2-8 involve one whenever harmonised-standards coverage is incomplete: which, in 2026, is most providers, because CEN-CENELEC JTC 21 harmonised-standard finalization is expected Q4 2027 / Q1 2028. Lane 2 - Annex I product-extension AI. Article 43(3) routes AI embedded in products listed under Annex I sectoral harmonisation legislation (medical devices via MDR/IVDR, machinery via the Machinery Regulation, civil aviation via EASA, automotive type-approval, lifts, pressure equipment, radio equipment, construction products) through the existing sectoral notified-body framework with AI Act overlays. Medical-device AI is the dominant overlay case in 2026: a clinical-decision-support tool scoped under MDR Class IIa or IIb already triggers notified-body involvement under the sectoral framework, and the AI Act layers Article 9-15 substantive requirements plus Annex IV documentation expectations onto the existing CE-MDR conformity pathway.

Acme.MedAssist v1.0 sits squarely in the overlap. The system summarises patient notes for clinical reviewers, Annex III §5 healthcare-adjacency on the AI Act side, MDR Class IIa software-as-medical-device on the sectoral side. Module H is mandatory on both flanks; Annex VI Module A is not available regardless of harmonised-standard coverage, because the sectoral overlay closes that door.

The 2026 designation landscape is still nascent and the leadership team should not assume the supply chain looks like the mature MDR or Machinery Regulation notified-body ecosystem. Member-state designation under Articles 28-39 began in earnest through 2025 following the European Commission's implementing acts on notified-body competence (Article 33), the application and notification procedure (Article 29-30), monitoring of designating authorities (Article 28(3)), peer review (Article 38), and information obligations (Article 36). As of May 2026 the European Commission's NANDO (New Approach Notified and Designated Organisations) database lists approximately ten notified bodies formally designated under Article 31 for AI Act scope. The expected senior tier, TÜV SÜD, TÜV Rheinland, DEKRA, BSI Group (operating its EU subsidiary in the Netherlands post-Brexit), DNV, Bureau Veritas, KIWA, SGS, AFNOR Certification, plus a handful of sector-specific bodies designated for Annex I overlaps, is the same firm-set that dominates MDR, Machinery Regulation, and Radio Equipment Directive work. AI Act designation is additive to existing sectoral backlogs, not a replacement market. The binding-constraint metric for an organization is not how many notified bodies exist; it is how many lead auditors with combined ISO/IEC 17021-1 management-system audit experience, ISO/IEC 17065 product-conformity-certification experience, and meaningful AI / ML / data-governance depth a given body has on staff. In 2026 that number is approximately 15-25 per body, the bottleneck behind every queue.

The Ten-Point Notified-Body Selection Criteria - The Defensible Procurement Frame

Selection is the highest-leverage decision in the engagement lifecycle, and the CAIO defends it twice, once in front of the audit committee at engagement-letter signing and again in the post-market period whenever a regulator asks how the notified body was chosen. A defensible selection frame uses ten weighted criteria scored across three-to-five candidate bodies, signed by the CAIO, Head of Quality / Regulatory Affairs, and General Counsel, and filed as a permanent record alongside the Article 47 declaration. The criteria below are the organizational-tier checklist; the practitioner-tier scoring rubric sits in lesson 052.

Criterion 1 - Member-State Designation Under Articles 28-39. Verify in the European Commission's NANDO database that the body is formally designated for AI Act scope by its home Member State's notifying authority. A body in the late stages of pursuing designation is not the same as a designated body; certificates issued before formal designation are invalid. Download the NANDO entry and file it.

Criterion 2 - Scope of Designation Matches Your Product's Harmonised Law. NANDO entries list designation scope by Annex III point and Annex I sectoral overlap. A body designated for Annex III point 1 (biometric ID) cannot certify Annex III point 5 (essential services, healthcare). A body designated for AI Act stand-alone Module H but not for MDR cannot certify the MDR-overlaid Annex I lane. Acme.MedAssist v1.0 required both AI Act Module H scope and MDR Class IIa scope, only four of the ten designated bodies in May 2026 carry both. General Counsel signs scope-match memo before contract.

Criterion 3 - AI Competence and ML-Specific Auditors. Article 33 requires notified bodies to have personnel with the technical knowledge to perform AI Act conformity assessment. Read the body's Article 33 competence file (available on request as part of prequalification): lead-auditor CVs, ML-specific training records, AI Office guidance interpretation, in-house technical referents for data governance, robustness testing, and post-market monitoring. A body whose competence file lists only ISO/IEC 27001 and ISO 9001 auditors with a one-week AI bridge course is not the same as a body with named lead auditors who hold prior ML-engineering credentials.

Criterion 4 - Sector Specialization. Healthcare-adjacent AI (MDR overlay) is not the same as employment AI is not the same as critical-infrastructure SCADA AI. The body's sector-specific experience compounds: a notified body with ten years of MDR Class IIa software-as-medical-device certification and twenty MDR-scope auditors is a different operating risk profile than one whose AI scope is general. Ask for sector reference lists; obtain three reference-client conversations under NDA.

Criterion 5 - Geographic and Language Coverage. The body's home country drives translation cost and Stage 2 efficiency. Operating evidence (training data inventories, risk register, post-market dashboards, instructions for use) submitted in English to a German-headquartered body adds translation surcharges of €15K-€40K and review delays. Geographic coverage matters for on-site Stage 2, a body with a regional office near the provider's production site reduces auditor travel cost and elapsed time.

Criterion 6 - ISO/IEC 17021 / ISO/IEC 17065 Baseline Accreditation. Article 29(1) requires notified bodies to be accredited by a national accreditation body in compliance with Regulation (EC) No 765/2008. The two applicable accreditation standards are ISO/IEC 17021-1 (requirements for bodies providing audit and certification of management systems, applies to QMS/AIMS audits) and ISO/IEC 17065 (requirements for bodies certifying products, processes, services, applies to the product/system certification side of Module H). A body lacking either accreditation cannot issue valid Module H certificates regardless of designation status. Verify the accreditation certificate scope, validity dates, and accreditation body's signatory status (e.g., DAkkS for Germany, UKAS for the UK / EU-recognised, COFRAC for France, RvA for the Netherlands).

Criterion 7 - Reasonable Fee Schedule. 2026 mid-market initial-certification fees for Module H run €120K-€450K (the upper bound reflects MDR-overlaid Annex I cases like Acme.MedAssist where the sectoral and AI Act audits run concurrently). Surveillance is 30-40% of initial cost annually; recertification at Year 3 (typical certificate validity) is 60-80%. Translation surcharges €15K-€40K. Re-audit on findings closure (if critical) €30K-€80K. Request the full fee schedule covering Stage 1, Stage 2, certificate issuance, Year-1 / Year-2 surveillance, Year-3 recertification, dispute resolution, and substantial-modification re-audit triggers under Article 43(4). A fee proposal missing surveillance or recertification line items is incomplete.

Criterion 8 - Timeline and Queue Length. The single most consequential operational parameter. Request written confirmation of earliest Stage 1 and Stage 2 dates closing the certificate before the provider's commercial milestone. In May 2026, mid-tier bodies are quoting Stage 2 nine-to-fifteen months from contract signing; top-tier bodies for MDR-overlaid scope are quoting twelve-to-eighteen months. The 14-month total engagement runway is the realistic baseline.

Criterion 9 - Reference Clients. Three reference-client conversations under NDA, ideally including one provider in your sector, one provider that received major findings and walked them through closure successfully, and one provider that completed first-cycle surveillance. The reference conversation surfaces what the formal proposal cannot: communication style, auditor consistency between Stage 1 and Stage 2, willingness to engage on technical edge cases, and post-certificate responsiveness.

Criterion 10 - Ongoing Surveillance Posture. The relationship is multi-year; the surveillance posture matters more than the initial-audit posture. Ask: how does the body schedule surveillance, fixed annual or risk-based intervals? How does it handle Article 43(4) substantial-modification notifications, paper review or surveillance re-trigger? What is its policy on certificate suspension during open findings? How does it engage with the Article 71 database, does it confirm registration entries match the certificate scope? A body with mature surveillance discipline reduces the operational drag of the next three-to-five years.

Acme's scoring placed BSI ahead of TÜV SÜD on Criteria 3 (AI competence) and 4 (sector specialization, more MDR Class IIa SaMD reference clients), TÜV SÜD ahead on Criteria 5 (geographic, Munich office near Acme's Frankfurt site) and 8 (timeline, four-month-shorter queue), tied on 1, 2, 6, 7, 9, 10. The CAIO weighted Criteria 3 and 4 at 1.5x, defensible AI competence drives the post-market relationship, and selected BSI. The 12-week queue penalty was absorbed by accelerating internal documentation readiness.

The Eight-Phase Engagement Lifecycle - From Prequalification to Article 71 Registration

The engagement runs in eight phases over 9-15 months for first-cycle Module H. The phase boundaries are operational gates that the CAIO defends in the program plan and that the audit committee tracks at quarterly cadence.

Phase 1 - Prequalification and Request for Information (Weeks 0-4). The provider issues an RFI to three-to-five shortlisted notified bodies covering: company profile, in-scope AI system, intended purpose under Article 3(1), preliminary risk-tier classification, Annex III point or Annex I sectoral overlap, deployment geography, expected user population, regulatory deadline, RFI response window (typically two weeks). The body returns an indicative scope confirmation, designation-scope match memo, timeline estimate, fee range, and named lead-auditor candidates. RFI responses get scored against the ten-point criteria; shortlist narrows to two.

Phase 2 - Scope Definition (Weeks 4-6). Mutual NDA, kick-off scope-definition meeting (1-2 hours auditor time). The provider walks the system architecture, intended purpose, claimed risk-tier, harmonised-standards application, and proposed conformity-assessment route (Module H stand-alone Annex III; Module H + sectoral overlay; sectoral with AI Act layer-on). The body validates scope, flags scope-definition ambiguities, and produces a formal engagement-scope memo. Disputed scope (e.g., is the system a high-risk AI system at all? does the sectoral overlay actually apply?) gets resolved here, not later. Acme.MedAssist's scope-definition meeting confirmed Annex III §5 healthcare-adjacency, MDR Class IIa overlay, and dual-track Module H + MDR conformity-assessment route.

Phase 3 - Contract Negotiation (Weeks 6-10). The body issues a formal engagement proposal naming Stage 1 / Stage 2 dates, deliverables, fees, surveillance cadence, dispute-resolution mechanism, certificate-scope template, termination terms. Negotiation focuses on slot dates (lock the earliest), fee transparency (line-item Year-1 / Year-2 surveillance and Year-3 recertification), substantial-modification re-audit pricing, and findings-closure re-audit pricing. General Counsel reviews indemnification, IP confidentiality, and certificate-suspension clauses. Contract counter-signed; slot becomes binding.

Phase 4 - Document Submission (Weeks 10-20). The provider compiles and submits the twelve-document package (detailed in the next section) for Stage 1 documentation review. Submission format follows the body's template: typically a single binder index with cross-references between Annex IV technical file sections, Article 17 QMS manual chapters, ISO 42001 Annex A controls, and supporting evidence. Document submission is where most first-cycle providers blow timeline: the Annex IV technical file is rarely truly complete and consistent at first attempt, and the body returns a documentation-gap memo before formally accepting the package for Stage 1.

Phase 5 - Stage 1 Documentation Review (Weeks 20-24). The notified body performs full paper review of the submitted package. The deliverable is a Stage 1 report identifying documentation gaps, classified as critical (precludes Stage 2 progression), major (closure required before Stage 2), minor (advisory; can carry into Stage 2), or observation. The Stage 1 audit is typically 5-15 auditor-days of effort over 3-4 weeks of elapsed time. Important distinction from ISO 42001: ISO 42001 Stage 1 also reviews documentation, but ISO 42001 Stage 1 readiness is a much lighter gate. Notified-body Stage 1 under Module H is operationally a comprehensive paper audit against Annex IV §1-§9 and Article 17 ten sub-areas, substantially more rigorous than ISO 42001 Stage 1 readiness review. Increasingly, when the same firm holds both ISO 42001 and notified-body designation (BSI, DEKRA, TÜV SÜD), Stage 1 review can be coordinated to share evidence, but the depth of Module H Stage 1 paper review remains higher.

Phase 6 - Stage 2 On-Site Operating-Effectiveness Audit (Weeks 24-30). Stage 2 is the on-site (or hybrid on-site / remote where the body's policy allows) operating-effectiveness audit. For a mid-size first-cycle Module H engagement the on-site phase runs 5-10 auditor-days; for an MDR-overlaid Annex I case like Acme.MedAssist it runs 8-15 days because the MDR overlay adds clinical-evaluation, post-market clinical follow-up, and PSUR audit threads. The audit follows ISO 19011 audit-guideline methodology: interview-based evidence gathering, document sampling, process observation, control walkthroughs. The day-by-day audit walk is in lesson 052; the organizational-tier view here is that Stage 2 produces a preliminary findings memo within 2-4 weeks of audit closure, formally classified at the closing meeting.

Phase 7 - Findings Closure (Weeks 30-42). Findings classification, corrective-action requests (CARs), root-cause analysis, remediation evidence, effectiveness verification. Detailed below; this is where 30-60-90 day closure plans run.

Phase 8 - Certificate Issuance and Article 71 Registration (Weeks 42-50). The notified body issues the certificate naming provider, system, certificate number, conformity-assessment route, scope, validity period (typically 3 years for Module H with annual surveillance), surveillance cadence, and conditions. The provider then completes downstream closure: Article 47 Declaration of Conformity signed by authorized person (CEO, Chief Quality Officer, or designated regulatory-affairs lead); Article 71 EU database registration before market placement; CE marking with notified body identification number; instructions-for-use and provider-information packs finalized for distribution. Phase 8 closes 9-15 months after Phase 1 RFI dispatch for first-cycle work; faster on subsequent cycles where documentation is mature.

The Twelve-Document Submission Package and Stage 1 / Stage 2 Mechanics

The Stage 1 submission package is the single most consequential operational artifact in the engagement and the most-underestimated by first-cycle providers. The body accepts the package only when documentation is complete, internally consistent, and cross-referenced. The twelve documents below are the AI Act minimum; MDR-overlaid Annex I cases like Acme.MedAssist add clinical-evaluation report, post-market clinical follow-up plan, PSUR, and unique device identification documents on top.

Document 1 - Annex IV Technical Documentation File (§1-§9). The system identification, intended purpose, version, provider details, hardware/software environment (§1); detailed development methods, design specification with rationale, system architecture, data requirements, human oversight, predetermined changes, V&V procedures, cybersecurity (§2); monitoring/functioning/control (§3); description of changes (§4); harmonised standards applied (§5); declaration of conformity preparation (§6); post-market monitoring plan (§7); cross-walked frameworks (§8); GPAI model integrated (§9). The Annex IV file is the master technical document.

Document 2 - Article 17 QMS Manual. The ten sub-area QMS manual covering compliance strategy, design/development procedures, examination/test/validation procedures, data governance, post-market monitoring, incident reporting, regulator communication, record-keeping, resource management, accountability. Article 17(1)(k) names the designated QMS person.

Document 3 - Article 9 Risk-Management Documentation. The risk register identifying foreseeable risks across the system lifecycle, severity/likelihood classification, mitigation history, residual-risk acceptance with named signatory, methodology reference (ISO/IEC 23894:2023 AI risk-management guidance). Cross-walked to ISO 42001 Clauses 6.1.2/6.1.3.

Document 4 - Article 10 Data-Governance Documentation. Training/validation/testing data inventory, source provenance, quality framework, data design choices, examination for bias across protected attributes (Article 10(2)(f), 10(3)), labelling and cleaning procedures, residual-bias acceptance. Cross-walked to ISO 42001 Annex A.7 data controls.

Document 5 - Article 14 Human-Oversight Design. Oversight measures and interpretation aids: who oversees, what, how, with what tools, training, sample rate, intervention pathway, escalation. Not a single line stating "human-in-the-loop"; a documented design with named roles. Cross-walked to ISO 42001 A.9.2 and to Article 26 deployer obligations.

Document 6 - Article 15 Accuracy / Robustness / Cybersecurity Evidence. V&V report covering accuracy on representative test sets, robustness on perturbation suite (1,000+ adversarial examples for generative or interactive systems), cybersecurity threat-model, OWASP LLM Top 10 or MITRE ATLAS coverage where applicable, penetration-test evidence.

Document 7 - Article 13 Instructions for Use. The provider's instructions to deployers covering intended purpose, technical capabilities, human-oversight expectations, limitations, accuracy/robustness/cybersecurity metrics, predetermined changes, complaint-handling, withdrawal procedures.

Document 8 - Article 72 Post-Market Monitoring Plan. Data collection methodology, performance monitoring, drift detection (input drift via KS test; prediction drift via PSI; concept drift via performance-decay tracking), incident detection, corrective-action triggers, review cadence (monthly engineering / quarterly executive). Cross-walked to ISO 42001 A.6.1.5.

Document 9 - Article 43(4) Substantial-Modification Log. Change-control log capturing each post-deployment change, classification (substantial vs. non-substantial), notification to notified body where substantial, re-assessment trigger handling. First-cycle providers submit the log as a v0.9 template; subsequent surveillance audits walk the live log.

Document 10 - Article 47 Declaration of Conformity Drafts. Pre-signature drafts of the EU declaration referencing certificate number (TBD at submission), Annex IV technical file, QMS, FRIA where applicable, harmonised standards applied. Signed at Phase 8 by authorized person; retained ten years.

Document 11 - ML Bill of Materials (CycloneDX 1.7). The machine-learning bill of materials capturing model components, training data references, pre-trained foundation models incorporated, libraries and frameworks, supply-chain provenance. CycloneDX 1.7 (or equivalent SPDX 3.0 ML profile) is the current 2026 reference format the AI Office has signalled support for in Annex IV §2 data and §9 GPAI integration documentation.

Document 12 - Mitchell-et-al. Model Card. The model card following Mitchell et al. (2019) structure: intended use, performance metrics, training data, evaluation data, ethical considerations, caveats and recommendations. The model card sits inside Annex IV §2(b) design specification as the canonical model documentation artifact and cross-walks to the system card and data card for completeness.

Stage 1 mechanics are paper review against this package. The Stage 1 auditor produces a documentation-gap memo within the 5-15 auditor-day window; gaps classified critical require closure before Stage 2 commences; gaps classified major require closure before Stage 2 closing; gaps classified minor can be addressed through the audit cycle. Stage 2 mechanics are on-site operating-effectiveness verification: interviews with the CAIO, Head of Quality / Regulatory Affairs, designated Article 17(1)(k) QMS person, engineering leads, post-market monitoring owner, and incident-response lead; document sampling against the submitted package; process observation of design-review, V&V, post-market monitoring dashboards, incident-response simulations; control walkthroughs. ISO 19011 audit-guideline methodology governs sampling, evidence sufficiency, and reporting. The Stage 2 closing meeting presents preliminary findings; the formal findings memo follows within 2-4 weeks.

Findings Classification and the 30-60-90 Day Closure Workflow

Findings are classified at audit closure into four tiers, and the classification drives the deployment timeline, the corrective-action workflow, and certificate conditionality. The CAIO and Head of Quality manage findings closure as a formal project with named owner, milestones, and audit-committee visibility.

Critical Findings - Precludes Certification. Critical findings indicate failure of a fundamental Article 16 provider obligation: prohibited-use overlap with Article 5; systemic failure of Article 9 risk-management; complete absence of Article 14 human oversight where required; Annex IV §2 design specification absent; sectoral-overlay (e.g., MDR) clinical-evaluation gap. Remediation requires full redesign or feature removal, followed by re-audit (typically 3-10 auditor-days on-site focused on remediated areas). Timeline: 3-12 months. No certificate issued until closed and verified. The audit committee is notified within 5 business days; the board AI committee within the next quarterly cycle.

Major Findings - Closure Required Before Certification. Major findings are significant gaps that materially affect conformity but do not block remediation pathway: shallow Annex IV §2(b) design rationale; weak §2(d) bias examination; vague §2(e) oversight design; thin §2(g) validation; vague Article 9 residual-risk acceptance; incomplete Article 72 drift detection methodology. The provider produces a corrective-action request (CAR) per finding: root-cause analysis, corrective action, effectiveness-verification approach, named owner, target-closure date (typically 30-60 days). The notified body verifies closure through documentary evidence review and confirms certificate issuance. Certificate is sometimes issued conditionally on first-surveillance verification.

Minor Findings - Closure Within Reasonable Timeframe. Minor findings indicate gaps requiring improvement but not materially affecting conformity: documentation formatting inconsistencies; cross-reference errors between Annex IV and QMS manual; missing audit-trail entries on edge cases; outdated regulator-contact details. CAR workflow same as major findings but target-closure 60-90 days; verified at first surveillance audit; does not affect certificate issuance. Treated as a managed backlog through the surveillance cycle.

Observation - Advisory Only. Observations (sometimes called Opportunities for Improvement, OFI) are auditor advisory comments that fall short of nonconformity. The provider chooses whether to act; observations do not affect certification but accumulate into improvement debt. Defensible practice closes 70%+ of observations by Year 2 surveillance.

The 30-60-90 day closure workflow operates as follows. Day 0, closing meeting. Preliminary findings presented; provider clarifies and contests classifications where defensible (evidence the auditor may have missed at sampling, or finding-statement scope that the auditor agrees to narrow). Days 0-14, formal findings memo. Body issues the formal memo with classified findings and CAR template. Days 14-30 - CAR drafting. Provider produces CAR per finding: root-cause analysis (5-whys or fishbone), corrective action specification, effectiveness-verification approach, named owner, target-closure date. Days 30-60, major-findings closure. Major findings remediated with documentary evidence (updated documentation, new V&V results, signed acceptance memos, training records, process updates). Days 60-90, minor-findings closure and verification. Minor findings closed; body verifies major-findings closure through paper review or targeted on-site verification (1-3 auditor-days). Critical findings extend the entire workflow by 3-12 months.

The corrective-action request workflow is governed by ISO/IEC 17021-1 clause 9.6 (corrective action) and ISO 19011 audit-guideline guidance. The CAR is a permanent QMS record; first-surveillance audits sample CAR effectiveness verification as a standard audit thread.

Cost, Timeline, Surveillance, and the Acme.MedAssist v1.0 Engagement Walk

2026 cost and timeline reality for first-cycle Module H, distinct from ISO 42001 alone. Initial certification fees. Mid-market Module H stand-alone Annex III runs €120K-€280K (lower bound for clean Annex III §2-§8 scope with strong harmonised-standard application; upper bound for Annex III §1 biometric or complex multi-component systems). MDR-overlaid Annex I cases like Acme.MedAssist run €250K-€450K because the sectoral and AI Act audits run concurrently and the auditor-day count rises to 25-40 for first cycle. Translation surcharges. €15K-€40K where operating evidence is not in the body's home language. Surveillance. 30-40% of initial cost annually; Acme.MedAssist budgeted €120K/year against a €380K initial. Recertification at Year 3. 60-80% of initial cost; the certificate validity is typically 3 years for Module H with annual surveillance, though some bodies offer 5-year cycles with bi-annual surveillance for mature programs. Substantial-modification re-audit triggers. Article 43(4) substantial modifications trigger re-audit; the notified body's policy on what counts as substantial (vs. a notification-only non-substantial change) is set in contract and surfaces in the surveillance posture criterion. Re-audit pricing is typically €30K-€80K per trigger. Findings-closure re-audit. Critical findings re-audit costs €30K-€80K and is the largest variable cost in the engagement; treating Stage 1 paper review seriously is the cheapest way to prevent it.

Timeline reality: 9-15 months from Phase 1 RFI dispatch to Phase 8 certificate issuance for first cycle. Faster on subsequent cycles where documentation is mature and the auditor team is the same. Acme.MedAssist's 14-month engagement walked as follows.

Month 1 (April 2026). RFI issued to four bodies; responses scored against ten criteria; BSI selected over TÜV SÜD on AI competence and sector specialization. Months 2-3 (May-June 2026). Scope-definition meeting confirmed Annex III §5 + MDR Class IIa overlay; engagement-scope memo signed. Contract negotiation closed mid-June; Stage 2 slot locked for January 2027. Months 3-6 (June-September 2026). Document submission package compiled. The team underestimated Annex IV §2(b) design-specification depth (a near-universal first-cycle pattern) and ran a 4-week internal pre-review against a Module H mock checklist before submission. Twelve-document package submitted late September 2026. Months 7-8 (October-November 2026). Stage 1 documentation review by BSI: 10 auditor-days over 3 weeks. Stage 1 report returned mid-November: 0 critical, 4 major, 8 minor, 6 observations. Major findings: (1) Annex IV §2(d) bias-examination methodology insufficiently specified for protected-attribute coverage; (2) Article 14 oversight-design vague on intervention thresholds; (3) Article 72 drift-detection methodology missing PSI threshold specification; (4) MDR clinical-evaluation report had gap in post-market clinical follow-up methodology. Months 9-10 (December 2026 - January 2027). Major findings closure: bias-examination report rewritten with disparate-impact ratio + equal-opportunity-difference + equalized-odds across age, sex, and language-of-origin protected attributes (signed by CAIO and Chief Medical Officer); oversight-design document v2.0 named clinical-reviewer intervention thresholds; drift-detection plan v2.0 specified PSI > 0.2 as warning, PSI > 0.25 as escalation; clinical-evaluation post-market-clinical-follow-up methodology added per MEDDEV guidance. All four major findings closed by mid-January. Month 11 (February 2027). Stage 2 on-site audit: 12 auditor-days over 3 weeks elapsed (combined AI Act Module H + MDR sectoral). Preliminary findings at closing meeting: 0 critical, 2 major, 5 minor, 4 observations. Major findings: (1) post-market monitoring dashboard not yet receiving production telemetry at audit (system was pre-launch); (2) incident-response procedure tabletop exercise had not been run in the preceding 6 months. Month 12 (March 2027). Closure of the two Stage 2 majors: production telemetry pipeline brought online with two weeks of operating data showing monitoring functioning; tabletop exercise run with engineering, clinical, and regulatory leads (recorded; signed). Minor findings closed within 60 days. Month 13 (April 2027). Certificate verification by BSI; certificate issued April 24, 2027 for scope "ServiceAssist-MedAssist v1.0 clinical-summarization assistant, MDR Class IIa overlay, Annex III §5 healthcare adjacency, conformity-assessment route Annex VII Module H + MDR Annex IX combined." Validity: 3 years (April 2027 - April 2030) with annual surveillance. Month 14 (May 2027). Article 47 Declaration of Conformity signed by Chief Executive Officer May 5, 2027 (note: today's date being May 16, 2026, this entire walk is the projected forward path the CAIO operationalized in April 2026; the certificate-issuance date is the planning target). Article 71 EU database entry registered May 8, 2027. CE marking with BSI identification number affixed to system documentation. Acme.MedAssist v1.0 went to market May 12, 2027.

Common engagement pitfalls and remediation: (1) selecting a notified body without AI competence, re-bid required mid-engagement, 3-month minimum delay; remediation: read Article 33 competence file before RFI shortlist. (2) submitting incomplete Annex IV technical file, Stage 1 gap memo extends timeline by 1-3 months per gap; remediation: internal mock-Stage-1 review 4 weeks before formal submission. (3) inadequate QMS records, Stage 2 finds insufficient operating evidence and downgrades to Stage 2 fail or major-findings backlog; remediation: 6 months of operating evidence accumulated before Stage 2. (4) substantial modifications during audit window, Article 43(4) triggers force re-scoping; remediation: freeze substantial-modification pipeline from Phase 4 document submission through Phase 8 certificate issuance. (5) inadequate post-market monitoring, Stage 2 cannot verify operating effectiveness; remediation: production telemetry pipeline operational and dashboards populated before Stage 2 start (not after).

Penalty exposure under Article 99 sits in two tiers relevant to notified-body engagement. Article 99(4) €15M / 3% global turnover covers notified-body-specific obligations including faulty conformity assessment, failure to register under Article 71, missing CE marking, and incorrect Article 47 declaration. The reputational dimension is independent: certificate suspension by the notified body creates a public Article 71 database record visible to deployers, customers, partners, and competing supervisory authorities under Article 70.

Key Takeaways

• Notified-body involvement is mandatory in two lanes: Annex III stand-alone high-risk under Article 43(1) + Annex VII Module H (Annex III §1 by default; §2-§8 where harmonised standards not fully applied: most providers in 2026 given CEN-CENELEC JTC 21 finalization expected Q4 2027 / Q1 2028); and Annex I product-extension under Article 43(3) through the existing sectoral framework with AI Act overlays (medical devices, machinery, civil aviation, automotive, lifts, pressure equipment, radio, construction). Internal control under Annex VI Module A is available only in narrow Annex III §2-§8 scope with full harmonised-standard application and no sectoral overlay.
• 2026 designation landscape is nascent: ~10 notified bodies formally designated under Article 31 (TÜV SÜD, TÜV Rheinland, DEKRA, BSI Group EU subsidiary, DNV, Bureau Veritas, KIWA, SGS, AFNOR, plus sector-specific overlap bodies). The binding constraint is 15-25 senior auditors per body with combined ISO/IEC 17021-1 + ISO/IEC 17065 + AI/ML/data-governance depth. Verify NANDO database entry before RFI shortlist.
• Ten-point selection criteria: (1) Member-state designation per Articles 28-39; (2) scope of designation matches product's harmonised law; (3) AI competence + ML-specific auditors per Article 33; (4) sector specialization; (5) geographic + language coverage; (6) ISO/IEC 17021 / 17065 baseline accreditation; (7) reasonable fee schedule (€120K-€450K initial; 30-40% surveillance; 60-80% recertification); (8) timeline / queue length; (9) reference clients (three under NDA); (10) ongoing surveillance posture. Scored matrix signed by CAIO, Head of Quality, General Counsel; filed permanently.
• Eight-phase engagement lifecycle: (1) prequalification + RFI; (2) scope definition; (3) contract negotiation; (4) document submission; (5) Stage 1 documentation review (5-15 auditor-days; deeper than ISO 42001 Stage 1); (6) Stage 2 on-site operating-effectiveness audit per ISO 19011 (5-15 auditor-days; 8-15 for MDR-overlaid); (7) findings closure (30-60-90 day workflow); (8) certificate issuance + Article 47 declaration + Article 71 registration + CE marking. 9-15 months first cycle.
• Twelve-document submission package: Annex IV §1-§9 TDF; Article 17 QMS manual; Article 9 risk documentation; Article 10 data governance; Article 14 oversight design; Article 15 accuracy/robustness/cybersecurity; Article 13 instructions for use; Article 72 post-market plan; Article 43(4) substantial-modification log; Article 47 declaration drafts; ML-BoM CycloneDX 1.7; Mitchell-et-al. model card. MDR-overlaid cases add clinical-evaluation report, PMCF plan, PSUR, UDI documents.
• Findings classification drives deployment: critical (precludes certification; 3-12 month redesign + re-audit); major (closure required before certification; 30-60 day CAR workflow); minor (closure within 60-90 days; verified at first surveillance; does not block certificate); observation (advisory). CAR workflow per ISO/IEC 17021-1 clause 9.6: root-cause analysis, corrective action, effectiveness verification, named owner, target-closure date.
• Cost and timeline reality 2026: first-cycle Module H €120K-€450K (upper bound for MDR-overlaid Annex I); surveillance 30-40% annually; recertification 60-80% at Year 3; certificate validity typically 3 years with annual surveillance; substantial-modification re-audit €30K-€80K per trigger. Five common pitfalls: NB without AI competence, incomplete Annex IV submission, inadequate QMS records, substantial modifications during audit window, inadequate post-market monitoring.
• Article 99(4) €15M / 3% global turnover covers notified-body-specific obligations: faulty conformity assessment, Article 71 registration failure, missing CE marking, incorrect Article 47 declaration. Certificate suspension creates public Article 71 database record visible to deployers, customers, partners, competing supervisory authorities under Article 70.
• Lesson 052 walks the practitioner-tier audit week-by-week; this lesson is the organizational decision frame above it. The CAIO defends the ten-point selection memo at audit-committee signing and again whenever a supervisory authority asks. The eight-phase lifecycle is the program plan the board AI committee tracks at quarterly cadence.