The EU AI Act's Notified Body Bottleneck: Why Conformity Assessment Still Isn't Ready

The deadline everyone was tracking just moved

For most of 2026, "2 August 2026" was the date compliance teams built their entire high-risk AI Act programme around. Then the Digital Omnibus on AI - Regulation (EU) 2026/1744 - entered into force on 27 July 2026, six days before that deadline, and pushed the application date for Annex III high-risk obligations to 2 December 2027. Holland & Knight's coverage of the possible August 2026 deadline and Tech Times' reporting on the Omnibus becoming law both capture how close that timing was.

The headline reason wasn't political cold feet. It was infrastructure that simply was not built yet.

What "conformity assessment" actually requires - and what was missing

High-risk AI providers need two things to legally place a system on the EU market: harmonised technical standards that define how to satisfy the Act's requirements in practice, and notified bodies - independent, government-designated organisations authorised to assess a system against those standards and issue the certification that supports CE marking. Neither was ready.

European standardisation bodies (CEN-CENELEC) were tasked with drafting the harmonised standards operationalizing the Act's risk-management, data-governance and human-oversight requirements into testable technical criteria. That drafting process ran badly behind schedule. Without finished standards, notified bodies have nothing concrete to assess against, and without designated notified bodies, providers who wanted to comply had no institution to submit to - even the most compliance-ready company had no legal pathway to certification. The Cloud Security Alliance's research note on the enterprise readiness gap and eyreACT's guide to notified bodies both describe this gap in the conformity-assessment chain.

Estimates circulating as the Omnibus passed suggested the full suite of harmonised standards may not be finished before December 2026 - meaning providers will have roughly 12 months of standards-backed compliance runway before the new December 2027 deadline, not the 18 months the date shift might suggest at first glance. Holistic AI's analysis of the deadline move and Lumenova's rundown of the 2026 delays both flag this compressed effective window.

What did NOT move

It's worth being precise here, because "the AI Act got delayed" oversimplifies what happened. Article 50 transparency obligations - labeling requirements for chatbots, AI-generated content, and deepfakes - activated on schedule on 2 August 2026. So did the enforcement powers and penalty regime over general-purpose AI (GPAI) model providers, which had already been operative since August 2025. Tech Letter's explainer on why the August deadline effectively disappeared and Modulos' 2026 status check both make this distinction clearly: it is specifically the Annex III high-risk conformity-assessment track that moved, not the whole Act.

Why this matters even if you're not building high-risk AI yet

The notified body shortage is a signal, not just an excuse. It tells you the certification market for AI Act conformity assessment is still forming - which means when standards do land and notified bodies scale up capacity, there will likely be a queue. Providers who wait until late 2027 to start engaging with the assessment process risk competing for scarce notified body capacity right as the deadline arrives, the same dynamic that has played out in other CE-marking regimes (like medical devices under MDR) when infrastructure lagged legislation.

How to use the extra runway instead of losing it

Don't treat December 2027 as a reset button. The parts of a compliance programme that don't depend on external certification infrastructure are exactly the parts you can - and should - build now:

• Risk management system. Article 9's lifecycle risk management process doesn't require a notified body to start; build the process and start logging.
• Technical documentation. Annex IV documentation can be drafted against the Act's text today, even before harmonised standards finalize the exact format.
• Quality management system. Article 17's QMS requirements are largely about process discipline your organisation controls directly.
• Vendor and standards tracking. Watch CEN-CENELEC publication schedules and notified body designation announcements so you can move quickly once the assessment pathway opens.

The deadline moved. The work didn't get any smaller.