AI Act Article 28: Obligations, Deadlines & Penalties

All obligations under Article 28

Obligation 1

Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Member State

Action required

designate

Deadline

—

Penalty

—

Obligation 2

The procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring shall be developed in cooperation between the notifying authorities of all Member States. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

cooperate

Deadline

—

Penalty

—

Obligation 3

Notifying authorities shall be established, organised and operated in such a way that no conflict of interest arises with conformity assessment bodies, and that the objectivity and impartiality of their activities are safeguarded. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

safeguard

Deadline

—

Penalty

—

Obligation 4

Notifying authorities shall be organised in such a way that decisions relating to the notification of conformity assessment bodies are taken by competent persons different from those who carried out the assessment of those bodies. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

organise

Deadline

—

Penalty

—

Obligation 5

Notifying authorities shall offer or provide neither any activities that conformity assessment bodies perform, nor any consultancy services on a commercial or competitive basis. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

refrain

Deadline

—

Penalty

—

Obligation 6

Notifying authorities shall safeguard the confidentiality of the information that they obtain, in accordance with Article 78. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

safeguard

Deadline

—

Penalty

—

Obligation 7

Notifying authorities shall have an adequate number of competent personnel at their disposal for the proper performance of their tasks, with necessary expertise in fields such as information technologies, AI and law. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

maintain

Deadline

—

Penalty

—

EU AI Act compliance deadlines

• 2025-02-02 Article 5 prohibitions (unacceptable risk) in_force
• 2025-02-02 Article 4 AI literacy in_force
• 2025-08-02 GPAI model obligations (Articles 51 to 56) in_force
• 2026-07-27 Regulation (EU) 2026/1744 (Digital Omnibus on AI) enters into force — AI Act applies as amended in_force
• 2026-08-02 AI Act general date of application (Art 113) — governance, penalties and remaining provisions without a different date in_force
• 2026-08-02 Article 50 transparency obligations (AI-interaction disclosure, labelling of deepfakes and AI-generated text, emotion-recognition notices) in_force
• 2026-12-02 Article 50(2) machine-readable marking of AI-generated content — transition for generative AI systems placed on the market before 2 August 2026 scheduled
• 2026-12-02 NEW Article 5 prohibition: AI generation of non-consensual intimate imagery (NCII) and CSAM scheduled
• 2027-08-02 National AI regulatory sandboxes: at least one operational per Member State (Art 57(1)) scheduled
• 2027-12-02 Annex III stand-alone high-risk obligations scheduled
• 2028-08-02 Annex I embedded (regulated-product) high-risk obligations scheduled

Questions about Article 28

Who must comply with Article 28 of the AI Act? +

Member State, Notifying Authority.

What does Article 28 of the AI Act require? +

designate cooperate safeguard