AI Act Article 28: Obligations, Deadlines & Penalties

All obligations under Article 28

Obligation 1

Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Member State

Action required

designate

Deadline

—

Penalty

—

Obligation 2

The procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring shall be developed in cooperation between the notifying authorities of all Member States. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

cooperate

Deadline

—

Penalty

—

Obligation 3

Notifying authorities shall be established, organised and operated in such a way that no conflict of interest arises with conformity assessment bodies, and that the objectivity and impartiality of their activities are safeguarded. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

safeguard

Deadline

—

Penalty

—

Obligation 4

Notifying authorities shall be organised in such a way that decisions relating to the notification of conformity assessment bodies are taken by competent persons different from those who carried out the assessment of those bodies. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

organise

Deadline

—

Penalty

—

Obligation 5

Notifying authorities shall offer or provide neither any activities that conformity assessment bodies perform, nor any consultancy services on a commercial or competitive basis. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

refrain

Deadline

—

Penalty

—

Obligation 6

Notifying authorities shall safeguard the confidentiality of the information that they obtain, in accordance with Article 78. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

safeguard

Deadline

—

Penalty

—

Obligation 7

Notifying authorities shall have an adequate number of competent personnel at their disposal for the proper performance of their tasks, with necessary expertise in fields such as information technologies, AI and law. Regulation (EU) 2024/1689, Article 28, Article 28

Obligated entity

Notifying Authority

Action required

maintain

Deadline

—

Penalty

—

EU AI Act compliance deadlines

• 2025-02-02 Article 4 AI literacy in_force
• 2025-02-02 Article 5 prohibitions (unacceptable risk) in_force
• 2025-08-02 GPAI model obligations (Articles 51 to 56) in_force
• 2026-08-02 Article 50(2) machine-readable marking (watermarking) of AI-generated content provisionally_amended
• 2026-08-02 Article 50 transparency obligations OTHER than the 50(2) marking grace (for example disclosure that a user is interacting with an AI system) scheduled
• 2026-08-02 Annex III stand-alone high-risk obligations provisionally_amended
• 2026-08-02 National AI regulatory sandboxes (establishment deadline) provisionally_amended
• 2026-12-02 NEW Article 5 prohibition: AI generation of non-consensual intimate imagery (NCII) and CSAM provisionally_amended
• 2027-08-02 Annex I embedded (regulated-product) high-risk obligations provisionally_amended

Questions about Article 28

Who must comply with Article 28 of the AI Act? +

Member State, Notifying Authority.

What does Article 28 of the AI Act require? +

designate cooperate safeguard