Govern Subsidiaries and Subcontractors Used for AI Conformity Assessment

Sub-obligations

These are independently assessable parts of the parent requirement.

1. Article 33(1)-(2)

   Current

   Verify Subcontractor and Subsidiary Compliance and Notify the Notifying Authority

   Tracker Networks Guidance

   Ensure each subcontractor or subsidiary performing conformity-assessment tasks satisfies the Article 31 requirements, inform the notifying authority and retain full responsibility for the work.

   Official text

   1. Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements laid down in Article 31, and shall inform the notifying authority accordingly. 2. Notified bodies shall take full responsibility for the tasks performed by any subcontractors or subsidiaries.

   Suggested controls

   • Notified-Body Subcontractor and Subsidiary Governance

     Qualify, approve, monitor and retain evidence for subcontractors/subsidiaries used in AI conformity assessment.

   Related risks

   • Notified-Body Subcontracting, Certificate or Reporting Failure

     Subcontracted assessment work, certificate management or required regulatory reporting may not meet AI Act requirements.

2. Article 33(3)

   Current

   Obtain Provider Agreement for Subcontracted Assessment Work and Publish the Subsidiary List

   Tracker Networks Guidance

   Use subcontractors or subsidiaries only with the provider's agreement and make the notified body's list of subsidiaries publicly available.

   Official text

   3. Activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. Notified bodies shall make a list of their subsidiaries publicly available.

   Suggested controls

   • Notified-Body Subcontractor and Subsidiary Governance

     Qualify, approve, monitor and retain evidence for subcontractors/subsidiaries used in AI conformity assessment.

   Related risks

   • Notified-Body Subcontracting, Certificate or Reporting Failure

     Subcontracted assessment work, certificate management or required regulatory reporting may not meet AI Act requirements.

3. Article 33(4)

   Current

   Retain Subcontractor and Subsidiary Qualification Records for Five Years

   Tracker Networks Guidance

   Keep documents concerning subcontractor/subsidiary qualifications and work performed available to the notifying authority for five years after the subcontracting arrangement ends.

   Official text

   4. The relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation shall be kept at the disposal of the notifying authority for a period of five years from the termination date of the subcontracting.

   Suggested controls

   • Regulatory Documentation Retention

     Retain required AI compliance documentation for mandated periods and ensure it remains retrievable.

   • Notified-Body Subcontractor and Subsidiary Governance

     Qualify, approve, monitor and retain evidence for subcontractors/subsidiaries used in AI conformity assessment.

   Related risks

   • Failure to Retain Required AI Records

     Required documentation or logs may not remain complete, available and retrievable for mandated periods.

   • Notified-Body Subcontracting, Certificate or Reporting Failure

     Subcontracted assessment work, certificate management or required regulatory reporting may not meet AI Act requirements.