Choosing a Notified Body: NANDO and scope verification

Hugues Orgitello updated 7 Oct 2026 18 min read

When the chosen assessment route requires a Notified Body, the choice of that body is a technical, commercial and calendar decision, and it starts in NANDO, the Commission database where every notification is published. This page explains what a notification legally covers, how to read a NANDO record line by line, what the database showed on October 7, 2026 for the main CE acts (including the Cyber Resilience Act, whose notification chapter has applied since June 11, 2026), and which contract points the texts already settle before you negotiate with an NB.

What a Notified Body actually is

A Notified Body is a conformity assessment body that a Member State has notified to the Commission and the other Member States as competent for specific tasks under a specific Union harmonisation act. The common rules are in Annex I of Decision 768/2008/EC, Articles R13 to R31, which each sector act copies with its own article numbers. Three points are often misread.

• Accreditation is preferred, not mandatory. The Blue Guide calls accreditation "the preferred way" to assess competence; a body without an accreditation certificate can still be notified if the notifying authority supplies documentary evidence of its competence and monitoring (Articles R22(3) and R23(4)). The only difference in the procedure is the objection window: two weeks with accreditation, two months without (Article R23(5)). Accreditation under Regulation 765/2008 is performed against the EN ISO/IEC 17000 series, and the standard depends on the module (the Blue Guide refers to European co-operation for Accreditation recommendations per act and per module).
• The MDR and IVDR use designation, not plain notification. A medical device body applies to its national authority, which reviews the application with a joint assessment team of three experts appointed by the Commission and the MDCG (MDR Article 39). Member States and the Commission then have 28 days to object (Article 42(6)), and the designation becomes valid the day after publication in NANDO (Article 42(11)).
• One body, one number. The Commission assigns a single identification number even when the body is notified under several acts (Article R24). The Blue Guide adds that numbers are sequential and never re-used when a body is withdrawn; withdrawn or expired notifications stay in the database.

The NB number follows the CE marking only where the body is involved in the production control phase (Article R12(3)). Sector texts make this concrete: under the Directive 2014/53/EU (RED), the number follows the CE marking only when Annex IV (full quality assurance, module H) is applied (Article 20(3)); under the Directive 2014/30/EU (EMC) Article 17 provides no number at all, because the only notified procedure is EU-type examination followed by internal production control (Annex III).

Manufacturers are free to choose any body notified for the procedure in question (Blue Guide, section 5.2.3). Under the MDR this freedom has one limit: an application may not be lodged in parallel with a second body for the same conformity assessment procedure, and an earlier withdrawn or refused application must be declared (Article 53(1) and (3)).

Where each act sets the notified body rules

The table maps the model articles of Decision 768/2008/EC to the article numbers in the acts an electronics manufacturer meets most often.

Topic	Decision 768/2008/EC, Annex I	RED 2014/53/EU	EMC 2014/30/EU	Machinery Regulation 2023/1230	CRA 2024/2847	MDR 2017/745
Requirements on the body (independence, no consultancy)	R17	Art. 26	Art. 24	Art. 30	Art. 39	Art. 36 and Annex VII
Subsidiaries and subcontracting	R20	Art. 28	Art. 26	Art. 32	Art. 41	Art. 37
Application	R22	Art. 29	Art. 27	Art. 33	Art. 42	Art. 38
Notification procedure and objections	R23	Art. 30	Art. 28	Art. 34	Art. 43	Art. 39 and 42
Identification numbers and lists	R24	Art. 31	Art. 29	Art. 35	Art. 44	Art. 43
Changes to notifications (restriction, suspension, withdrawal)	R25	Art. 32	Art. 30	Art. 36	Art. 45	Art. 46
Operational obligations	R27	Art. 34	Art. 32	Art. 38	Art. 47	Annexes VII and IX to XI
Coordination group of notified bodies	R30	Art. 38	Art. 36	Art. 42	Art. 51	Art. 49

Two dates matter in this table. The notification articles of the Machinery Regulation (Articles 26 to 42) have applied since January 20, 2024, three years before the Regulation itself applies on January 20, 2027, so bodies could be notified in advance (Article 54, as corrected). The Cyber Resilience Act notification chapter (Articles 35 to 51) has applied since June 11, 2026, while the rest of the Regulation applies from December 11, 2027 (Article 71(2)); Article 35(2) asks Member States to strive for a sufficient number of notified bodies by December 11, 2026.

NANDO in practice

NANDO is both the tool notifying authorities use to send notifications and the public list. The Blue Guide (section 5.3.3) states that the site is refreshed daily and can be searched by act, by country, by body number or by keyword. NANDO is now part of the Commission Single Market Compliance Space: the former NANDO address on the DG GROW website redirects there. Besides notified bodies, it lists notifying authorities, bodies designated under mutual recognition agreements, bodies under the EU-Canada CETA Protocol and other categories such as the recognised third-party organisations and user inspectorates of the Pressure Equipment Directive.

NANDO query workflow

1. Identify every act that applies to the product. A typical radio IoT product falls under the RED, which covers EMC and electrical safety objectives through its Article 3(1); a medical device falls under the Regulation 2017/745 (MDR). Each act has its own list of bodies, and a body notified under one act is not competent under another.
2. Open the list for that act. Filter on active notifications; withdrawn, expired and suspended notifications remain visible and must not be mistaken for current ones.
3. Open the body record. It shows the legal name, address, notifying authority, the procedures or modules, the annexes and the products or requirements covered, with the history of notification versions.
4. Cross-check every line you need. For each procedure in your certification plan and each requirement or product code, check that the exact entry is listed. A missing line is an exclusion.
5. Keep a dated copy. Notifications are amended (extensions, reductions, changes of validity) and published in NANDO (Blue Guide, section 5.3.3). Save the record on the day you sign and again before the certificate is issued.

Reading a NANDO record line by line

The structure of the scope differs by act, and the vocabulary in the record follows the text of each act.

• RED: the procedure appears as "Module B" (Article 17 and Annex III) and, for some bodies, "Module H" (Annex IV). The product list names each essential requirement separately: Article 3.1(a), 3.1(b), 3.2, 3.3(d), 3.3(e), 3.3(f), 3.3(g) (split into "applied in conjunction with" and "not applied in conjunction with" the Commission Decisions adopted under the former R&TTE Directive) and 3.4. A body notified for the RED is not necessarily notified for the cybersecurity requirements of Article 3(3)(d), (e) and (f).
• EMC: the only entry is Annex III, EU-type examination (module B) followed by conformity to type based on internal production control (module C).
• MDR: the procedures are listed as Annex IX chapter I (quality management system), Annex IX chapter II (assessment of technical documentation), Annex X (type examination), Annex XI part A (production quality assurance) and Annex XI part B (product verification). Product scope uses the codes of Implementing Regulation (EU) 2017/2185: MDA (active devices) and MDN (non-active devices) codes describe design and intended purpose; the horizontal codes MDS (devices with specific characteristics, such as MDS 1001 devices incorporating medicinal substances) and MDT (specific technologies or processes, such as MDT 2001 metal processing) must also be covered. Annex VII is the list of requirements on the bodies themselves, not a conformity assessment procedure.
• Machinery Regulation: procedures are listed as EU-type examination (module B), unit verification (module G) and full quality assurance (module H), with machinery categories referenced to Annex I.

What NANDO showed on October 7, 2026

The figures below were read through the NANDO public search on October 7, 2026, counting notifications with status "active" in their latest version. They change with every notification, suspension or withdrawal: treat them as a dated snapshot and read NANDO again on the day you decide.

Act	Active notified bodies	Countries	What the scope lines show
Regulation 2017/745 (MDR)	45	18	Annex IX ch. I: 45; Annex IX ch. II: 44; Annex XI part A: 43; Annex X: 13; Annex XI part B: 12
Regulation 2017/746 (IVDR)	17	11	Annex IX ch. I and ch. II: 17; Annex XI: 12; Annex X: 3
Directive 98/79/EC (IVDD, legacy)	12	8	Still listed as active
Directive 2014/53/EU (RED)	46, of which 18 in the United States	13	Module B: 46; Module H: 6; Article 3.3(d): 29; 3.3(e): 29; 3.3(f): 28
Directive 2014/30/EU (EMC)	57, of which 13 in the United States	20	Annex III (B+C) only
Directive 2006/42/EC (Machinery Directive)	80	20	Applies until January 19, 2027
Regulation 2023/1230 (Machinery Regulation)	34, of which 18 in Germany	8	Module B: 33; Module G: 19; Module H: 11
Directive 2014/34/EU (ATEX)	45	17
Directive 2014/68/EU (PED)	149	25	Plus recognised third-party organisations and user inspectorates, listed separately
Directive 2014/33/EU (lifts)	124, of which 52 in Italy	24
Regulation 2016/425 (PPE)	70	19
Regulation 2024/2847 (CRA)	0	0	Act listed in NANDO; notification chapter applies since June 11, 2026

Three readings follow from this table.

• For a radio product with cybersecurity requirements, the useful pool is smaller than the RED headline. Of the 46 RED bodies, 29 list Article 3(3)(d) and 28 list 3(3)(f), and 18 of the 46 are United States bodies designated under the EU-US MRA. Only 6 RED bodies list module H.
• For medical devices, the narrow codes decide. Only 10 of the 45 MDR bodies list MDA 0101 (active implantable devices for stimulation, inhibition or monitoring) and 8 list MDS 1002 (devices manufactured using tissues or cells of human origin, or their derivatives), against 44 for MDA 0315 and 45 for the horizontal code MDT 2011.
• For the CRA, there was no notified body yet. A manufacturer of an important product of class II, which must use EU-type examination, full quality assurance or a European cybersecurity certification scheme (Article 32(3)), had no CRA notified body to contract on October 7, 2026, fourteen months before the main obligations apply. See the Cyber Resilience Act guide.

Scope verification: operational checklist

A certificate issued outside the notified scope has no legal value, whatever the reputation of the body. The checklist below should run before contract signature.

• Act: is the body notified under the act that applies, and is the notification active in its latest version?
• Procedure: is the exact module or annex listed (B, G or H under the Machinery Regulation; Annex III or IV under the RED; Annex IX chapter I and II, X or XI under the MDR)? A notification for one module does not cover the others.
• Product or requirement line: under the RED, are 3.3(d), (e) and (f) listed if your product needs them? Under the MDR, are both your MDA or MDN code and every applicable MDS and MDT code listed?
• Harmonised standards: under the RED, a notified body is needed for Article 3(2) and 3(3) where cited harmonised standards were not applied, were applied only in part, or do not exist (Article 17(4)). The standards for Article 3(3)(d), (e) and (f), EN 18031-1, -2 and -3, were cited with restrictions by Decision (EU) 2025/138 for the requirements that apply since August 1, 2025; where a restriction concerns your product, the standard does not give presumption for that part and the notified body route follows.
• History: does the record show recent restrictions, suspensions or a withdrawal under another act? The Blue Guide (section 5.3.4) explains that only the notifying Member State can withdraw a notification.
• Subcontracting: which tasks does the body subcontract, to whom, and in which country? The body stays fully responsible (Article R20(2)), the subcontractor must meet the same requirements, and subcontracting needs your agreement (Article R20(3)).
• Language: for the RED, documentation and correspondence for a type examination must be in an official language of the Member State of the body or in a language it accepts (Article 21(3)). For the MDR, the Member State of the body may require its own official language for some or all documents (Article 52(12)), and certificates are issued in an official Union language set by that Member State or accepted by the body (Article 56(1)).

See the CE procedure for where an NB intervenes, and Self-declaration vs Notified Body for when the third-party route can be avoided.

Criteria for choosing a Notified Body

Once scope has been verified, several bodies may be eligible. The texts do not rank them, and NANDO publishes no lead time or price. What follows are the questions worth asking, with the parts the law already settles.

Capacity and lead time

Lead times are not published in NANDO and vary by body, act and module. Ask in writing for:

• the availability of the project manager over your planned window,
• the typical time from complete submission to first technical feedback,
• the typical time from closure of non-conformities to certificate issue,
• what happens if those times slip.

Geography and language

A body close to your sites makes on-site audits under quality assurance modules simpler. Language is partly regulated (see the checklist above): check what the body accepts before you translate a technical file.

Fees

The texts give two handles. MDR bodies must establish and publish lists of their standard fees (MDR Article 50). Under the CRA, fees for conformity assessment must take the interests of micro, small and medium-sized enterprises into account and be reduced proportionately (CRA Article 32(6)). For every other point, compare quotes on the same basis:

• documentary review and test costs, and which tests the body performs itself,
• regime for scope extensions and design changes,
• frequency and cost of surveillance audits (under the MDR, at least once every 12 months, with unannounced audits at least once every five years, Annex IX sections 3.3 and 3.4; under module D, E or H of Decision 768/2008/EC, "periodic audits" with no fixed frequency),
• fee revision rule over the life of the certificate,
• conditions for transferring the file to another body.

Pre-application meeting

Many bodies offer a meeting before formal application. It is useful to agree the scope and the documents expected, but it is not consultancy: a notified body may not provide consultancy on the design, construction, marketing or maintenance of the products it assesses (Article R17(4); Blue Guide, section 5.2.2), although technical information and guidance may be exchanged.

Specific risks

Restriction, suspension or withdrawal

Under the acts aligned with Decision 768/2008/EC, the notifying authority restricts, suspends or withdraws a notification depending on the seriousness of the failure (Article R25(1)). The Blue Guide states that, without prejudice to sectoral rules, this "does not affect certificates issued by the notified body up to that point, until such time as demonstration can be made that the certificates should be withdrawn", and that the Member State must ensure the files are processed by another notified body or kept available (Article R25(2)).

The MDR is stricter and more precise. The body must inform the manufacturers concerned within 10 days (Article 46(5)); a suspension may not exceed one year, renewable once (Article 46(4)); after a withdrawal, certificates not unduly issued remain valid for nine months only if the competent authority confirms there is no safety issue and another body confirms in writing that it takes responsibility for the devices (Article 46(9)). A body that decides to stop its activities must announce a planned cessation one year in advance, and its certificates can stay valid nine months after cessation under the same written take-over condition (Article 46(3)).

Changing body

Under the MDR, a voluntary change of body requires an agreement between the manufacturer, the incoming body and, where practicable, the outgoing body, covering at least: the date the old certificates become invalid, the date until which the old number may appear in the manufacturer information, the transfer of documents including confidentiality and property rights, the date the incoming body takes over, and the last serial or lot number under the outgoing body (Article 58). Use the same list as a checklist under other acts.

Conflict of interest

A notified body, its top management and its assessment staff may not be the designer, manufacturer or supplier of the products they assess, nor provide consultancy on them (Article R17(4)). The Blue Guide extends the rule to subsidiaries and subcontractors: if a related company has advised you on a product, the body cannot assess that product (section 5.2.5).

Notified Body, Certification Body, accredited laboratory: do not confuse

The vocabulary of certification covers distinct roles, often held by different legal entities of the same group.

Role	Mandate	Basis	Identifier
Notified Body (NB)	Conformity assessment tasks under a Union harmonisation act, for which it is notified	Notification by a Member State, published in NANDO	Four-digit NANDO number
Certification body (CB)	Voluntary certification, IECEE CB Scheme, schemes outside the EU	ISO/IEC 17065 accreditation	Accreditation number
Accredited test laboratory	Measurements and test reports	ISO/IEC 17025 accreditation	Accreditation number
Consortium programme	Bluetooth SIG, Wi-Fi Alliance, USB-IF qualification	Consortium rules	Consortium identifier
TCB	FCC equipment certification in the United States	FCC recognition	TCB designation

The Blue Guide (section 5.2.2) sets three rules that follow from this split. A body that issues a test report acts as a conformity assessment body; only as a notified body can it issue an EU-type examination certificate with its name and number. It must never issue a test report carrying its notified body number for tests the legislation does not specify. And it may serve markets outside the EU, for example under mutual recognition agreements, only if those activities are clearly separated and carried out without its notified body number.

Consortium qualifications such as the Bluetooth SIG process are contractual and are not carried out by notified bodies in the EU sense. A product may need a CE assessment by a notified body, a consortium qualification and operator approvals at the same time; plan them as separate tracks.

For the medical sector, see the MDR guide and the IVDR guide; the glossary carries the formal definitions.

Mutual recognition: how far MRAs reach

An MRA is an agreement between the Union and a third country under which each party accepts the reports, certificates and marks issued by bodies the other party has designated, under its own legislation, for the sectors covered (Blue Guide, section 9.2.1). The assessment is not waived; it is performed in the country of production against the rules of the importing party.

• In force: the Blue Guide lists MRAs with Australia, New Zealand, the United States, Japan and Switzerland. The MRA with Canada has been replaced by the CETA Protocol on the mutual acceptance of the results of conformity assessment (section 9.2.1 and 9.2.4).
• Switzerland is a special case: the 2002 agreement is an "enhanced MRA" based on equivalent legislation. The Blue Guide lists twenty sectors, among them machinery, personal protective equipment, toys, partially medical devices, pressure equipment, ATEX equipment, electrical safety and EMC, lifts and cableway installations (section 9.2.2). See Switzerland EU-CH MRA.
• In NANDO: bodies designated under MRAs figure in a dedicated part of the database, and some appear directly in the act lists: on October 7, 2026, 18 of the 46 RED bodies and 13 of the 57 EMC bodies were located in the United States.
• The United Kingdom became a third country on February 1, 2020 and the transition period ended on December 31, 2020 (Blue Guide, section 2.9.5). NANDO shows, for example, BSI Assurance UK Ltd withdrawn under the MDR with an end date of December 31, 2020.

The practical lesson: a United States manufacturer of a radio product may contract a United States body designated under the MRA for the RED, but a product under an act not covered by the relevant agreement still needs an EU notified body.

Claims the texts contradict

Common claim (including earlier versions of this page)	What the primary text says
"A body is designated after accreditation by the national accreditation body"	Accreditation is the preferred route but not a requirement; without it, the notifying authority provides documentary evidence and the objection period is two months instead of two weeks (Decision 768/2008/EC, Articles R22(3), R23(4) and (5); Blue Guide, section 5.3.2)
"Notified bodies are accredited to ISO/IEC 17065"	The EN ISO/IEC 17000 standard used depends on the module and the act (Blue Guide, section 5.3.2.3); under the MDR, designation rests on Annex VII and a joint assessment (Articles 38 and 39)
"NANDO can be searched by product type"	The Blue Guide lists search by act, by country, by body number and by keyword; product scope is read inside each record
"The NB number goes next to the CE marking whenever modules D, E, F or H are used"	It follows the CE marking where the body is involved in production control (Article R12(3)); under the RED only when Annex IV is applied (Article 20(3)), and the EMC Directive provides no number (Article 17)
"An NB notified for MDR Annex VII is not automatically competent for Annex IX"	Annex VII sets the requirements on notified bodies; the conformity assessment procedures are in Annexes IX, X and XI
"MDR horizontal codes cover clinical investigations and biocompatibility"	Horizontal codes are MDS (devices with specific characteristics) and MDT (specific technologies or processes) (Implementing Regulation (EU) 2017/2185, Annex I)
"Medical, ATEX, lifts and pressure equipment are excluded from active MRAs"	The EU-Swiss MRA covers pressure equipment, ATEX, lifts and, partially, medical devices among its twenty sectors (Blue Guide, section 9.2.2)
"There is an EU MRA with Canada"	The MRA with Canada has been replaced by the CETA Protocol (Blue Guide, section 9.2.1)
"After a withdrawal, certificates remain valid for a few months to two years"	Generally they are not affected until it is shown they should be withdrawn (Blue Guide, section 5.3.4); under the MDR, nine months under the conditions of Article 46(9)
"When an NB disappears, certificates are transferred to the acquiring entity"	No such rule; files are processed by another notified body or kept available (Article R25(2)), and under the MDR a new body completes a full assessment before issuing new certificates (Article 46(3))
"Modules D, E and H impose annual audits"	Decision 768/2008/EC requires "periodic audits" without a fixed frequency; the 12-month minimum is an MDR rule (Annex IX, section 3.3)
"A manufacturer can approach several MDR notified bodies at once"	No parallel application for the same procedure; earlier withdrawn or refused applications must be declared (MDR Article 53(1) and (3))

Common pitfalls

Scope framing

• Verify the scope at signature time, not at quote time. Notifications are amended and the changes are published in NANDO; a record consulted months earlier may be out of date.
• Distinguish the scope of the body from the scope of its laboratory. An ISO/IEC 17025 accreditation of the test laboratory says nothing about the notification; only the NANDO record does.
• Read the act, not the brand. The same group may hold several numbers through different legal entities, each with its own notifications.

Calendar

• Engaging the body late. Under the MDR and the CRA, the number of bodies for a given scope can be small (see the table above); engage in parallel with design rather than after the technical file is final.
• Forgetting surveillance. Quality assurance modules involve periodic audits after certification, and the MDR adds unannounced audits; budget them over the life of the certificate.

Contract

• Uncapped fee revision. Fix the revision rule for the certificate lifetime.
• Document transfer. Agree in advance how test reports and the file are handed over if you change body; Article 58 of the MDR gives a ready list of points.
• Subcontracting without your agreement. Article R20(3) requires the client agreement; ask for it to be explicit.

See also

• NB surveillance audits: cadence and conduct
• Conformity assessment modules A-H (768/2008/EC)
• EU Authorised Representative and Importer
• Multi-marking layouts: CE, FCC, UKCA, ANATEL and other marks
• Cyber Resilience Act (CRA)
• Machinery Directive 2006/42 and Regulation 2023/1230

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Going further

Selecting a Notified Body sits within the assessment procedure defined by the applicable act. For the upstream sequencing, see the CE pillar and the CE procedure. For the decision upstream (self-declaration or NB), see Self-declaration vs Notified Body. For the medical sector, see the MDR guide. The glossary carries the formal definitions (NB, CAB, NANDO, MRA, accreditation, notification).

Sources & references

1. NANDO, Notified bodies database (Single Market Compliance Space), European Commission (DG GROW) webgate.ec.europa.eu/single-market-compliance-space/#/notified-bodies
2. Decision No 768/2008/EC, common framework for the marketing of products (Annex I, Articles R12 and R13 to R31), EUR-Lex eur-lex.europa.eu/eli/dec/2008/768/oj
3. The Blue Guide on the implementation of EU product rules 2022 (chapter 5.2 and 5.3, section 9.2), European Commission eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629(04)
4. Regulation (EC) No 765/2008, accreditation and market surveillance, EUR-Lex eur-lex.europa.eu/eli/reg/2008/765/oj
5. Directive 2014/53/EU (RED), Articles 17, 20, 21 and 22 to 38, EUR-Lex eur-lex.europa.eu/eli/dir/2014/53/oj
6. Directive 2014/30/EU (EMC), Articles 17 and 20 to 36, EUR-Lex eur-lex.europa.eu/eli/dir/2014/30/oj
7. Regulation (EU) 2017/745 (MDR), Articles 35 to 58 and Annexes VII and IX, EUR-Lex eur-lex.europa.eu/eli/reg/2017/745/oj
8. Implementing Regulation (EU) 2017/2185, codes for the scope of designation of MDR and IVDR notified bodies, EUR-Lex eur-lex.europa.eu/eli/reg_impl/2017/2185/oj
9. Regulation (EU) 2023/1230 on machinery, Articles 26 to 42 and 54, EUR-Lex eur-lex.europa.eu/eli/reg/2023/1230/oj
10. Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 32, Chapter IV and Article 71, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
11. Mutual recognition agreements, European Commission (DG GROW) single-market-economy.ec.europa.eu/single-market/goods/international-aspects/mutual-recognition-agreements_en
12. Accessing EU markets, European Commission (mutual recognition agreements), European Commission (DG TRADE) policy.trade.ec.europa.eu/help-exporters-and-importers/accessing-markets_en