Governance by and of Intermediaries in the European Regime of Artificial Intelligence (2018-2026)

This article examines how and why European rule-makers have chosen to rely on notified bodies and conformity assessment to verify, certify, and monitor compliance despite their weak accountability. The case study is the European Union’s emerging regime for high-risk artificial intelligence. It addresses three research questions: First, how did the regulatory regime of notified bodies evolve during the policy process of the AI Act between 2018 and 2026? Second, how should this system of governance by and of intermediaries be characterized? Third, what factors explain the EU’s decision to rely on regulatory intermediaries? The article conceptualizes notified bodies as regulatory intermediaries situated between rule-makers, market actors, and affected publics and the conformity assessment as a mechanism of intermediation. The article argues that the AI Act does not merely delegate a technical function of conformity assessment. Rather, it institutionalizes a broader regime of governance by and of intermediaries, in which private or semi-private actors are expected to translate public objectives into ex ante verification practices while intermediaries themselves are governed through accreditation, designation, notification, and supervisory controls. The core policy puzzle is that although providers formally retain legal responsibility for compliance, the practical credibility of the regime depends to a significant extent on the competence, independence, and accountability of notified bodies. Yet the accountability arrangements governing them remain relatively thin and fragmented. To explain this underdevelopment, the article presents three competing hypotheses centered on interests, institutions, and ideas. It proposes a theory-testing process-tracing design that combines qualitative document analysis, conceptual analysis, and elite interviews. In doing so, the article offers a framework for studying the legitimacy, advantages, and limits of intermediary-based verification.