NoBo vs DeBo vs AsBo: who assesses what in rail certification

Q: Who appoints each body?

A NoBo is notified by a Member State to the European Commission (and appears in the NANDO database). A DeBo is designated by a Member State for its own national rules. An AsBo is accredited or recognised for CSM-RA work (commonly to ISO/IEC 17020). The distinction between notified, designated and accredited/recognised is the giveaway to which body you are dealing with.

Q: Is an AsBo always required?

An AsBo is required whenever a change is assessed as significant under the CSM-RA. The proposer first applies the significance criteria in Regulation (EU) 402/2013; if the change is not significant, the full CSM-RA process (and therefore an independent AsBo) is not triggered. If it is significant, independent assessment by an AsBo is mandatory.

Who this is for: engineers, project managers and newcomers to European rail certification who keep tripping over three near-identical acronyms. NoBo, DeBo and AsBo sound alike and are often engaged on the same project, but they assess different things, under different legislation, and answer to different appointing authorities. Here is the clean version.

The three bodies at a glance

Body	Full name	Assesses conformity against…	Legal framework	Output
NoBo	Notified Body	The TSIs (EU-level technical rules)	Interoperability Directive (EU) 2016/797	EC certificate of verification
DeBo	Designated Body	National technical rules	Same directive, national-rules route	Certificate of verification vs national rules
AsBo	Assessment Body	The applicant's risk-management process for a significant change	CSM-RA, Regulation (EU) 402/2013	Safety assessment report

The one-line distinction to memorise: NoBo = European rules, DeBo = national rules, AsBo = the risk process itself. The first two check that a subsystem conforms to technical specifications; the third checks that you managed risk properly.

Notified Body (NoBo)

A Notified Body performs conformity assessment against the Technical Specifications for Interoperability (TSIs). The TSIs are the EU-wide technical rules that make the rail system interoperable across borders — for rolling stock, control-command and signalling, infrastructure, energy and so on.

A NoBo is notified to the European Commission by a Member State (and listed in the Commission's NANDO database), having been assessed as competent — typically accredited to the relevant conformity-assessment standards. On completion of its work, the NoBo issues an EC certificate of verification for the subsystem (or an EC certificate of conformity for an interoperability constituent), which feeds into the "EC" declaration of verification the applicant draws up.

Familiar names operating as NoBos across Europe include the certification arms of bodies such as TÜV SÜD, TÜV Rheinland, SGS, DEKRA, Ricardo Certification, Lloyd's Register and CERTIFER — but which body and which scope matters more than the brand, because notification is granted per subsystem and per assessment module.

Which subsystems and modules a NoBo covers

A NoBo's notification is scoped: a body notified for the rolling stock subsystem is not automatically notified for control-command and signalling. Within that scope, the NoBo applies conformity-assessment modules — the standard EU menu (module SB for type examination, SD/SF for production-phase verification, SH1 for a full quality-management-system route, and so on). The applicant chooses a permitted module combination; the NoBo executes the assessment and issues the certificate. For how the modules map to the EC verification route, see TSI LOC&PAS requirements.

Designated Body (DeBo)

A Designated Body does the same kind of work as a NoBo — verification of a subsystem — but against national technical rules rather than the TSIs. National rules are the legitimate national complement to the TSIs: they cover open points (where the TSI deliberately leaves a topic to Member States), specific cases, and areas not yet harmonised at EU level.

A DeBo is designated by the Member State (not notified to the Commission), and its remit is that state's notified national rules. The output is a certificate confirming the subsystem meets the applicable national requirements, which sits alongside the NoBo's EC certificate in the authorisation dossier.

When a DeBo is needed alongside a NoBo

You need both whenever the vehicle or subsystem is subject to national rules in addition to the TSIs — which, in practice, is most real projects. The TSIs rarely cover everything: open points and specific cases remain, and any network with legacy characteristics carries national rules for compatibility. So a typical authorisation runs two parallel assessment streams: the NoBo against the TSIs, the DeBo against each relevant Member State's national rules. Note that one accredited organisation is frequently designated for both roles (see the FAQ) — but the two hats, and the two certificates, remain distinct.

Assessment Body (AsBo / CSM)

An Assessment Body performs independent assessment of the applicant's risk management under the Common Safety Method for Risk Assessment (CSM-RA), Regulation (EU) 402/2013. This is a fundamentally different activity from conformity assessment.

When a proposer makes a significant change to the railway system — technical, operational or organisational — the CSM-RA requires them to run a structured risk-assessment process (hazard identification, risk evaluation against acceptance principles, and the definition and management of safety requirements). The AsBo independently assesses whether that process was applied correctly and completely, and issues a CSM safety assessment report. The AsBo must be independent of the design, risk assessment, manufacture, operation and maintenance of the system under assessment, and is typically accredited or recognised to ISO/IEC 17020.

How the AsBo's remit differs from conformity assessment

This is the distinction people most often get wrong:

A NoBo/DeBo asks "does this subsystem conform to the rules?" — a technical, specification-driven check.
An AsBo asks "did you assess and manage the risk of this change correctly?" — a process-driven check of your risk management.

An AsBo does not certify that a train is safe; it gives assurance that the risk-assessment process behind a change was sound. The two are complementary. Note also a related-but-separate role: the independent safety assessor (ISA) referred to in the CENELEC EN 5012x standards is a distinct concept from the CSM AsBo, though the same organisation may perform both — don't assume they are interchangeable on your project.

How the three fit together in a vehicle authorisation

Consider a new passenger vehicle to be authorised for a single Member State plus one neighbour:

NoBo assesses the subsystems against the applicable TSIs (rolling stock, CCS, noise, PRM) and issues EC certificate(s) of verification.
DeBo(s) assess the same vehicle against the notified national rules of each state of intended use, issuing national certificate(s).
AsBo independently assesses the risk management for the change under the CSM-RA and issues the safety assessment report.
The applicant compiles all of this into a single dossier and submits an application for a vehicle type authorisation / authorisation for placing on the market.
Since the 4th Railway Package, the European Union Agency for Railways is the authorising entity for vehicles used in more than one Member State (via its One-Stop Shop), while a National Safety Authority may authorise vehicles for a single state. The authorising entity relies on the NoBo, DeBo and AsBo outputs — it does not redo their work.

For the end-to-end process, see TSI LOC&PAS requirements on what the rolling-stock TSI actually requires of that dossier.

Frequently asked questions

Can one organisation be both NoBo and DeBo?

Yes. It is common for a single accredited certification body to be notified for TSI conformity assessment and designated for national-rules assessment, and to perform both on the same project. The roles, scopes and certificates remain legally distinct even when the letterhead is the same. Whether the same body can also act as your AsBo depends on independence rules and the project's separation requirements.

Who appoints each body?

A NoBo is notified by a Member State to the European Commission (and appears in the NANDO database). A DeBo is designated by a Member State for its own national rules. An AsBo is accredited or recognised for CSM-RA work (commonly to ISO/IEC 17020). The distinction between notified, designated and accredited/recognised is the giveaway to which body you are dealing with.

Is an AsBo always required?

An AsBo is required whenever a change is assessed as significant under the CSM-RA. The proposer first applies the significance criteria in Regulation (EU) 402/2013; if the change is not significant, the full CSM-RA process (and therefore an independent AsBo) is not triggered. If it is significant, independent assessment by an AsBo is mandatory.

How does the Agency (ERA) fit in?

Since the technical pillar of the 4th Railway Package took effect, the European Union Agency for Railways acts as the EU-level authority for vehicle authorisations across multiple Member States and for single safety certificates, operating a One-Stop Shop for applications. It is the authorising entity that relies on the assessment bodies' outputs — a different role from the NoBo, DeBo or AsBo, none of which it replaces.

Sources

ERA Standards is an independent product and is not affiliated with the European Union Agency for Railways. This guide is general information, not certification advice.