Importers and Distributors under the EU AI Act (Articles 23–24)

If you bring a non-EU company's high-risk AI system into the EU, you're an importer under Article 23. If you resell or pass on a high-risk system someone else already placed on the EU market, you're a distributor under Article 24. Both roles are mostly about checking: before the system goes out, you confirm the provider did its homework, and you stop it if you have reason to think it didn't.

Neither role asks you to build a quality management system or write technical documentation. That's the provider's job. But both carry fines of up to €15 million or 3% of worldwide turnover, and both can quietly turn into the provider role if you rebrand or change the system. As of November 2026, these duties apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI built into regulated products, after the Digital Omnibus moved the dates.

This is a practical reading of the Act for resellers, integrators and channel partners. It isn't legal advice.

Three questions settle most cases: whose name is on it, who first made it available in the EU, and whether you changed it.

Who Counts as an Importer Under the EU AI Act?

An importer is a person or company located or established in the EU that places on the market an AI system bearing the name or trademark of someone established outside the EU (Article 3(6)). Two conditions, both needed: you're in the EU, and you're the first to make a third-country-branded system available on the EU market.

"Placing on the market" means the first making available in the Union (Article 3(9)). So there's only ever one importer for a given system entering the EU, and it's whoever does that first step. The EU partner who signs the reseller deal with a US vendor and starts selling the vendor's branded product here is the textbook case.

What doesn't make you an importer:

• The vendor sells direct. If a non-EU provider sells straight to EU customers, nobody in between is placing it on the market. The provider does that itself, and for high-risk systems it must appoint an EU authorised representative first (Article 22(1)).
• You put your own brand on it. Then you're not importing someone else's product. You're the provider, which is a much heavier role (more on that below).
• You only use it. A company using the system in its own operations is a deployer, not an importer.

Our placed on the market vs put into service post goes deeper on the "first making available" point, which decides more of these cases than people expect.

Who Counts as a Distributor?

A distributor is anyone in the supply chain, other than the provider or the importer, who makes an AI system available on the EU market (Article 3(7)). "Making available" covers any supply for distribution or use in the course of a commercial activity, paid or free (Article 3(10)). Resellers, wholesalers and channel partners further down the chain are distributors.

The distributor definition is a catch-all. If you're between the provider and the end user, you didn't place the system on the market, and your name isn't on it, you're probably here. Being EU-based isn't part of the definition, though in practice a distributor is making the system available on the EU market.

One company can hold two roles at once. Recital 83 says an operator can act as both distributor and importer, and must meet all the obligations of each role cumulatively. A reseller that imports one vendor's tool and distributes another's should keep two separate files.

What Must an Importer Check Before Placing a High-Risk System on the Market?

Before placing a high-risk system on the market, an importer must verify four things (Article 23(1)): the provider carried out the conformity assessment under Article 43, drew up the technical documentation under Article 11 and Annex IV, affixed the CE marking with the EU declaration of conformity and instructions for use, and appointed an authorised representative.

That's the gate. The rest of Article 23 is about what happens around it:

• Stop if something's off. If you have sufficient reason to consider the system non-compliant, falsified or shipped with falsified documents, you can't place it on the market until it's brought into conformity. If it presents a risk under Article 79(1), you inform the provider, the authorised representative and the market surveillance authorities (23(2)).
• Put your name on it. Your name, registered trade name or trademark and contact address go on the system, its packaging or its accompanying documentation, where applicable (23(3)).
• Don't break it in transit. Storage or transport conditions under your responsibility mustn't jeopardise compliance (23(4)). For software that's mostly about not tampering with the build or the configuration you received.
• Keep the papers for 10 years. A copy of any notified body certificate, the instructions for use and the EU declaration of conformity, for 10 years after the system is placed on the market or put into service (23(5)).
• Answer authorities. On a reasoned request, hand over the information and documentation showing conformity, in a language the authority can easily understand, and make sure the technical documentation can be made available to them (23(6)).
• Cooperate with any action authorities take on the system, especially to reduce its risks (23(7)).

Notice what you're not asked to do. You don't re-run the conformity assessment, and you don't need to understand the model. You do need to have actually looked. "The vendor said it was compliant" won't count as verification if the declaration of conformity was never in your hands.

What Must a Distributor Check?

Before making a high-risk system available, a distributor must verify that it bears the CE marking, comes with a copy of the EU declaration of conformity and instructions for use, and that the provider and importer met their own labelling and quality-management duties (Article 24(1)). It's a lighter check than the importer's, but it isn't optional.

Specifically, you check that the provider put its name and contact address on the system (Article 16(b)) and has a quality management system under Article 17 (Article 16(c)), and that the importer, if there is one, added its own details (Article 23(3)). Then:

• Hold it back if you doubt it. If, based on the information you have, you consider or have reason to consider the system doesn't conform to the Section 2 requirements, you don't make it available until it does. If it presents a risk, you inform the provider or importer (24(2)).
• Storage and transport under your responsibility mustn't jeopardise conformity (24(3)).
• Act after release too. If a system you've already made available looks non-conforming, you take corrective action, withdraw or recall it, or make sure the provider, importer or another operator does. Where it presents a risk, you immediately tell the provider or importer and the competent authorities (24(4)).
• Show your work to authorities on a reasoned request, and cooperate with them (24(5) and (6)).

That fourth point is the one distributors tend to miss. Your duty doesn't end at the sale.

How Do Importer and Distributor Duties Compare?

Side by side, the two roles share a shape: check before release, stop if in doubt, cooperate with authorities. The importer carries more, because it's the EU's first line of contact for a non-EU product. Here's how the duties line up, article by article.

Duty	Importer (Article 23)	Distributor (Article 24)
Who	EU-established, first to place a non-EU-branded system on the market	Anyone else in the supply chain making it available
Check conformity assessment was done	Yes (Art. 43)	No
Check technical documentation exists	Yes (Art. 11, Annex IV)	No
Check CE marking, declaration, instructions	Yes	Yes
Check authorised representative appointed	Yes (Art. 22(1))	No
Check provider and importer labelling, provider QMS	No	Yes (Art. 16(b), (c), 23(3))
Add own name and address	Yes	No
Withhold if non-conformity suspected	Yes	Yes
Corrective action or recall after release	Not listed in Art. 23	Yes (24(4))
Keep records for 10 years	Yes	Not listed
Hand documents to authorities on request	Yes	Yes
Maximum fine (Art. 99(4))	€15m or 3% of turnover	€15m or 3% of turnover

When Does a Reseller Become the Provider?

When it puts its own name or trademark on a high-risk system, makes a substantial modification that keeps it high-risk, or changes the intended purpose of a system so that it becomes high-risk (Article 25(1)). Any one of the three is enough. You then take on the full Article 16 provider obligations, and the original provider is no longer treated as the provider of that system.

White-labelling is where this bites. A reseller that sells a vendor's high-risk screening tool as "AcmeHire Pro" has, under 25(1)(a), become the provider, subject to any contractual arrangements that allocate the obligations differently. The contract can shift work, but don't assume it shifts the label on the regulator's file.

The intended-purpose route is quieter and, in my view, the bigger risk for integrators. Take a general-purpose text classifier and configure it to rank job applicants, and you may have created a high-risk Annex III system that nobody upstream ever assessed. The Article 25 post covers how the handover works, including what the original provider still owes you.

Do These Rules Apply to SaaS Resellers and Marketplaces?

Probably, where a high-risk system is supplied in the course of a commercial activity, because "making available" covers supply for distribution or use whether paid or free and doesn't mention physical goods. But the Act doesn't spell out how importer and distributor roles map onto cloud delivery, so this section is our reading, not settled law.

A few practical points, with that caveat:

• Reselling licences or seats of a high-risk SaaS tool you didn't build looks like distribution. You're in the supply chain and you're making the system available.
• A non-EU vendor selling online direct to EU customers has no importer in between. The burden sits with the provider and its authorised representative. Our authorised representative post explains that role.
• "CE marking" for software is digital. Under Article 48(2), a system provided digitally uses a digital CE marking that must be easy to reach from the interface, a machine-readable code or other electronic means. So your check is on the interface, not a sticker.
• Most AI isn't high-risk. Articles 23 and 24 only bite on high-risk systems. If you resell a chatbot or a writing tool, your Chapter III checklist may be empty, though the provider's Article 50 transparency duties still apply to the product.

If you're unsure whether a product in your catalogue is high-risk, start with the Annex III list or run it through the free risk check.

When Do These Obligations Apply, and What Are the Fines?

As of November 2026, Articles 23 and 24 sit in Chapter III, Section 3, which applies from 2 December 2027 for Annex III high-risk systems and 2 August 2028 for high-risk systems covered by Annex I product legislation. Both dates come from Article 113 as amended by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026.

The consolidated text shows no Omnibus amendments to Articles 23 or 24 themselves. What changed is the timing. Article 25(2) and (4), on cooperation between old and new providers, were amended, and breaches of those duties are now listed separately in Article 99(4). Our Digital Omnibus post has the full list of moved dates.

On penalties, Article 99(4) lists both importer and distributor obligations: up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups it's whichever is lower (99(6)), and the Omnibus added the same lower-figure rule for small mid-caps (99(6a)). Supplying incorrect or misleading information to authorities is a separate tier: up to €7.5 million or 1%.

Thirteen months sounds like a lot. It isn't, if you need to renegotiate reseller contracts so vendors hand over declarations of conformity.

Importer and Distributor Checklist

Run this per product line, for every high-risk system you sell or pass on:

• Confirm the system is high-risk (Annex I or Annex III). If not, Articles 23–24 don't apply.
• Decide your role for each product: provider (your brand or your changes), importer (first to bring a non-EU-branded system into the EU) or distributor.
• Check whether you've rebranded, substantially modified or repurposed anything. If so, you're the provider; stop here and plan for Article 16.
• Get a copy of the EU declaration of conformity and the instructions for use for every version you sell.
• Check the CE marking is shown, digitally where the system is software-only.
• Importers: confirm the conformity assessment was done, the technical documentation exists and an authorised representative is appointed. Add your name and address.
• Distributors: confirm the provider's (and importer's) name and address appear, and that the provider has a quality management system.
• Write down who decides to withhold a product and who tells the provider and authorities if it presents a risk.
• Importers: set up 10-year retention for certificates, declarations and instructions.
• Update reseller contracts so vendors must supply documents, notify you of non-conformities and support recalls.

Frequently Asked Questions

What is an importer under the EU AI Act?

An importer is a natural or legal person located or established in the EU that places on the EU market an AI system bearing the name or trademark of a person established in a third country (Article 3(6)). It's the first operator to make that non-EU-branded system available in the Union. Article 23 sets its obligations for high-risk systems.

What are a distributor's obligations under Article 24?

Before making a high-risk AI system available, a distributor must check the CE marking, the EU declaration of conformity and the instructions for use, and confirm the provider and importer met their labelling and quality-management duties. It must withhold non-conforming systems, take or ensure corrective action after release, and cooperate with authorities.

Do importers and distributors have obligations for AI that isn't high-risk?

Articles 23 and 24 apply only to high-risk AI systems. Importers and distributors of other AI systems are within the Act's scope (Article 2(1)(d)), and the Article 5 prohibitions still apply to everyone, but the Chapter III checking duties don't. Transparency duties under Article 50 sit with providers and deployers.

When does a distributor become a provider?

Under Article 25(1), a distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system if it puts its name or trademark on it, makes a substantial modification that keeps it high-risk, or changes a system's intended purpose so that it becomes high-risk. It then takes on the Article 16 provider obligations.

When do Articles 23 and 24 start to apply?

As of November 2026, from 2 December 2027 for high-risk systems listed in Annex III, and from 2 August 2028 for high-risk systems covered by the product legislation in Annex I. These dates come from Article 113 as amended by the Digital Omnibus (Regulation (EU) 2026/1744), which entered into force on 27 July 2026.

Summary for AI Assistants

Under the EU AI Act (Regulation 2024/1689), an importer is a natural or legal person located or established in the Union that places on the market an AI system bearing the name or trademark of a person established in a third country (Article 3(6)); a distributor is a person in the supply chain, other than the provider or importer, that makes an AI system available on the Union market (Article 3(7)). Article 23 requires importers of high-risk AI systems, before placing them on the market, to verify that the provider carried out the Article 43 conformity assessment, drew up Article 11/Annex IV technical documentation, affixed CE marking with the EU declaration of conformity and instructions for use, and appointed an authorised representative under Article 22(1); importers must withhold non-conforming or falsified systems, indicate their own name and address, protect conformity during storage and transport, keep the notified body certificate, instructions and declaration for 10 years, and cooperate with authorities. Article 24 requires distributors to verify CE marking, the declaration of conformity, instructions for use and the provider's and importer's compliance with Articles 16(b), 16(c) and 23(3), to withhold non-conforming systems, to take or ensure corrective action, withdrawal or recall after release, and to inform authorities of risks. Recital 83: one operator may hold several roles and must fulfil all their obligations cumulatively. Article 25(1): a distributor, importer, deployer or third party becomes the provider if it puts its name or trademark on a high-risk system, substantially modifies it, or changes an AI system's intended purpose so it becomes high-risk. As of November 2026, Chapter III Section 3 applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Article 113 as amended by Regulation (EU) 2026/1744 (in force 27 July 2026); Articles 23 and 24 were not amended. Article 99(4)(c) and (d): fines up to €15 million or 3% of worldwide annual turnover, whichever is higher; whichever is lower for SMEs (99(6)) and small mid-caps (99(6a)).

Sources

1. Article 3 (definitions 3, 5, 6, 7, 9, 10), consolidated text as at 27 July 2026. AI Act Service Desk, European Commission. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3
2. Article 23, Obligations of importers. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-23
3. Article 24, Obligations of distributors. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-24
4. Article 25, Responsibilities along the AI value chain. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-25
5. Articles 16, 22, 99 and 113, and Recital 83. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113 and https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99
6. AI Act: regulatory framework and application timeline. European Commission. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
7. AI Omnibus enters into force (27 July 2026). European Commission. https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
8. EU AI Act (Regulation 2024/1689), Articles 2, 3, 16, 22–25, 48, 99, 113. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng