Importer and Distributor Obligations Under the EU AI Act

Most explanations of the EU AI Act describe two roles: the provider who builds the system and the deployer who uses it. The Regulation defines six operators, and the two in the middle — importer and distributor — carry their own verification duties, their own document retention period, and their own exposure to fines.

Four operator roles, not two

Article 3 of Regulation (EU) 2024/1689 defines “operator” to include the provider, the product manufacturer, the deployer, the authorised representative, the importer and the distributor. An importer is a natural or legal person located or established in the Union that places on the market an AI system bearing the name or trademark of a person established in a third country. A distributor is any operator in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.

The distinction turns on geography and on sequence, not on size. A European reseller of a US-built high-risk system is an importer if it is the one placing that system on the Union market for the first time, and a distributor if somebody else did that first. An integrator that ships a third-party high-risk component inside its own product may be neither — it may be a provider, for the reasons in Article 25 below.

What an importer must verify (Article 23)

Article 23(1) requires an importer, before placing a high-risk AI system on the market, to verify four things. This is a positive duty to check, not a duty to refrain from knowingly shipping something defective:

• that the conformity assessment procedure referred to in Article 43 has been carried out by the provider;
• that the provider has drawn up the technical documentation in accordance with Article 11 and Annex IV;
• that the system bears the required CE marking and is accompanied by the EU declaration of conformity under Article 47 and by the instructions for use;
• that the provider has appointed an authorised representative in accordance with Article 22(1) — which every third-country provider of a high-risk system must do.

Article 23(2) then says that where the importer has sufficient reason to consider that a system is not in conformity, is falsified, or is accompanied by falsified documentation, it must not place it on the market until it has been brought into conformity; and where the system presents a risk within the meaning of Article 79(1), it must inform the provider, the authorised representatives and the market surveillance authorities.

Three further duties are easy to miss. Article 23(3) requires the importer to indicate its name, registered trade name or trademark and contact address on the system, its packaging or its accompanying documentation — which is what makes an importer traceable at all. Article 23(4) requires that storage and transport conditions, while the system is under the importer’s responsibility, do not jeopardise compliance. And Article 23(5) requires the importer to keep, for ten years after the system has been placed on the market or put into service, a copy of any notified body certificate, of the instructions for use, and of the EU declaration of conformity. That is a records obligation on a party that may have stopped selling the product nine years earlier.

Article 23(6) requires the importer to provide national competent authorities, on a reasoned request, with all the information and documentation necessary to demonstrate conformity, including in a language those authorities can easily understand.

What a distributor must verify (Article 24)

Article 24(1) sets a lighter but still real check. Before making a high-risk AI system available on the market, the distributor must verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity and the instructions for use, and that the provider and, where applicable, the importer have complied with their identification obligations — Article 16(b) and (c) for the provider, Article 23(3) for the importer.

The distributor is not asked to verify that the conformity assessment happened or that the technical documentation exists. It is asked to verify that the paperwork accompanying the product is there and that the upstream parties are identified. The difference from the importer’s duty is deliberate: the importer is the Union’s point of entry for a third-country product and is treated as the party that must look behind the label.

The distributor’s harder obligations come after the sale. Under Article 24(4), a distributor that considers, or has reason to consider on the basis of the information in its possession, that a system it has already made available is not in conformity must take the corrective action necessary to bring it into conformity, withdraw it or recall it, or ensure that the provider, importer or other relevant operator does so. Where the system presents a risk within the meaning of Article 79(1), it must immediately inform the provider or importer and the relevant authorities. Article 24(5) requires it to be able to demonstrate all of this on a reasoned request.

“Information in its possession” is the phrase that decides how much a distributor has to notice. It does not create a duty to audit, and it does create a duty to act on what support tickets, customer complaints and provider notices actually tell you — which means a distributor that routes such signals nowhere has built the problem into its process.

How either becomes a provider (Article 25)

Article 25(1) is the provision that makes the middle roles risky rather than merely administrative. A distributor, importer, deployer or other third party is considered to be a provider of a high-risk AI system, and is subject to the provider obligations in Article 16, in any of three circumstances:

• They put their name or trademark on it. White-labelling an existing high-risk system makes you its provider — without prejudice to contractual arrangements allocating obligations differently between the parties, which reallocates the commercial burden but not the regulator’s counterparty.
• They make a substantial modification to a high-risk system already on the market, such that it remains high-risk under Article 6.
• They modify the intended purpose of a system, including a general-purpose AI system, that was not classified as high-risk, in such a way that it becomes high-risk under Article 6.

The third limb is the one that catches people building on general-purpose models. Nothing about the model changes; the intended purpose you declare for your system does, and if that purpose lands in Annex III you are the provider of a high-risk AI system with all of Article 16 attached. See what counts as a substantial modification and the integrator’s position under Article 25.

Article 25(2) softens the landing in one direction: where that happens, the original provider is no longer considered the provider of that specific system, but must cooperate closely with the new provider, make available the information and the reasonably expected technical access needed to comply, unless it has clearly specified that its system is not to be changed into a high-risk one.

What this looks like in a contract

The obligations above are non-negotiable as against the authorities, but almost all of them are discharged with information that only the provider has. That makes them contract terms in practice. An importer cannot verify that Annex IV technical documentation exists without a right to see it; a distributor cannot demonstrate what it verified without a copy of the declaration of conformity it can retain; neither can meet a reasoned request from an authority in an official language without a translation commitment from upstream.

The ten-year retention rule in Article 23(5) deserves its own clause because it outlives the commercial relationship, and the corrective action duty in Article 24(4) deserves one because a distributor exposed to a recall obligation with no contractual route to trigger it upstream is carrying a risk it cannot manage. See AI contract clauses that actually do something.

On exposure: under Article 99(4), non-compliance with the obligations of importers under Article 23 or distributors under Article 24 sits in the middle penalty band — administrative fines of up to €15,000,000 or, for an undertaking, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher, with the lower of the two figures applying to SMEs including start-ups. The full text is on EUR-Lex; the per-tier detail is in the penalty tiers.