Importer, distributor, and authorised representative obligations
In short
Not every organisation in a high-risk AI system’s supply chain builds it or uses it, importers, distributors, and authorised representatives each carry a distinct obligation set that makes them accountable checkpoints, not passive intermediaries.
Importers (Article 23), the EU-side gatekeeper
Before placing a high-risk AI system from outside the EU on the market, an importer must verify the provider has completed the conformity assessment, drawn up the technical documentation, affixed the CE marking, and (where required for a non-EU provider) appointed an authorised representative. If the importer has reason to believe the system is not conforming, it must not place the system on the market until conformity is verified, and must inform the provider and the relevant market surveillance authority instead of proceeding anyway.
Distributors (Article 24), the last checkpoint before the end user
Before making a high-risk system available on the market, a distributor must verify it carries the CE marking and is accompanied by the EU declaration of conformity and instructions for use, and must verify the provider and importer (where applicable) met their own obligations. As with importers, a distributor with reason to believe a system is non-conforming must not make it available until conformity is verified.
Authorised representatives (Article 22), the EU point of contact for non-EU providers
A provider established outside the EU must appoint, by written mandate, an authorised representative established in the EU before making a high-risk system available. The mandate must cover, at minimum: verifying the declaration of conformity and technical documentation were drawn up, keeping both at authorities’ disposal for 10 years, providing information and documentation on request, cooperating with authorities, and being reachable for enquiries. If the representative comes to consider the provider is acting contrary to the Act, it must terminate the mandate and inform the relevant market surveillance authority, an active duty, not just a right to quietly step away.
Ongoing duties that outlast the initial check
Beyond the point-in-time verification, importers and distributors carry continuing obligations: indicating their name and contact details on the system or its documentation, ensuring storage and transport conditions do not compromise conformity, keeping a copy of the declaration of conformity available for authorities, taking corrective action ( including withdrawal or recall) where non-conformity is identified, and cooperating with and proactively informing authorities of any risk the system presents.
These roles are frequently underestimated because none of them require building or using the AI system directly, but each one carries independent legal exposure. A company that simply resells or re-imports third-country AI systems into the EU market is not shielded from liability by the fact that someone else built the underlying system.
Frequently asked questions
- What must an importer of a high-risk AI system check?
- Before placing a non-EU high-risk system on the market, an importer must verify (Article 23) that the provider completed the conformity assessment, drew up the technical documentation, affixed the CE marking, and (where required) appointed an authorised representative. If it suspects non-conformity, it must not place the system on the market.
- What are a distributor's obligations under the EU AI Act?
- Before making a high-risk system available, a distributor must verify (Article 24) it carries the CE marking and is accompanied by the EU declaration of conformity and instructions for use, and that the provider and importer met their obligations. It must not make a suspected non-conforming system available.
- When does a non-EU provider need an authorised representative?
- A provider established outside the EU must appoint an EU-established authorised representative by written mandate before making a high-risk system available (Article 22). The representative verifies and keeps the declaration and technical documentation for 10 years, cooperates with authorities, and must terminate the mandate and inform authorities if the provider acts contrary to the Act.
Related guides
Not sure where your company stands?
Our free assessment gives you an indicative result in minutes (free and anonymous) no account needed.
Start the free check