If you buy a high-risk AI system from a non-EU provider and sell it in Europe, or if you make a high-risk AI system available in the market without developing it yourself, the EU AI Act gives you your own independent obligations. Article 23 covers importers. Article 24 covers distributors. Both apply from 2 August 2026. And under Article 25, certain actions — like rebranding or substantially modifying a system — make you a provider with significantly heavier obligations.
Placing a non-compliant system on the market is a breach
Importers and distributors who fail their verification obligations — or who continue to supply a system they know is non-compliant — face the Art 99(4) penalty: up to €15 million or 3% of global annual turnover. These obligations apply to you even if the system was developed by someone else. “The provider said it was compliant” is not sufficient — you must verify.
Not sure if you’re an importer, distributor — or actually a provider?
The distinction matters: providers face 7x more obligations than distributors. Regumatrix identifies your role, maps your exact obligation chain, and quantifies your fine exposure — in about 30 seconds.
Check in 30 seconds — 3 free analysesThe EU AI Act uses precise definitions for each role. Getting the classification right matters because obligations differ — and certain actions can shift your role from distributor to provider.
Importer
Any natural or legal person established in the EU that places on the market a high-risk AI system which bears the name or trademark of a person established outside the EU.
Common example: A UK or US company develops an HR screening AI. A German reseller buys it and sells it to German businesses — the German reseller is the importer.
Distributor
Any natural or legal person in the supply chain, other than the provider or importer, that makes a high-risk AI system available on the market without altering its properties.
Common example: A software marketplace or reseller that lists and sells a validated AI system developed and CE-marked by a third-party provider.
Key boundary: The “without altering its properties” condition is critical for distributors. Any modification — including rebranding, configuration changes that go beyond the provider’s intended customisation options, or routing the system through your own API — may trigger Art 25 and make you a provider.
Before placing a high-risk AI system on the EU market, importers must verify four pre-market conditions. These are personal obligations — you cannot delegate them entirely to the foreign provider.
Pre-market verification checklist (Art 23(1))
The relevant conformity assessment procedure under Art 43 has been completed by the provider. You must obtain evidence — a conformity assessment certificate from the notified body, or a signed declaration of conformity for self-assessed systems.
The provider has drawn up technical documentation in accordance with Art 11 and Annex IV.
The system bears the required CE marking and is accompanied by the EU declaration of conformity ( Art 47 ) and instructions for use.
The provider has appointed an authorised representative in the EU under Art 22 (1). This does not apply if the provider is itself established in the EU.
Ongoing obligations during market presence
Art 23(2) — Blocking obligation
Where an importer has sufficient reason to consider that a high-risk AI system is not in conformity with the EU AI Act, or is falsified, or accompanied by falsified documentation — the importer must not place the system on the market until it has been brought into conformity. If the system presents a risk (Art 79(1)), the importer must also immediately inform the provider, the authorised representative, and the relevant market surveillance authorities.
Distributors have a lighter — but still real — verification obligation before making a high-risk AI system available. Unlike importers, distributors do not need to independently verify the underlying conformity assessment procedure; they rely on the CE marking and documentation already being in place.
Pre-availability verification (Art 24(1))
The system bears the required CE marking.
It is accompanied by a copy of the EU declaration of conformity (Art 47) and instructions for use.
The provider and importer (as applicable) have complied with obligations under Art 16(b)–(c) (provider labelling and instructions) and Art 23(3) (importer contact labelling).
Ongoing distributor obligations
Art 24(2) — Blocking obligation for distributors
Where a distributor has reason to consider that a high-risk AI system is not in conformity with Section 2 requirements — based on the information in their possession — they must not make it available until it has been brought into conformity. If it presents a risk (Art 79(1)), the distributor must inform the provider or importer of the system.
| Obligation | Importer (Art 23) | Distributor (Art 24) |
|---|---|---|
| Verify conformity assessment completed | ✅ Required | ❌ Not required |
| Verify technical documentation exists | ✅ Required | ❌ Not required |
| Verify CE marking + declaration of conformity | ✅ Required | ✅ Required |
| Verify instructions for use present | ✅ Required | ✅ Required |
| Verify authorised representative appointed | ✅ Required (if non-EU provider) | ❌ Not required |
| Check provider/importer labelling (Art 16(b)(c)) | ✅ (importer is the one labelling) | ✅ Verify it is done |
| Add own contact details to system/packaging | ✅ Required (Art 23(3)) | ❌ Not required |
| 10-year document retention | ✅ Required (Art 23(5)) | ❌ Not required |
| Cooperate with market surveillance | ✅ Required | ✅ Required |
| Block non-compliant system | ✅ Mandatory | ✅ Mandatory |
Article 25(1) converts any distributor, importer, deployer, or other third party into a provider with full provider obligations (Art 16 checklist) in three circumstances:
Rebranding — putting your name or trademark on the system
If you place your company name or brand on a high-risk AI system already on the market, you become the provider. This commonly applies to white-labelling arrangements — a reseller who sells an AI tool under their own brand is a provider, not a distributor. Note: contractual arrangements can re-allocate some obligations, but the AI Act position is the default.
Substantial modification — changing a deployed system in a material way
Making a substantial modification to a high-risk AI system already placed on the market or put into service — such that it remains high-risk under Art 6 — makes you the new provider. This includes retraining the AI model, changing its intended purpose, or altering its architecture in ways beyond the original provider’s pre-authorised parameters.
Purpose upgrade — making a non-high-risk system high-risk
Modifying the intended purpose of an AI system (including a GPAI model) that was not classified as high-risk, such that it becomes high-risk under Art 6, makes you the new provider for that system. A classic example: taking a general-purpose language model and deploying it specifically for employment screening — moving it into Annex III HR-4.
What happens to the original provider?
Under Art 25(2), once any of the three conditions above occur, the original provider ceases to be the provider of that specific AI system for AI Act purposes. However, the original provider must cooperate with the new provider — making available the necessary information, technical access, and assistance needed for the new provider to meet their AI Act obligations (including conformity assessment support). This does not apply if the original provider clearly specified that their AI system is not to be changed into a high-risk system.
Warning signals — you might be a provider without knowing it
If you are an IMPORTER
If you are a DISTRIBUTOR
No changes are proposed under COM(2025) 836 or COM(2025) 837 for Articles 23 or 24 (importer and distributor obligations). These articles apply in full from 2 August 2026.
Under Article 3 of the EU AI Act: an importer is any natural or legal person established in the EU that places on the market a high-risk AI system which bears the name or trademark of a person established outside the EU. A distributor is any natural or legal person in the supply chain, other than the provider or the importer, that makes a high-risk AI system available on the market without altering its properties. The key distinction is establishment: importers bring systems into the EU from non-EU providers; distributors make already-available EU-market systems accessible to end users.
Article 23(1) requires importers to verify four things before market placement: (a) the required conformity assessment procedure under Article 43 has been completed by the provider; (b) the provider has prepared technical documentation in accordance with Article 11 and Annex IV; (c) the system bears the required CE marking and is accompanied by the EU declaration of conformity (Article 47) and instructions for use; (d) the provider has appointed an authorised representative in the EU under Article 22(1). If any of these checks fail, the importer must not place the system on the market until the deficiency is remedied.
Article 24(1) requires distributors to verify three things before making a system available: (1) the system bears the required CE marking; (2) it is accompanied by a copy of the EU declaration of conformity (Article 47) and instructions for use; (3) the provider and importer, as applicable, have complied with their respective obligations under Article 16(b) and (c), and Article 23(3) (importer contact labelling). Distributors have a lighter verification obligation than importers — they rely on CE marking already being in place rather than having to independently verify the underlying conformity assessment procedure.
Yes — Article 25(1) sets out three circumstances where an importer, distributor, or any other third party becomes a provider: (a) they put their name or trademark on the system (rebranding); (b) they make a substantial modification to the system; (c) they modify the intended purpose of an AI system so that it becomes high-risk. Once any of these applies, the original provider loses their provider status for that system, and the new entity must fulfil all provider obligations under Article 16 — including conformity assessment, technical documentation, CE marking, and EU database registration.
Article 23(5) requires importers to keep, for a period of 10 years after the high-risk AI system has been placed on the market or put into service: (1) a copy of any certificate issued by the notified body (where applicable); (2) instructions for use; (3) the EU declaration of conformity referred to in Article 47. Importers must also be able to provide this documentation to competent authorities upon a reasoned request, and ensure that technical documentation can be made available to those authorities (Article 23(6)).
Importers and distributors who breach their obligations under Articles 23 or 24 fall within the Article 99(4) penalty tier (violations of high-risk AI obligations): up to €15 million or 3% of global annual turnover, whichever is higher. For SMEs and startups, Article 99(6) provides that the lower of the two figures applies. Additionally, if an importer or distributor takes on provider status under Article 25 and then fails to meet provider obligations, they become subject to the same penalties as any other provider — potentially including the same €15M/3% fines for Chapter III Section 2 violations.
AI Provider Obligations (Art 16)
Full checklist for developers and vendors — Arts 9–21, conformity, CE marking, registration.
Product Manufacturers Adding AI (Art 25)
When integrating AI into your product under your brand makes you the provider.
Non-EU AI Companies Selling Into Europe
Extraterritorial reach, authorised representative, and obligations for US/UK/Asian providers.
Conformity Assessment (Art 43)
Self-assessment vs notified body — what importers need to verify.
CE Marking for AI Systems
Arts 47–48: what CE marking means, what it requires, and how to verify it.
Is My AI High-Risk?
Determine whether the system you are importing or distributing is high-risk.
