Article 23 requires an importer, before placing a high-risk AI system on the market, to ensure that the provider has carried out the conformity assessment, drawn up the technical documentation, and, where applicable, appointed an authorised representative, and to verify that the system bears the required CE marking, is accompanied by the EU declaration of conformity and instructions for use, and that the provider has complied with the identification duties in Article 16. An importer must indicate its own name and contact address, ensure storage and transport conditions do not jeopardise conformity, keep documentation and logs available, take corrective action and inform authorities where the system presents a risk or is not in conformity, and cooperate with authorities. Where the importer considers or has reason to consider that a system is not in conformity, it must not place it on the market.
Who is an importer under the Act?
An importer is a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a person established outside the Union. The definition turns on location, market act, and branding: the system bears a third-country person's name, and the importer is the Union-based person that first makes it available on the Union market. A Union subsidiary that imports its parent company's system, a distributor that first places a third-country system on the market, and an agent that places a system on the market in its own capacity can each be an importer on the facts. The role should be identified before the first market act, because the verification duties must be completed before placement, not after the system is already supplied.
What must be verified before placement?
Before placement, the importer must ensure the provider has carried out the relevant conformity assessment procedure, has drawn up the technical documentation, and has appointed an authorised representative where Article 22 requires it. The importer must verify that the system bears the CE marking where required, is accompanied by the EU declaration of conformity and the instructions for use, and that the provider has indicated its name and contact details as Article 16 requires. Verification means checking the documents and the marking, not merely accepting a supplier assurance. The importer should record what was checked, the document versions, and the result, and should hold the check until any gap is closed. A system with missing documentation, missing marking, or no authorised representative where one is required must not be placed on the market.
For the broader regulatory framework, see deployer responsibilities.
What identification and storage duties apply?
The importer must indicate its name, registered trade name or registered trademark, and its address at which it can be contacted, on the system or, where that is not possible, on its packaging or accompanying documentation. The importer must also ensure that, while the system is under its responsibility, storage and transport conditions do not jeopardise its conformity with the Chapter III requirements. Storage and transport conditions matter for physical products and for systems supplied on media or hardware, and they can also matter for software where the deployment environment affects performance. The importer should record the storage and transport arrangements, the conditions maintained, and the checks performed, so that conformity at the point of supply can be shown.
What record keeping and cooperation duties apply?
The importer must keep a copy of the EU declaration of conformity, the technical documentation, and, where applicable, the certificate issued by the notified body, for ten years after the system was placed on the market, and must provide that information to authorities on request. The importer must also keep automatically generated logs to the extent they are under its control, and must cooperate with authorities on a reasoned request. Record keeping should be organised so that the file for each system, version and batch can be produced promptly, in the language the Member State requires. A file that is held by the provider but not available to the importer does not satisfy the importer's duty, because the importer must be able to produce it itself.
What must an importer do where a system is non-conforming or risky?
Where an importer considers or has reason to consider that a high-risk system is not in conformity, it must not place it on the market, and must inform the provider and the market surveillance authority. Where a system presents a risk, the importer must inform the provider, the market surveillance authority, and, where applicable, the notified body, and must take corrective action, including withdrawing or recalling the system, as appropriate. The importer must also inform deployers and distributors where they are affected. The duty is triggered by considering or having reason to consider non-conformity or risk, not only by proof of harm. An importer that learns of a problem from a deployer, a distributor or an authority should treat the report as a trigger for assessment and action, and should record the decision.
Continue with distributor duties under Article 24.
What is not decided by this guide?
This guide explains Article 23 in outline. It does not decide whether a particular person is an importer, whether verification is sufficient, or whether a system must be withheld from the market. Those questions need the branding, the location, the market act, the documents checked, and the risk facts, read against Article 23 in the consolidated text. Importer decisions affect market access and the supply chain, so borderline cases should be confirmed with a competent authority or legal adviser before the system is placed on the market.
Frequently asked questions
Is every Union buyer an importer?
No. An importer places a system on the market that bears a third-country person's name or trademark. A buyer that only uses a system under its authority is a deployer, and a seller that makes a system available without placing it on the market for the first time may be a distributor. The market act and branding decide the role.
Can an importer rely on the provider's assurance that conformity is done?
No, not alone. Article 23 requires the importer to ensure and verify the conformity assessment, documentation, authorised representative, marking, declaration and instructions before placement, and to record the verification. An assurance without checking the documents does not meet that duty.
How long must an importer keep documentation?
Ten years after the system was placed on the market, for the declaration, technical documentation and any notified body certificate, under Article 23, read with the documentation keeping duties. Logs have their own periods and must be kept to the extent they are under the importer's control.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗