In short
- Under Article 3(6) of the AI Act, the first EU company to place a non-EU provider's AI system on the market under that provider's name is the importer. Everyone after it in the chain is a distributor under Article 3(7).
- Article 23(1) lists 4 checks an importer must run before placing a high-risk AI system on the market, and point (d) is whether the provider has appointed an EU authorised representative.
- A non-EU provider without an authorised representative under Article 22(1) leaves the importer unable to complete its checks, so the system should not ship.
- Breaching the importer duties in Article 23 or the distributor duties in Article 24 carries administrative fines of up to EUR 15 000 000 or 3% of worldwide annual turnover under Article 99(4).
- Regulation (EU) 2026/1744 left Articles 22 to 24 unchanged but moved their application to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
Resellers, system integrators and EU subsidiaries of US vendors tend to assume that AI Act compliance is the vendor’s problem. For a high-risk AI system, the EU company that brings it in carries its own checklist, and the checklist can stop the sale.
Regulation (EU) 2024/1689 gives that company one of two roles, importer or distributor, and each comes with duties that apply before the first unit ships.
01Which role do you hold: importer or distributor?
Role under the AI Act follows position in the supply chain, not the label in your reseller agreement. Article 3(6) defines the importer as a person established in the Union that places on the market an AI system bearing the name or trademark of a person established in a third country. Article 3(7) defines the distributor as anyone else in the supply chain, other than the provider or the importer, that makes the system available on the Union market.
| Your position | Role | Provision | Duties |
|---|---|---|---|
| First EU seller, vendor's name on the system | Importer | Article 3(6) | Article 23 |
| Buys from an EU importer or EU provider and resells | Distributor | Article 3(7) | Article 24 |
| Holds the non-EU provider's written mandate | Authorised representative | Article 3(5) | Article 22 |
| Own name or trademark on the high-risk system | Provider | Article 25(1)(a) | Article 16 |
The last row is covered in detail in the piece on the three ways a deployer, importer or distributor becomes the provider. For this reading, the relevant point is that a white label deal takes a reseller out of the importer role entirely and into the full provider set. Everything below assumes the vendor’s name stays on the product.
02Which four checks stand between an importer and the EU market?
Article 23(1) of the AI Act requires an importer, before placing a high-risk AI system on the market, to ensure the system conforms by verifying four things. None of them asks the importer to redo the provider’s work. Each asks it to see evidence that the work exists.
| Check | Provision | Evidence to request |
|---|---|---|
| Conformity assessment carried out | Article 23(1)(a) | Procedure used under Article 43, notified body certificate if any |
| Technical documentation drawn up | Article 23(1)(b) | Confirmation of an Annex IV file, plus a route for authorities to reach it |
| CE marking, declaration, instructions | Article 23(1)(c) | Copy of the Article 47 declaration and the instructions for use |
| Authorised representative appointed | Article 23(1)(d) | Name, EU address and a copy of the Article 22 mandate |
A distributor’s list under Article 24(1) is shorter: CE marking, a copy of the declaration of conformity, instructions for use, and confirmation that the provider and the importer have put their names and contact addresses on the system as Articles 16(b) and 23(3) require, together with the provider’s quality management system under Article 16(c). Article 24(1) does not ask the distributor to verify the authorised representative. That check sits with the importer.
These questions belong in the same file as the artefacts a buyer should ask an AI vendor for before signing, because the answer is a document the vendor either has or does not.
03No authorised representative: can the system still ship?
Article 22(1) of the AI Act requires a provider established outside the Union to appoint an EU authorised representative, by written mandate, before making a high-risk AI system available on the Union market. Article 23(1)(d) makes that appointment one of the importer’s four checks, and Article 23(2) says that where an importer has sufficient reason to consider a system not in conformity with the Regulation, it shall not place it on the market until it has been brought into conformity.
The authorised representative is not a formality. Under Article 22(3) the mandate must empower it to verify the declaration and technical documentation, keep them for 10 years, hand documentation and logs to a competent authority on reasoned request, and be addressed by authorities instead of the provider. Without one, an authority has no EU party holding the file, and the importer is the nearest company it can reach.
| Option | What it changes | Exposure |
|---|---|---|
| Vendor appoints a representative first | Article 23(1)(d) satisfied | Delay until the mandate is signed |
| You accept the mandate yourself | You take the Article 22(3) tasks and the Article 22(4) duty to terminate and report | Article 99(4)(b), 10 year retention |
| Ship without one | Article 23(1) checks incomplete | Article 99(4)(c), up to EUR 15 000 000 or 3% |
| Rebrand under your own name | You become the provider under Article 25(1)(a) | Full Article 16 set, Article 99(4)(a) |
The second option is the one sales teams propose because it keeps the deal moving. Article 3(5) allows any person established in the Union to accept the mandate, but Article 22(4) then obliges that representative to terminate it and inform the market surveillance authority if it has reason to consider the provider is acting contrary to its obligations. A reseller that holds the mandate is legally required to report its own supplier.
04What does the AI Act expect after the system ships?
Importer duties continue once the high-risk system is on the market. Article 23(3) requires the importer’s name and contact address on the system, its packaging or accompanying documentation. Article 23(5) requires it to keep the notified body certificate where applicable, the instructions for use and the declaration of conformity for 10 years. Article 23(6) requires it to make sure the technical documentation can be made available to authorities, and Article 23(7) to cooperate in any action they take.
Distributors carry a corrective duty. Article 24(4) requires a distributor that has reason to consider a system it has supplied non-conforming to bring it into conformity, withdraw it or recall it, or ensure the provider or importer does so, and to inform the authorities immediately where the system presents a risk under Article 79(1).
Fines for breaching Articles 22, 23 or 24 fall under Article 99(4): up to EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher. For SMEs under Article 99(6), and for small mid-cap enterprises under Article 99(6a) added by Regulation (EU) 2026/1744, the lower of the two applies.
Articles 22 to 24 sit in Chapter III, Section 3. Under Article 113 as amended by Regulation (EU) 2026/1744, that section applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, as set out in what the high-risk delay leaves binding now. Distribution agreements signed in 2026 routinely run past both dates, which makes the mandate question a contract term to settle now rather than a shipping problem to discover later.
05Frequently asked questions
Is an EU reseller of a US AI system an importer or a distributor?
The first EU company that places the system on the market under the US provider's name is the importer under Article 3(6) of Regulation (EU) 2024/1689. Resellers further down the chain, buying from that importer, are distributors under Article 3(7). A reseller that puts its own name on a high-risk system is neither, because Article 25(1)(a) makes it the provider.
What happens if a non-EU AI provider has no authorised representative in the EU?
Article 22(1) requires a non-EU provider to appoint one by written mandate before making a high-risk AI system available in the Union, and Article 23(1)(d) requires the importer to verify that appointment. Without it the importer cannot complete its checks and should not place the system on the market.
Can the importer act as the authorised representative itself?
Nothing in Article 3(5) or Article 22 excludes it, since any person established in the Union can accept a written mandate. Accepting it adds the Article 22(3) tasks, including 10 years of document retention and a duty under Article 22(4) to terminate the mandate and inform the market surveillance authority if the provider breaches its obligations.
06References and method
- Regulation (EU) 2024/1689, Article 3(5) to 3(10), for the definitions of authorised representative, importer, distributor, operator, placing on the market and making available on the market.
- Regulation (EU) 2024/1689, Articles 22, 23 and 24, for the duties of authorised representatives, importers and distributors of high-risk AI systems, and Article 25(1), for the circumstances in which they become the provider.
- Regulation (EU) 2024/1689, Article 99(4), (6) and (6a), for the administrative fine ceilings and the lower of the two caps for SMEs and small mid-caps.
- Regulation (EU) 2026/1744, for the amended application dates in Article 113 and the new Article 99(4)(da) and (6a).
- Articles 3, 22, 23, 24, 25, 99, 111 and 113 in the consolidated presentation, read on 25 September 2026 with amended paragraphs checked against the current text. Articles 22, 23 and 24 carry no amendment from Regulation (EU) 2026/1744.