European UnionAI Act, Article 23 (obligations of importers of high-risk AI systems)
Regulation (EU) 2024/1689, Article 23
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment
- Obligation class
- Governance, Retention, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Kept, Produced on request
As of .
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- It reaches you if you are an importer of a high-risk AI system: you are located or established in the Union and place on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.
- Before you place the system on the market, ensure that it is in conformity with the Regulation by verifying that the provider has carried out the conformity assessment procedure referred to in Article 43, has drawn up the technical documentation in accordance with Article 11 and Annex IV, and has appointed an authorised representative in accordance with Article 22(1), and that the system bears the required CE marking and is accompanied by the EU declaration of conformity referred to in Article 47 and instructions for use (Article 23(1)).
- If you have sufficient reason to consider that the system is not in conformity with the Regulation, or is falsified, or is accompanied by falsified documentation, do not place it on the market until it has been brought into conformity (Article 23(2)).
- Where the system presents a risk within the meaning of Article 79(1), inform the provider of the system, the authorised representative and the market surveillance authorities (Article 23(2)).
- Indicate your name, registered trade name or registered trade mark, and the address at which you can be contacted on the system and on its packaging or its accompanying documentation, where applicable (Article 23(3)).
- While the system is under your responsibility, ensure that storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements of Section 2 (Article 23(4)).
- Keep, for 10 years after the system has been placed on the market or put into service, a copy of the certificate issued by the notified body, where applicable, of the instructions for use, and of the EU declaration of conformity referred to in Article 47 (Article 23(5)).
- Provide the relevant competent authorities, upon a reasoned request, with all the necessary information and documentation, including the items you keep for 10 years, to demonstrate the conformity of the system with the requirements of Section 2, in a language which can be easily understood by them, and ensure that the technical documentation can be made available to those authorities (Article 23(6)).
- Cooperate with the relevant competent authorities in any action they take in relation to a system you placed on the market, in particular to reduce and mitigate the risks posed by it (Article 23(7)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4), point (c): non-compliance with the obligations of importers under Article 23 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Does an AI system sold in the Union under the name or trademark of a person established in the Union, but developed by a third-country provider, make the seller an importer under Article 3, point (6), as a person that places on the market an AI system "that bears the name or trademark of a natural or legal person established in a third country"?
What it makes you log
Who may demand the log
Regulator
Log retention
Ten years after the high-risk AI system has been placed on the market or put into service, for the copy of the notified body's certificate where applicable, the instructions for use and the EU declaration of conformity; the period is for those documents, not for the logs, whose minimum period is Article 19's.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 10
- Minimum value
- 10
Logging duty
Article 23(5) is a duty to keep a copy of three named documents for a fixed period. It does not create those documents, which the provider's duties under Articles 13 and 47 and the notified body's procedures create, and it does not cover the logs a system automatically generates, which a provider keeps under Article 19.
- Kind
- Explicit
- As of
- Provision
- Article 23(5)
- Trigger
- high_risk_systems
What this law does
An importer is a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.
Before placing a high-risk AI system on the market, importers must ensure that the system is in conformity with the Regulation by verifying that the conformity assessment procedure referred to in Article 43 has been carried out by the provider, that the provider has drawn up the technical documentation in accordance with Article 11 and Annex IV, that the system bears the required CE marking and is accompanied by the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider has appointed an authorised representative in accordance with Article 22(1).
Where an importer has sufficient reason to consider that a high-risk AI system is not in conformity with the Regulation, or is falsified, or accompanied by falsified documentation, it must not place the system on the market until it has been brought into conformity. Where the high-risk AI system presents a risk within the meaning of Article 79(1), the importer must inform the provider of the system, the authorised representative and the market surveillance authorities to that effect.
Importers must indicate their name, registered trade name or registered trade mark, and the address at which they can be contacted on the high-risk AI system and on its packaging or its accompanying documentation, where applicable. Importers must ensure that, while a high-risk AI system is under their responsibility, storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements set out in Section 2.
Importers must keep, for a period of 10 years after the high-risk AI system has been placed on the market or put into service, a copy of the certificate issued by the notified body, where applicable, of the instructions for use, and of the EU declaration of conformity referred to in Article 47.
Importers must provide the relevant competent authorities, upon a reasoned request, with all the necessary information and documentation, including that referred to in paragraph 5, to demonstrate the conformity of a high-risk AI system with the requirements set out in Section 2 in a language which can be easily understood by them, and must also ensure that the technical documentation can be made available to those authorities.
Importers must cooperate with the relevant competent authorities in any action those authorities take in relation to a high-risk AI system placed on the market by the importers, in particular to reduce and mitigate the risks posed by it. Article 23 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.
Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from for a system classified as high-risk under Article 6(2) and Annex III, and from for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.
Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.
Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.
By , the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or distributes a software product.