European UnionAI Act, Article 24 (obligations of distributors of high-risk AI systems)
Regulation (EU) 2024/1689, Article 24
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- It reaches you if you are a distributor of a high-risk AI system: you are a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.
- Before you make the system available on the market, verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider and the importer, as applicable, have complied with their obligations under Article 16, points (b) and (c), and Article 23(3) (Article 24(1)).
- If you consider or have reason to consider, on the basis of the information in your possession, that the system is not in conformity with the requirements of Section 2, do not make it available on the market until it has been brought into conformity; where it presents a risk within the meaning of Article 79(1), also inform the provider or the importer, as applicable (Article 24(2)).
- While the system is under your responsibility, ensure that storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements of Section 2 (Article 24(3)).
- If you consider or have reason to consider that a system you have made available on the market is not in conformity with the requirements of Section 2, take the corrective actions necessary to bring it into conformity, to withdraw it or recall it, or ensure that the provider, the importer or any relevant operator, as appropriate, takes them (Article 24(4)).
- Where such a system presents a risk within the meaning of Article 79(1), immediately inform the provider or importer and the authorities competent for the system, giving details, in particular, of the non-compliance and of any corrective actions taken (Article 24(4)).
- Upon a reasoned request from a relevant competent authority, provide it with all the information and documentation regarding your actions under Article 24(1) to (4) that are necessary to demonstrate the conformity of the system with the requirements of Section 2 (Article 24(5)).
- Cooperate with the relevant competent authorities in any action they take in relation to a system you made available on the market, in particular to reduce or mitigate the risk posed by it (Article 24(6)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4), point (d): non-compliance with the obligations of distributors under Article 24 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Does a person that supplies a high-risk AI system to users only as a hosted service, without transferring a copy of the system, "make an AI system available on the Union market" and so become a distributor under Article 3, point (7)?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 24(5) requires the distributor to provide information and documentation regarding its actions under paragraphs 1 to 4, which cannot be done without a kept record of the checks and corrective actions. The article does not say what must be kept or for how long, and it does not cover the logs a system automatically generates, which a provider keeps under Article 19.
- Kind
- Implicit
- As of
- Provision
- Article 24(5)
- Trigger
- high_risk_systems
What this law does
A distributor is a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.
Before making a high-risk AI system available on the market, distributors must verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider and the importer of that system, as applicable, have complied with their respective obligations as laid down in Article 16, points (b) and (c) and Article 23(3).
Where a distributor considers or has reason to consider, on the basis of the information in its possession, that a high-risk AI system is not in conformity with the requirements set out in Section 2, it must not make the system available on the market until the system has been brought into conformity with those requirements.
Where the high-risk AI system presents a risk within the meaning of Article 79(1), the distributor must also inform the provider or the importer of the system, as applicable, to that effect. Distributors must ensure that, while a high-risk AI system is under their responsibility, storage or transport conditions, where applicable, do not jeopardise the compliance of the system with the requirements set out in Section 2.
A distributor that considers or has reason to consider, on the basis of the information in its possession, that a high-risk AI system which it has made available on the market is not in conformity with the requirements set out in Section 2 must take the corrective actions necessary to bring that system into conformity with those requirements, to withdraw it or recall it, or must ensure that the provider, the importer or any relevant operator, as appropriate, takes those corrective actions.
Where such a system presents a risk within the meaning of Article 79(1), the distributor must immediately inform the provider or importer of the system and the authorities competent for the high-risk AI system concerned, giving details, in particular, of the non-compliance and of any corrective actions taken.
Upon a reasoned request from a relevant competent authority, distributors of a high-risk AI system must provide that authority with all the information and documentation regarding their actions pursuant to paragraphs 1 to 4 necessary to demonstrate the conformity of that system with the requirements set out in Section 2.
Distributors must cooperate with the relevant competent authorities in any action those authorities take in relation to a high-risk AI system made available on the market by the distributors, in particular to reduce or mitigate the risk posed by it. Article 24 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.
Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from for a system classified as high-risk under Article 6(2) and Annex III, and from for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.
Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.
Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.
By , the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or distributes a software product.