EU AI Act · Art. 24
Distributor duties for high-risk AI systems
Before making the system available, verify it bears the CE marking, is accompanied by the EU declaration of conformity and instructions, and that provider and importer complied with their obligations; ensure storage and transport do not jeopardise compliance; take corrective action or withdraw where non-conformity appears; and inform providers, importers, and authorities of any risk.
What do you actually have to do?
Before making the system available, verify it bears the CE marking, is accompanied by the EU declaration of conformity and instructions, and that provider and importer complied with their obligations; ensure storage and transport do not jeopardise compliance; take corrective action or withdraw where non-conformity appears; and inform providers, importers, and authorities of any risk.
Statutory basis: Art. 24 — https://artificialintelligenceact.eu/article/24/
Who does this apply to?
- Distributor
When does it apply?
- 2028-08-02 — 2 August 2028 (Annex I, deferred by the Digital Omnibus)
- 2027-12-02 — 2 December 2027 (Annex III, deferred by the Digital Omnibus)
Does ISO 42001 or NIST AI RMF cover this duty?
Requirement-level mappings from Shieldra's crosswalk pack (v2026.07.30). Partial mappings contribute evidence but deliberately do not count as coverage.
| Mapped requirement | Strength | Why (and what’s missing) |
|---|---|---|
| ISO/IEC 42001 A.10 | Partial | Third-party assurance processes support distributor verification, but the CE-marking checks and market-surveillance cooperation duties are EU-specific. |
| NIST AI RMF GOVERN-6.1 | Partial | Third-party due-diligence procedures support the distributor verification duties, which remain EU-specific market-surveillance obligations. |
Disclaimer
Compliance guidance, not legal advice. Confirm obligations with counsel. Pack verified 2026-09-16.
Frequently asked questions
What does "Distributor duties for high-risk AI systems" require?
Before making the system available, verify it bears the CE marking, is accompanied by the EU declaration of conformity and instructions, and that provider and importer complied with their obligations; ensure storage and transport do not jeopardise compliance; take corrective action or withdraw where non-conformity appears; and inform providers, importers, and authorities of any risk.
When does this obligation apply?
2 August 2028 (Annex I, deferred by the Digital Omnibus). 2 December 2027 (Annex III, deferred by the Digital Omnibus)
Who does this obligation apply to?
The distributor role under the EU AI Act. Statutory basis: Art. 24.