EU AI Act · Art. 23
Importer duties for high-risk AI systems
Before placing the system on the EU market, verify the provider completed conformity assessment, drew up the technical documentation, and affixed the CE marking with an EU declaration of conformity; add your name and contact details on the product or packaging; ensure storage and transport do not jeopardise compliance; keep documentation for 10 years; and inform the provider and market-surveillance authorities of any risk.
What do you actually have to do?
Before placing the system on the EU market, verify the provider completed conformity assessment, drew up the technical documentation, and affixed the CE marking with an EU declaration of conformity; add your name and contact details on the product or packaging; ensure storage and transport do not jeopardise compliance; keep documentation for 10 years; and inform the provider and market-surveillance authorities of any risk.
Statutory basis: Art. 23 — https://artificialintelligenceact.eu/article/23/
Who does this apply to?
- Importer
When does it apply?
- 2028-08-02 — 2 August 2028 (Annex I, deferred by the Digital Omnibus)
- 2027-12-02 — 2 December 2027 (Annex III, deferred by the Digital Omnibus)
Does ISO 42001 or NIST AI RMF cover this duty?
Requirement-level mappings from Shieldra's crosswalk pack (v2026.07.30). Partial mappings contribute evidence but deliberately do not count as coverage.
| Mapped requirement | Strength | Why (and what’s missing) |
|---|---|---|
| ISO/IEC 42001 A.10 | Partial | Supply-chain requirements management supports verifying provider conformity, but CE-mark checks, labelling, and 10-year retention are EU-specific. |
| NIST AI RMF GOVERN-6.1 | Partial | Third-party AI due-diligence policy supports verifying provider conformity before market placement, but the CE-marking and documentation checks are EU-specific. |
Disclaimer
Compliance guidance, not legal advice. Confirm obligations with counsel. Pack verified 2026-09-16.
Frequently asked questions
What does "Importer duties for high-risk AI systems" require?
Before placing the system on the EU market, verify the provider completed conformity assessment, drew up the technical documentation, and affixed the CE marking with an EU declaration of conformity; add your name and contact details on the product or packaging; ensure storage and transport do not jeopardise compliance; keep documentation for 10 years; and inform the provider and market-surveillance authorities of any risk.
When does this obligation apply?
2 August 2028 (Annex I, deferred by the Digital Omnibus). 2 December 2027 (Annex III, deferred by the Digital Omnibus)
Who does this obligation apply to?
The importer role under the EU AI Act. Statutory basis: Art. 23.