EU AI Act · Art. 23
Importer duties for high-risk AI systems
Before placing the system on the EU market, verify the provider completed conformity assessment, drew up the technical documentation, and affixed the CE marking with an EU declaration of conformity; add your name and contact details on the product or packaging; ensure storage and transport do not jeopardise compliance; keep documentation for 10 years; and inform the provider and market-surveillance authorities of any risk.
By the Shieldra Compliance Team · Last updated 2026-07-29
What do you actually have to do?
Before placing the system on the EU market, verify the provider completed conformity assessment, drew up the technical documentation, and affixed the CE marking with an EU declaration of conformity; add your name and contact details on the product or packaging; ensure storage and transport do not jeopardise compliance; keep documentation for 10 years; and inform the provider and market-surveillance authorities of any risk.
Statutory basis: Art. 23 — https://artificialintelligenceact.eu/article/23/
When does it apply?
- 2028-08-02 — deferred to 2 August 2028 (Annex I, Digital Omnibus)
- 2027-12-02 — deferred to 2 December 2027 (Annex III, Digital Omnibus)
Does ISO 42001 or NIST AI RMF cover this duty?
Requirement-level mappings from Shieldra's crosswalk pack (v2026.07.30). Partial mappings contribute evidence but deliberately do not count as coverage.
| Mapped requirement | Strength | Why (and what’s missing) |
|---|
| ISO/IEC 42001 A.10 | Partial | Supply-chain requirements management supports verifying provider conformity, but CE-mark checks, labelling, and 10-year retention are EU-specific. |
| NIST AI RMF GOVERN-6.1 | Partial | Third-party AI due-diligence policy supports verifying provider conformity before market placement, but the CE-marking and documentation checks are EU-specific. |
Disclaimer
Compliance guidance, not legal advice. Confirm obligations with counsel. Pack verified 2026-07-29.
Frequently asked questions
What does "Importer duties for high-risk AI systems" require?
Before placing the system on the EU market, verify the provider completed conformity assessment, drew up the technical documentation, and affixed the CE marking with an EU declaration of conformity; add your name and contact details on the product or packaging; ensure storage and transport do not jeopardise compliance; keep documentation for 10 years; and inform the provider and market-surveillance authorities of any risk.
When does this obligation apply?
deferred to 2 August 2028 (Annex I, Digital Omnibus). deferred to 2 December 2027 (Annex III, Digital Omnibus)
Who does this obligation apply to?
The importer role under the EU AI Act. Statutory basis: Art. 23.
