Art.24

Article 24 — Obligations of Distributors of High-Risk AI Systems

Governance SME Relevant ~2 min read · 491 words

Article 24 sets out what distributors must do before making a high-risk AI system available on the EU market. Distributors occupy the last link in the supply chain before the end deployer — and the Act holds them responsible for verifying that what they pass on is compliant.

⚠ Medium compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

The distributor as the final compliance checkpoint

Article 24 establishes the obligations of distributors of high-risk AI systems. A distributor is any entity in the supply chain — other than the provider or importer — that makes a high-risk AI system available on the EU market. While distributor obligations are lighter than those of providers or importers, they are real and enforceable.

WHAT IT SAYS

Check before you distribute — act if you find problems

Before making a high-risk AI system available on the market, distributors must verify that it bears the required CE marking, is accompanied by a copy of the EU declaration of conformity and instructions for use, and that the provider and importer have met their key obligations
Where a distributor believes a system is not in conformity, they must not make it available until it is brought into compliance
Where a distributed system presents a risk, the distributor must inform the provider or importer accordingly
Distributors must ensure that storage and transport conditions during their period of responsibility do not jeopardise compliance
Where a distributor has already made a non-compliant system available, they must take corrective action — including withdrawal or recall — inform the relevant parties, and notify competent authorities
Distributors must cooperate with competent authorities in any action taken and provide requested information about the system

WHO IS AFFECTED

Resellers, platform operators, and marketplace intermediaries

Traditional software resellers who include AI systems in their product catalogue
Cloud marketplace operators making third-party AI tools available to customers
Value-added resellers who bundle AI systems with other products or services
IT service companies that deploy high-risk AI systems on behalf of end clients — depending on their role, they may qualify as distributors or deployers

WHAT IT MEANS FOR SMES

Light obligations — but real ones

Of all the supply chain roles, distributor obligations are the most proportionate — you are not responsible for the system’s technical compliance, only for verifying that the compliance documentation exists and is present
The practical checklist before distributing any high-risk AI system: does it have CE marking, is there a declaration of conformity, are instructions for use included, and have the provider and importer done their jobs? If yes to all four, your pre-distribution obligation is met
Keep records of what you distributed, when, and to whom — if a system is later recalled or found non-compliant, you will need to trace who received it
If you customise or substantially modify a system you distribute, you may cross the line into becoming a provider under Article 25 — with significantly heavier obligations
Review your supplier contracts to ensure providers and importers are contractually required to supply compliant documentation — do not accept systems without it

Article 23 — Obligations of importers (the upstream party distributors depend on for compliance)
Article 25 — Responsibilities along the AI value chain (when distributors become providers)
Article 47 — EU declaration of conformity (what distributors must verify is present)
Article 48 — CE marking (the marking distributors must check for)

← Back to the Guide