If you're a Distributor — what's specific to your role

For: distributor
Tier: free+
Time: ~4 min

Why you'd do this

Distributor (Art. 3(7)) is the supply-chain role for any party making a high-risk AI system available on the EU market that is neither the Provider nor the Importer. 8 actionable obligations, all in Art. 24 + shared Art. 25 chain-responsibility. Lighter than Importer because you're not gatekeeping market entry — you're verifying the gatekeepers did their job.

Before you start

Have visibility into Provider's CE marking + Importer's name + address on the system / its packaging — Distributor obligations are fundamentally about checking those exist
Know the storage and transport conditions you maintain — Art. 24(2) makes you responsible for not degrading conformity through your handling

Step 1

Workflow 1 — Pre-distribution verification (Art. 24(1))

Before making a high-risk AI system available on the EU market, verify:

The system bears the required CE marking
It is accompanied by the EU declaration of conformity + instructions for use
The Provider AND (where applicable) the Importer have complied with the obligations of Art. 16(b) (Provider name + trade name + address visible) and Art. 23(3) (Importer name + address visible)

Lighter than Importer's check — you confirm the markers exist, you don't audit the underlying conformity assessment.

Step 2

Workflow 2 — Storage + non-conformity escalation (Art. 24(2)-(4))

While the system is under your responsibility:

Storage and transport conditions must not jeopardise the system's conformity (Art. 24(2))
If you have reason to consider the system is not in conformity, you MUST NOT make it available until conformity is restored (Art. 24(3))
Where the system presents a risk, immediately inform the Provider OR Importer AND the relevant national authorities, specifying the non-conformity + corrective measures taken (Art. 24(4))

On reasoned authority request, provide all information and documentation necessary to demonstrate conformity (Art. 24(5)).

Step 3

Workflow 3 — Recall participation

Per Art. 24(6), Distributors cooperate with authorities + Providers + Importers in any action taken to eliminate risks posed by systems they make available — including recalls and withdrawals.

Practical operational deliverables:

A traceability log mapping which specific units of the system you distributed to which downstream customer (so a recall can reach them)
A documented recall communication template + escalation list
A pre-arranged channel with the Provider for receiving recall notifications

ComplianceLint's Art. 24 Human Gates questionnaire captures all three.

What can go wrong

Provider goes out of business — who handles a recall? — Per Art. 25(1), if the Provider can no longer be reached, the obligation chain shifts: the Importer (if any) carries forward the corrective-action duty, then Distributors. Document the Provider's unreachability in writing before assuming the elevated obligation.
You repackage the system or modify it before distributing — does that change your role? — Yes — per Art. 25(1)(b)/(c), substantial modification or rebranding can elevate you to Provider status with the full Provider obligation set. The dashboard's role multi-select lets you flag both; if in doubt, treat as Provider and run a full scan to surface the Provider-specific obligations you'd then owe.

Last updated: 2026-10-29