The legal definition
The EU AI Act (Regulation (EU) 2024/1689) defines the roles along the supply chain so that obligations attach to the right actor at the right point. Article 3(6) defines an importer as a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a person established in a third country.
Two elements of that definition do the work. First, the importer is inside the EU — it is the Union-based counterpart to a provider that sits outside it. Second, the system it places on the market carries the mark of that non-EU provider, rather than the importer's own. When both hold, the actor is an importer, and the Act's importer obligations apply.
The distinguishing test
Because several roles can touch the same AI system, the practical question is which one a given actor occupies. The importer is identified by two facts taken together:
- Established in the Union. The importer has its place of establishment or location inside the EU. An actor outside the Union is not an importer — it may be the provider itself.
- Places on the market a system bearing a third-country provider's mark. The system enters the EU market for the first time under it, and it carries the name or trademark of a provider established outside the Union.
It helps to contrast the importer with the adjacent roles the Act defines:
Importer vs distributor
A distributor is a person in the supply chain, other than the provider or the importer, that makes an AI system available on the market — meaning the system is already on the EU market and the distributor supplies it onward. The importer is the one that places it on the market in the first place, at the border between a non-EU provider and the Union. The importer is upstream of the distributor.
Importer vs authorised representative
An authorised representative is a person in the Union that a provider appoints by written mandate to carry out obligations on its behalf. The authorised representative acts under the provider's instruction and authority. An importer acts in its own right as an independent economic operator — it is not mandated by the provider, it is the party placing the goods on the market.
Importer duties for high-risk AI
For high-risk AI systems, the Act places specific verification and conduct obligations on the importer before and after a system is placed on the market. In plain terms, the importer must check the provider's homework before letting the system enter the EU, and stand behind that check afterwards. The obligations that typically attach include:
- Verify conformity before placing on the market. The importer must ensure, before the system enters the market, that the provider has carried out the required conformity assessment, drawn up the technical documentation, affixed the CE marking, provided the required instructions for use, and appointed an authorised representative where one is required.
- Do not place a non-conforming system on the market. Where the importer has reason to consider that a high-risk AI system is not in conformity, it must not place it on the market until it has been brought into conformity — and must inform the provider and the relevant authorities where the system presents a risk.
- Keep documentation. The importer keeps a copy of the relevant documentation, including certificates and instructions for use, for the period the Act prescribes, so that authorities can request it.
- Cooperate with authorities. The importer provides competent authorities, on a reasoned request, with the information and documentation needed to demonstrate the conformity of the system, and cooperates on any corrective or risk-mitigation action.
These duties do not make the importer the party that designed or trained the system. They make the importer accountable for confirming that a non-EU provider met its obligations before the system reaches EU users — a gatekeeping function at the edge of the single market.
How the importer relates to the other roles
The Act deliberately distributes responsibility across the supply chain rather than concentrating it. The provider develops the system and bears primary responsibility for conformity. The importer sits between a third-country provider and the EU market and verifies that conformity before the system is placed. The distributor supplies the system onward once it is on the market. A deployer — the party that uses the system under its own authority — carries its own operational duties; the collective term for these actors, alongside providers and importers, is operator.
Crucially, these roles are defined by conduct, not by a fixed label. Under Article 25, an importer (like a distributor or deployer) is treated as a provider of a high-risk AI system — and takes on the provider's full obligations — if it puts its own name or trademark on a high-risk system already placed on the market, or substantially modifies such a system, or changes its intended purpose so that it becomes high-risk. Putting your brand on the box, or materially reworking the system, moves you up the chain.
For the wider picture of how the Act tiers obligations by risk, see our EU AI Act glossary entry and the practical walkthrough in the EU AI Act guide.
This article is an educational explainer, not legal advice. How the EU AI Act applies to a specific product, actor, or supply-chain arrangement depends on the facts, and organizations should seek qualified legal counsel for their own obligations.
