Distributor Liability for High-Risk AI Systems

Up to EUR 15 million or 3% of total worldwide annual turnover! This is the level of administrative fine that a distributor may face for non-compliance with its obligations under the Artificial Intelligence Act (AI Act). And this applies to a company that did not develop the AI system, did not train the model and may have had no influence at all over its technical architecture.

However, the position that “we only sell it” does not eliminate regulatory risk. The AI Act allocates obligations among different operators across the AI value chain and assigns a distinct role to distributors of high-risk AI systems.

Before such a system is made available on the EU market, the distributor must carry out a number of checks. If there is reason to consider that the system does not comply with the requirements of the AI Act, its further distribution must be stopped. And if issues are identified only after the system has been made available on the market, the distributor’s obligations do not end with the sale.

There is another, potentially more serious scenario: under certain circumstances, a company that entered the AI value chain as a distributor may legally find itself in the role of a provider of a high-risk AI system and, with that new status, become subject to a significantly broader set of regulatory obligations. Putting its own name or trademark on the system, making a substantial modification to the system, or modifying its intended purpose may, under certain conditions, change not only the product the company offers to its customers, but also its own role under the AI Act.

So where are the boundaries of a distributor’s responsibilities? What exactly must a distributor verify before making a high-risk AI system available on the market? What signs of non-compliance can no longer be ignored, and at what point does a distributor risk becoming a provider itself?

Below, we take a closer look at the obligations the AI Act imposes on distributors and what they need to do in practice to comply with them.

Who Is a Distributor under the AI Act?

To begin with, it is important to determine who qualifies as a distributor within the meaning of the AI Act.

Under Article 3(7), a distributor is a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.

The AI Act clearly distinguishes a distributor from a provider and an importer. A provider is a person that develops an AI system or a general-purpose AI model, or has such a system or model developed, and places it on the market or puts the AI system into service under its own name or trademark. An importer, in turn, is a person located or established in the Union that places on the market an AI system bearing the name or trademark of a person established in a third country.

A distributor, by contrast, is neither a provider nor an importer. It is another person in the supply chain that makes an AI system available on the Union market. What matters when determining distributor status is the company’s position in the supply chain and the functions it actually performs, rather than the nominal description of its role in a contract.

Correctly identifying this role is important because the AI Act imposes distinct obligations on different operators across the AI value chain. For distributors of high-risk AI systems, those obligations are primarily set out in Article 24 of the AI Act.

From Verification to Response: What Must a Distributor Do?

Article 24 of the AI Act sets out a fairly practical course of action for distributors. Their obligations are not limited to checking documentation before making a high-risk AI system available on the market. Distributors must also respond to signs of non-compliance, ensure appropriate storage and transport conditions, and, where necessary, cooperate with the competent authorities.

First, the Checks…

Before making a high-risk AI system available on the market, a distributor must carry out a number of checks. First, it must verify that the system bears the required CE marking. The distributor must then verify that the system is accompanied by a copy of the EU declaration of conformity referred to in Article 47 of the AI Act and by instructions for use.

Article 24(1) of the AI Act also specifically requires the distributor to verify compliance with certain obligations by other operators in the supply chain.

Provider and Importer: What Should a Distributor Look For?

As regards the provider, the distributor must verify compliance with the requirements set out in Article 16(b) and (c) of the AI Act. In particular, the provider must indicate on the system or, where that is not possible, on its packaging or accompanying documentation, its name, registered trade name or registered trademark, and the address at which it can be contacted. In addition, the provider must have in place a quality management system that complies with Article 17 of the AI Act.

Where an importer is involved in the supply chain, the distributor must also verify the importer’s compliance with Article 23(3).

In particular, the importer must indicate its name, registered trade name or registered trademark, and the address at which it can be contacted on the high-risk AI system. Where this information cannot be indicated on the system itself, it must be provided on its packaging or accompanying documentation.

If in Doubt, Do Not Distribute!

However, formally checking the marking and documentation is not enough. Where, on the basis of the information in its possession, a distributor considers or has reason to consider that a high-risk AI system does not comply with the applicable requirements, it must not make the system available on the market until it has been brought into conformity.

Where such a system also presents a risk within the meaning of Article 79(1) of the AI Act, namely a risk to the health or safety, or to the fundamental rights, of persons, the distributor must inform the provider or, as applicable, the importer.

Storage and Transport Matter

While a high-risk AI system is under the distributor’s responsibility, the distributor must ensure that its storage or transport conditions, where applicable, do not jeopardise the system’s compliance with the applicable requirements.

Already on the Market? The Obligations Remain!

A distributor’s obligations do not end once the system has been made available on the market.

If the distributor subsequently considers or has reason to consider that the system does not comply with the applicable requirements, it must take the corrective actions necessary to bring the system into conformity, to withdraw it or to recall it. The distributor may also ensure that the provider, the importer or any relevant operator, as appropriate, takes those corrective actions.

At the same time, where the system presents a risk within the meaning of Article 79(1) of the AI Act, the distributor must immediately inform the provider or importer and the authorities competent for the high-risk AI system concerned, giving details, in particular, of the non-compliance and of any corrective actions taken.

Finally, the distributor must be prepared to demonstrate compliance with its obligations to the competent authorities. Upon a reasoned request from a relevant competent authority, it must provide the information and documentation necessary to demonstrate compliance with its obligations and cooperate with that authority regarding any high-risk AI system it has made available on the market, in particular to reduce or mitigate the risk posed by the system.

From Distributor to Provider: Just a Few Steps

A separate risk arises where a distributor’s role goes beyond the ordinary distribution of a system. Article 25 of the AI Act sets out the circumstances in which a distributor of a high-risk AI system is considered to be its provider and, accordingly, becomes subject to the obligations of the provider under Article 16 of the AI Act.

This occurs where the distributor:

• puts its name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated;
• makes a substantial modification to a high-risk AI system that has already been placed on the market or has already been put into service in such a way that it remains a high-risk AI system pursuant to Article 6;
• modifies the intended purpose of an AI system, including a general-purpose AI system, that has not been classified as high-risk and has already been placed on the market or put into service. As a result of that modification, the AI system concerned becomes a high-risk AI system in accordance with Article 6 of the AI Act.

The consequence of such a change in role is significant: for the purposes of the AI Act, the distributor is considered to be the provider of the high-risk AI system concerned. Accordingly, it becomes subject to the obligations of the provider under Article 16 of the AI Act.

At the same time, the initial provider that placed the relevant system on the market or put it into service is no longer considered to be the provider of that specific AI system for the purposes of the AI Act. The initial provider must closely cooperate with the new provider, make available the necessary information, and provide the reasonably expected technical access and other assistance required for the fulfilment of the obligations under the AI Act. In particular, such cooperation must facilitate compliance with the conformity assessment requirements applicable to high-risk AI systems.

There is, however, an exception. Where the initial provider has clearly specified that its AI system is not to be changed into a high-risk AI system, it is not subject to the obligation to hand over the relevant documentation.

How to Keep Distribution from Becoming a Regulatory Risk

As we can see, the distributor’s role under the AI Act is far from passive. Simply receiving a system from the provider and passing it on is not enough. A distributor has its own obligations to fulfil and, in certain circumstances, may even become a provider. To reduce regulatory risks, distributors should:

– clearly identify their role in the supply chain and monitor whether their actual activities go beyond the boundaries of that role;

– establish a procedure for verifying high-risk AI systems before making them available on the market;

– establish clear arrangements for cooperation with the provider and importer, including the exchange of necessary information and procedures for responding to identified issues;

– monitor the branding of and modifications to the system, as under the circumstances set out in Article 25 of the AI Act, such actions may result in the distributor being considered a provider and becoming subject to a significantly broader set of obligations.

The Cost of Non-Compliance

Ignoring these requirements can be costly. As noted above, non-compliance with the distributor obligations under Article 24 of the AI Act may be subject to administrative fines of up to EUR 15 million. Where the offender is an undertaking, the fine may reach up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Last but Not Least

A distributor does not develop the AI system or determine its initial intended purpose. Nevertheless, the AI Act gives the distributor a distinct role in ensuring that a high-risk AI system complies with the applicable requirements both on its way to the market and after it has been made available on the market.

For distributors, it is therefore essential to understand the boundaries of their role, carry out the checks required under the AI Act, and respond to non-compliance in a timely manner. Even more importantly, they should not miss the point at which their own actions may turn them into a provider subject to a much broader set of obligations.