AI Governance Engineer
GitHub

EU AI Act Art. 23: obligations of importers

Before placing a high-risk system on the market, the importer verifies the conformity assessment, the Annex IV documentation, the CE marking, the declaration and instructions and the authorised representative, and keeps copies for 10 years

By Reviewed

From clause to evidenceThe chain from EU AI Act Art. 23 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: EU AI Act (post-Omnibus), Art. 23ClauseEU AI ActArt. 23Duty holder: ImporterDuty holderImporterApplies from: 2027-12-02 (Deferred)Applies from2027-12-02DeferredArtefact: Import verification record against each check; 10-year document copiesArtefactImportverification…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic in 15 frameworks (30 clauses): EU AI Act, ISO 42001, NIST AI RMF, TC260 Framework 3.0, GDPR, CSA AICM, OWASPLLM and 8 moreAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from EU AI Act Art. 23 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: EU AI Act (post-Omnibus), Art. 23ClauseEU AI Act · Art. 23Duty holder: ImporterDuty holderImporterApplies from: 2027-12-02 (Deferred)Applies from2027-12-02 · DeferredArtefact: Import verification record against each check; 10-year document copiesArtefactImport verification record against…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic in 15 frameworks (30 clauses): EUAI Act, ISO 42001, NIST AI RMF, TC260Framework 3.0, GDPR and 10 moreAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-EUAIA-ART23. Drawn from chapter 08.
Text alternative
  • Clause: EU AI Act, Art. 23.
  • Duty holder: Importer.
  • Applies from: 2027-12-02, Deferred.
  • Artefact: Import verification record against….
  • Layers: Layer 02, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • The same topic in 15 other frameworks; the crosswalk section below links each clause.
When this obligation applies3 dates of AIGE-OBL-EUAIA-ART23 on a time axis, against its review date 2026-09-24.2024202620282030As of 2026-09-242027-12-02 · DeferredAnnex III2028-08-02 · High-risk(Annex I)Applies to Annex I embedded(product safety-component)systems2030-08-02 · Later stepDeadline for legacy high-risksystems intended for use bypublic authorities (Art.111(2))2027-12-02 · Deferred · Annex III2028-08-02 · High-risk (Annex I) · Applies to Annex I embedded (product safety-component) systems2030-08-02 · Later step · Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Source: Obligation register(chapter 08)
When this obligation applies3 dates of AIGE-OBL-EUAIA-ART23 on a time axis, against its review date 2026-09-24.2027-12-02 · DeferredAnnex III2028-08-02 · High-risk (Annex I)Applies to Annex I embedded(product safety-component)systems2030-08-02 · Later stepDeadline for legacy high-risksystems intended for use by publicauthorities (Art. 111(2))2024202620282030As of 2026-09-242027-12-02 · Deferred · Annex III2028-08-02 · High-risk (Annex I) · Applies to Annex I embedded (product safety-component) systems2030-08-02 · Later step · Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Source: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-EUAIA-ART23
DateStepDetail
2027-12-02DeferredAnnex III
2028-08-02High-risk (Annex I)Applies to Annex I embedded (product safety-component) systems
2030-08-02Later stepDeadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))
Id
AIGE-OBL-EUAIA-ART23
Instrument
EU AI Act (post-Omnibus) law
Compared side by side
ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act
Clause
Art. 23
Duty holder
Importer
Authority
National MSA
Applies from
Deferred · Annex III
Later dates
  • Applies to Annex I embedded (product safety-component) systems
  • Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))
System class
High-risk (Annex III) · High-risk (Annex I)

The artefact that evidences it

Import verification record against each check; 10-year document copies.

What this obligation connects toEU AI Act Art. 23 and its 15 relations: 15 same crosswalk topic.DirectEU AI Act Art. 23Same crosswalk topic (15)AI Verify 9.7.1, 5.3.1, 4.5.2, 9.3.1 · Core clauseAI VerifyCSA AICM STA-10, STA-09 · Core clauseCSA AICMEU AI Act Art. 25, Art. 25(4), Art. 26, Art. 22, Art. 24, Art. 54 · Core clauseEU AI ActGDPR Art. 28, Arts. 44–46 · Core clauseGDPRISO 42001 A.10 · Core clauseISO 42001NIST AI RMF GOVERN 6, MAP 4, MANAGE 3, MANAGE 3.1, GOVERN 6.2 · Core clauseNIST AI RMF+9 more+9 more: OWASP Agentic ASI04, OWASP LLM LLM04:2026, TC260 Framework 3.0 TC260 App. 2 II.4, TC260 4.4.4, China Deep Synthesis DeepSyn Art. 14, China GenAI Measures GenAI Art. 7, G7 Code G7 Action 11, GAO AI Accountability 2.6, GPAI Code Transparency 1.2, UK ATRS ATRS 2.1.4
What this obligation connects toEU AI Act Art. 23 and its 15 relations: 15 same crosswalk topic.DirectSame crosswalk topic (15)AI Verify 9.7.1, 5.3.1, 4.5.2, 9.3.1 · Core clauseAI VerifyCSA AICM STA-10, STA-09 · Core clauseCSA AICMEU AI Act Art. 25, Art. 25(4), Art. 26, Art. 22, Art. 24, Art. 54 · Core clauseEU AI ActGDPR Art. 28, Arts. 44–46 · Core clauseGDPRISO 42001 A.10 · Core clauseISO 42001NIST AI RMF GOVERN 6, MAP 4, MANAGE 3, MANAGE 3.1, GOVERN 6.2 · Core clauseNIST AI RMF+9 more+9 more: OWASP Agentic ASI04, OWASP LLM LLM04:2026, TC260 Framework 3.0 TC260 App. 2 II.4, TC260 4.4.4, China Deep Synthesis DeepSyn Art. 14, China GenAI Measures GenAI Art. 7, G7 Code G7 Action 11, GAO AI Accountability 2.6, GPAI Code Transparency 1.2, UK ATRS ATRS 2.1.4EU AI Act Art. 23
What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.
Data table: every relation
Relations of AIGE-OBL-EUAIA-ART23
FamilyItemRelation
Same crosswalk topicAI Verify 9.7.1, 5.3.1, 4.5.2, 9.3.1Core clause
Same crosswalk topicCSA AICM STA-10, STA-09Core clause
Same crosswalk topicEU AI Act Art. 25, Art. 25(4), Art. 26, Art. 22, Art. 24, Art. 54Core clause
Same crosswalk topicGDPR Art. 28, Arts. 44–46Core clause
Same crosswalk topicISO 42001 A.10Core clause
Same crosswalk topicNIST AI RMF GOVERN 6, MAP 4, MANAGE 3, MANAGE 3.1, GOVERN 6.2Core clause
Same crosswalk topicOWASP Agentic ASI04Core clause
Same crosswalk topicOWASP LLM LLM04:2026Core clause
Same crosswalk topicTC260 Framework 3.0 TC260 App. 2 II.4, TC260 4.4.4Core clause
Same crosswalk topicChina Deep Synthesis DeepSyn Art. 14Related clause
Same crosswalk topicChina GenAI Measures GenAI Art. 7Related clause
Same crosswalk topicG7 Code G7 Action 11Related clause
Same crosswalk topicGAO AI Accountability 2.6Related clause
Same crosswalk topicGPAI Code Transparency 1.2Related clause
Same crosswalk topicUK ATRS ATRS 2.1.4Related clause

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Supply chain and third parties

Source

Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). EU AI Act Art. 23: obligations of importers (AIGE-OBL-EUAIA-ART23). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art23. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{EU AI Act Art. 23: obligations of importers (AIGE-OBL-EUAIA-ART23)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art23},
  note         = {Version 0.5.0}
}