What Article 23 EU AI Act requires importers to check before sale
Article 23 requires an EU importer to verify, before placing a high-risk AI system on the EU market, that the non-EU provider has completed the conformity assessment, prepared the Annex IV technical documentation, affixed the CE marking with the EU declaration of conformity and instructions, and appointed an authorised representative in the EU. An importer is an EU-established person that places on the market a system bearing the name or trademark of a person established in a third country (Article 3(6)). That role puts the importer in front of the product, so the Act assigns it its own checks rather than relying only on the provider. Before the system is sold, the importer should hold copies of each item, confirm the CE marking and declaration match the system actually being shipped, and confirm that the named authorised representative has accepted its mandate. Where any item is missing, the importer should not proceed. The hold-back duty matters as much as the checklist. If an importer has sufficient reason to consider a system non-conforming, falsified, or accompanied by falsified documentation, it must not place the system on the market until it conforms. If the system presents a risk, the importer must also inform the provider, the authorised representative and the market surveillance authorities. Practically, this means the importer needs a written escalation path and a decision owner who can stop a shipment, which is a governance step to settle before the first import rather than during an incident.
The usual difficulty is timing and completeness. Technical documentation, test reports and declarations often come from a provider outside the EU, sometimes late, in a different language, or as summaries that omit the Annex IV detail an assessor would ask for. Importers should agree in the supply contract which documents will be delivered, in which version, and by which date, and should confirm with the provider whether the conformity assessment was internal control under Annex VI or a notified body route under Article 43. The importer must also keep its own record of the name and contact address it shows on the product or its documentation, plus the certificate, instructions and declaration, for 10 years (Article 23(3) to (7)). Because the Act's high-risk rules for Annex III systems apply from 2 December 2027 and for Annex I product systems from 2 August 2028 (Regulation (EU) 2026/1744), confirm with counsel which obligations already apply to the specific system and when the provider's file must be ready. Breach carries fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher, or the lower amount for SMEs (Article 99(4) and (6)).
Which importers and systems Article 23 Obligations of importers reaches
Article 23 applies only when an EU-established company places a high-risk AI system on the market that carries a non-EU provider's name or trademark. The cards below separate the role test, the high-risk test and the dates from the 2026 amendment, so you can decide early whether the duties reach your organization.
The importer definition
Article 3(6) defines an importer as a person established in the EU that places on the market an AI system bearing the name or trademark of a person established in a third country. Two conditions must both hold: the EU establishment places the system on the market, and the name on the system belongs to a non-EU provider. Check the product label, documentation and contract to confirm whose name appears on the system and who first makes it available in the EU.
Third-country name or trademark
The importer role depends on the name or trademark on the system, not on where the code was written or where servers run. A system built by a non-EU developer but sold under an EU company's own brand usually makes that EU company the provider, not the importer. Record which name appears on the system, its documentation and its declaration, because this single fact determines which Article governs your duties.
High-risk scope under Chapter III
Article 23 duties attach only to high-risk systems. Chapter III Section 1 sets two routes: systems covered by Annex I product legislation, and systems listed in Annex III use cases. Run your classification against both annexes and the Article 6(3) exemption before you assume the importer duties apply. A system outside both routes falls outside Article 23, although other operator duties may still apply.
Dates after the 2026 amendment
Regulation (EU) 2026/1744 moved the high-risk dates. Chapter III Section 1 to 3 rules apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems. Plan imports against these dates and confirm with counsel which date governs a system already on the EU market. Importers should also watch for later changes, because the amendment itself followed a Commission proposal.
Distributors and resellers
A reseller that sells a high-risk system without changing its name or trademark is generally a distributor under Article 24, not an importer under Article 23. The distributor still has its own verification and holding-back duties. Ask suppliers to state in writing whether their EU entity is the importer, the distributor or the provider, and keep that statement with your conformity records.
Rebranding can make you the provider
If an EU company puts its own name or trademark on a third-party high-risk system, or makes a substantial modification, Article 25 can make it the provider. The provider then owes the full set of Article 16 duties, not only the importer checks. Review any white-label or OEM arrangement before launch, and confirm with your legal team whether the contract transfers provider responsibilities.
How an assessor tests Article 23 importer checks
This table shows, for each Article 23 duty, how an assessor samples imports, what evidence they request and where importers most often fall short. Read it as a file review: the assessor picks specific imported systems and checks the paper trail for each one, so evidence must exist per import, not only as a general policy.
| Duty | Test approach | Evidence requested | Common finding |
|---|---|---|---|
| Pre-market verification (Article 23(1)) | Select sampled imports and confirm the checks were completed before the first placement on the EU market | Dated record of the conformity assessment, Annex IV technical documentation, CE marking with declaration and instructions, and the authorised representative appointment | Absent or undated conformity check, found in the file only after placement |
| Suspect or falsified system hold (Article 23(2)) | Look for signs of doubt in the import file and check whether the system was held until it conformed | Records of concerns raised, hold decisions, correspondence with the provider and authorised representative, and any notices to authorities | No documented hold decision where documentation looked inconsistent or incomplete |
| Name and contact address (Article 23(3)) | Check that the system's packaging or accompanying documents show the importer's name, trademark and contact address | Labeling samples, product documentation and the address used in the declaration | Importer details missing from accompanying documents or outdated after a change of address |
| Storage and transport (Article 23(4)) | Ask how the importer keeps compliance intact while the system is stored or moved | Written storage and transport conditions, hosting or handling records, and any change control applied | No defined conditions, or conditions not followed for a specific shipment or deployment |
| 10-year record retention (Article 23(5)) | Pick older imports and confirm the certificate, instructions and declaration can still be produced | Retention schedule, archive index, and retrieval test showing documents from the retention period | Records held only by the provider or a departed employee, or deleted before ten years |
| Cooperation with authorities (Article 23(6) and (7)) | Run a mock authority request for one import and time how long it takes to produce the file | Named contact, request log, response procedure and proof of past or simulated responses | No named owner, or responses delayed because documents sit in several places |
How to set up importer checks before the first shipment
This sequence turns Article 23 into a working gate: you identify every high-risk system you import, verify the provider's paperwork before anything is placed on the market, hold non-conforming systems, control storage and transport, and keep records for 10 years. Each step ends with a document or decision that shows the check was done.
Map imported high-risk systems
Start with an inventory of every AI system your organization would bring into the EU market under a non-EU provider's name or trademark. Article 3(6) defines an importer as an EU-established person placing on the market such a system, so confirm for each item who the provider is, where it is established, and whether it falls within the high-risk categories. Ask the provider to confirm the classification in writing. Done means each imported system has a named owner, a provider record and a high-risk determination you can show an authority.
Build the pre-import verification checklist
Turn Article 23(1) into a checklist that you run before each placement on the market. It should cover four items: the conformity assessment, the Annex IV technical documentation, the CE marking with the EU declaration of conformity and instructions for use, and the appointment of an authorised representative. For each item, record what you received, the version or date, and who checked it. Confirm with your own legal or compliance function which evidence you will accept, since the checklist sets the standard your team applies. Done means a signed template exists for each system.
Review the provider's documentation
Assess the actual documents against the checklist rather than accepting a cover letter. Check that the conformity assessment route matches the system's category, that the technical documentation covers the Annex IV content, that the CE marking and declaration refer to the same system and version you intend to import, and that the authorised representative's mandate is in place. Where something is missing or unclear, ask the provider to supply it before you proceed. Done means a dated review record with any open questions logged against the provider.
Define the hold and escalation procedure
Write the procedure you follow when you have sufficient reason to consider a system non-conforming, falsified or accompanied by falsified documentation. Under Article 23(2), you must not place the system on the market until it conforms. Set out who can stop an import, who must be told at the provider, the authorised representative and the market surveillance authorities where the system presents a risk, and how each notice is recorded. Define who makes the final decision to release a system. Done means the procedure is approved, and the hold can be triggered by any member of the import or procurement team.
Set storage and transport controls
Article 23(3) requires importers to make sure that storage and transport conditions do not jeopardize the system's conformity. For software, this means controlling the copies, media and delivery channels you hold, and recording the version hash or release identifier at each handover. For hardware or embedded systems, record the conditions the provider specifies and confirm with your logistics team that they are met. Ask the provider to confirm these conditions in writing. Done means a storage and transport specification is attached to each system's import file.
Record your name and contact address
Article 23(3) requires the importer to show its name, registered trade name or trademark and contact address on the system, or on its packaging or accompanying documentation where that applies. Check the labeling before release, and keep a copy of the label as it will appear to the user. Confirm with your provider how the address is displayed on digital distribution. Done means a labeling check is signed off for each system and version.
Set up the 10-year record
Article 23(5) requires you to keep a copy of the certificate where applicable, the instructions for use and the EU declaration of conformity for 10 years after the system is placed on the market. Set the retention period in your records system, with an owner, a storage location and an access log. Keep the import review record and any hold decisions with the file. Ask your provider how it will keep the technical documentation available to you if it ceases trading. Done means every system has a retention record that an auditor can retrieve on request.
Prepare for cooperation with authorities
Under Article 23(7), importers must cooperate with the competent authorities on any action relating to a high-risk system they have placed on the market. Name a contact point, define how you will provide documents to an authority on request, and rehearse retrieving a complete import file within a short internal window. Tie this step to your incident and hold procedures so the same file answers both. Done means a tested retrieval exercise is logged with the contact point named.
Evidence that proves an importer checked before placing on the market
An importer's defense under Article 23 rests on a record, not a memory of checks. The cards below describe the artifacts an assessor or market surveillance authority would expect to see, and how each one stays tied to the exact system version that was imported.
Signed pre-import verification record
One signed record per system and version, dated before the system is placed on the market, listing each Article 23(1) check and its result. It is the first document an authority asks for, so it should name the importer's responsible person, the provider, the system name and the version identifier. Each record must be complete before the first import of that version. Confirm that a record cannot be reused for a later version without a fresh review.
Conformity assessment and declaration copies
Keep a copy of the conformity assessment evidence and the EU declaration of conformity supplied by the provider, stored in the same record as the verification. Check that the declaration names the same system and version as the import and that the assessment route matches what the system requires. Confirm with the provider that any notified body involvement is documented and that the certificate, where one exists, is still valid.
Annex IV documentation review notes
Written notes showing what the importer reviewed in the technical documentation, which sections were present, and what questions were raised and closed. Review notes prove that the check was substantive. Record gaps, the provider's answers and the date each gap closed. An empty checklist with a signature is weak evidence.
CE marking and instructions checks
A dated check that the CE marking and accompanying instructions appear on the system or its packaging as the provider supplied them, with photographs or screenshots where the marking is digital. Record the instructions version next to the system version so a later update cannot silently replace the instructions an importer verified.
Authorised representative mandate
The written mandate appointing the EU authorised representative of the non-EU provider, with its date and the scope it covers. Confirm that the representative's contact details match those on the system or in the instructions. Keep a note of the date the mandate was last confirmed, because a lapsed or disputed mandate blocks placing the system on the market.
Hold, storage and retention index
Hold records show each occasion when the importer kept a system off the market because it was non-conforming or falsified, who was informed and when the system was released or withdrawn. The retention index lists every record by system and version, its storage location and its 10-year retention end date. Store the index separately from the records so both can be located during an authority request.
What meeting Article 23 costs in money and effort
This table breaks down the main cost components an EU importer meets before and after placing a non-EU provider's high-risk system on the market, marking which are one-time and which recur. Use it to see who is paid for each activity and what to request in a quote, since no fixed figures are supplied for this page.
| Cost component | Who is paid or who does the work | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Legal review of provider documents | Internal counsel or an outside lawyer checking the EU declaration, instructions and authorised representative mandate | One-time at onboarding, then recurring per new version | Number of provider documents, language, and how complete the first submission is |
| Verification of conformity evidence | Internal compliance or engineering staff checking the conformity assessment route and Annex IV technical documentation | Recurring for each system and each version placed on the market | Number of systems, version frequency and the quality of the provider's documentation |
| Contract terms with the provider | Procurement and legal teams negotiating warranties, cooperation duties, notice of non-conformity and audit access | One-time per supplier agreement, with occasional amendments | Supplier bargaining position, whether the provider already has a standard importer addendum |
| Document storage and 10-year retention | Internal IT or records team, or a managed archive provider | Recurring storage and access costs across the full retention period | Volume of files, format, backup and encryption requirements, and how long records must stay readable |
| Engineering time per import | Internal platform or compliance staff preparing deployment records, labeling checks and storage conditions | Recurring for every import or update | Frequency of releases, degree of automation in deployment records, and staff availability |
| External review of technical documentation | Independent consultant or assessor reviewing Annex IV documentation on the importer's behalf | Optional, recurring when used for each new system or major version | Scope of review, system complexity, and whether a sectoral notified body is involved |
| Suspect or falsified system handling | Legal, compliance and security staff investigating, holding the system back and informing authorities | Unplanned, triggered by a specific concern | Likelihood of documentation gaps, number of affected systems and speed of provider response |
| Cooperation with authorities | Compliance lead and legal counsel answering requests and supplying records | Unplanned, recurring if inquiries arrive | Number and scope of requests, and how quickly records can be retrieved from storage |
Who verifies, who prepares evidence and who audits
The importer is the EU-established party that places a third-country provider's high-risk system on the EU market under its own name or trademark, so the verification duty under Article 23(1) sits with the importer's legal, compliance and procurement functions. Before the system is placed on the market, these teams decide whether the conformity assessment, the Annex IV technical documentation, the CE marking with the declaration and instructions, and the authorised representative appointment are in order. They also make the hold decision under Article 23(2) if something looks falsified or non-conforming, and they answer for that decision to authorities.
- Verification decision: Legal or compliance signs off that each Article 23(1) item was checked and recorded, with a named owner and date.
- Hold authority: The team must be able to stop a placement without commercial override, and must know when to inform the provider, the authorised representative and the authorities.
- Contract terms: Procurement writes audit, document access and cooperation clauses into the supply agreement with the non-EU provider.
- Name and contact on the system: The importer keeps its own name and contact address visible as Article 23(3) requires.
- Ownership of the 10-year file: Records are kept by the importer, even if a partner built the storage.
Confirm internally who holds the final placement decision and whether that person has the authority to refuse a launch.
An implementation partner prepares the checklists, document registers, storage and retention systems that let the importer make and prove its checks. The partner does not verify the provider's conformity on the importer's behalf and does not sign the importer's conclusions. Its work product is the system and the evidence trail: a register of received documents, version control, access logs and a retention schedule that runs for 10 years from the relevant date set by the Act.
- Checklist build: Turns each Article 23 item into a dated, owned control with a clear acceptance test.
- Document register: Tracks the certificate, instructions, declaration, Annex IV documentation and authorised representative mandate for each system version.
- Retention system: Configures self-hosted storage inside the importer's own environment, with immutable or versioned records and tested restore.
- Version history: Tools such as XWiki keep recorded changes, authors and dates, and allow comparison and rollback between versions.
- Role-based access: BookStack-style roles can separate who may edit checklists from who may approve them.
Ask any partner to state in writing which tasks it performs, which remain with the importer, and how it will hand over the records if the engagement ends.
Independent assessment bodies and national market surveillance authorities test whether the importer's records support its claims. An independent auditor or certification body can issue an audit report or certificate for a scheme it is accredited or appointed to deliver, and notified bodies assess the systems that need them under Article 43. Market surveillance authorities can request documents and cooperation under Article 23(7). Neither the importer's advisers nor a partner can stand in for this review.
- Sampling of records: Testers pick systems and check whether the Article 23(1) items were verified before placement and retained afterwards.
- Authority requests: Regulators may ask for the certificate, instructions, declaration and supporting evidence in a set timeframe.
- Independence limits: A partner that wrote the checklist should not also be the party that tests it.
- Notified body role: Where Article 43 requires one, the notified body assesses the provider's system, not the importer's checks.
- Scope confirmation: Confirm with the chosen assessor which evidence it will accept and what it will not review.
Before engaging any auditor, confirm whether it issues reports or certificates for this specific obligation and whether it is independent of the team that built the records.
Where importers fall short on Article 23
Importers carry their own duties under Article 23 before a non-EU provider's high-risk system reaches the EU market. The gaps below recur in practice, and each one has a specific check and a closing action that an importer can put in its own procedures.
Importing before the check is complete
Article 23(1) requires the importer to verify the conformity assessment, the Annex IV technical documentation, the CE marking with the declaration and instructions, and the authorised representative appointment before the system is placed on the market. Shipments and go-live dates are often set by commercial teams before this review finishes. Close the gap by making the four-item verification a written gate that must pass before any contract is signed for market placement.
Accepting documents that do not match
A declaration or technical file that describes an earlier version of the system does not evidence the version actually imported. Importers should compare version identifiers, software builds and model references in the documents against the delivered product. Where documents and product diverge, the importer has grounds under Article 23(2) to hold the system. Close the gap by requiring a version-matched document set for each release and recording the comparison.
No hold procedure for suspect documents
Article 23(2) prohibits placing a system on the market where the importer has sufficient reason to consider it non-conforming or falsified, and requires the importer to inform the provider, the authorised representative and authorities where there is a risk. Many importers have no written trigger, owner or escalation path for this decision. Close the gap by documenting who can halt a placement, the evidence that triggers a halt, and the notification steps.
No storage and transport conditions
Article 23(3) asks importers to ensure that storage and transport conditions do not jeopardize conformity. For software-based systems this extends to how copies, installation media, model files and license keys are held, transferred and deployed inside the importer's own environment. Without defined conditions, a conforming release can be altered before it reaches users. Close the gap by specifying integrity controls, access limits and checksum verification for stored and transferred copies.
Records that cannot be produced for 10 years
Importers must keep the certificate, instructions and declaration of conformity for 10 years under Article 23(3) to (7), and must be able to show their name and contact address on the product. Archives often sit in mailboxes or shared drives with no retention rule, and the link between each record and the imported version is lost. Close the gap by storing these records in a versioned repository with retention labels and a tested retrieval procedure.
Questions importers ask about Article 23
Can an importer run the Article 23 checks in-house?
Yes, an importer can run the checks itself, and the Act places the duty on the importer regardless of who helps. The checks cover four things before a high-risk system is placed on the market: the conformity assessment, the Annex IV technical documentation, the CE marking with the declaration and instructions, and the appointment of an authorised representative. Whether in-house staff can perform them depends on whether they can read technical documentation against the Act's requirements, judge whether a conformity route was followed correctly, and keep a dated record of what was checked. Teams without that depth usually bring in an outside partner for the review, while the importer keeps the decision and the signed record.
How long does it take to set up importer checks?
No general duration is set by the Act, so the timeline depends on the number of systems, the completeness of the provider's documentation and how many documents need translation or follow-up. The main drivers are the time needed to collect the Annex IV file, the time to confirm the conformity route and the notified body details where one applies, and the time to write a repeatable intake procedure that staff can follow for each new system. Ask any partner for a fixed-scope plan that lists the systems in scope, the documents to be reviewed and the deliverables, and confirm the dates with the provider before work starts. Importers can also check the high-risk application dates in the Act, since these affect when the checks must be ready.
What does a non-EU provider need to give the importer?
The provider must give the importer the material the importer needs to verify the requirements. In practice that means the conformity assessment evidence, the Annex IV technical documentation, the CE marking and the EU declaration of conformity, the instructions for use, and the written appointment of an EU authorised representative. Importers should also ask for the provider's contact details and a named point of contact for authority requests, because the importer must show its own name and address on the system and cooperate with authorities. Agree these items in a written intake list before the import, so that a missing document is found before the system reaches the EU market and not after.
Can the 10-year record be kept in a document system?
Yes, a document system can hold the record if it preserves the certificate, the instructions and the declaration for the full retention period and can show who changed what and when. Article 23 requires the importer to keep these items for 10 years, so the system must hold copies that remain readable and unchanged over that period. Open-source wiki and documentation tools can support this. XWiki, for example, keeps every change to a page under version control, records what changed, when and by whom, and allows rollback, while BookStack assigns user abilities through roles that can be overridden per shelf, book, chapter or page. Neither tool is a compliance product, so the importer should confirm backup, export, access control and retention settings in its own environment and test a restore.
What should an importer do when documentation is falsified?
The importer must not place the system on the market while it has sufficient reason to consider it non-conforming, falsified or accompanied by falsified documentation. It must hold the system back until it conforms, inform the provider and the authorised representative, and inform the market surveillance authorities if the system presents a risk. The response starts with a written record of the evidence that raised the concern, a stop on placing the system on the market, and a question to the provider with a deadline. Legal advice is appropriate at this stage because the importer's decisions may carry fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher, or whichever is lower for SMEs under Article 99.
How does a partner's role differ from an auditor's?
A partner prepares the importer's checks, records and evidence, while an auditor or certification body is the independent party that issues any report or certificate. DeployOpen, for example, can help an importer design its intake procedure, set up its document record and prepare evidence for review, but it does not issue audit reports, attestations or certifications. The importer remains responsible for its own decisions and for the Article 23 duties. Where a conformity assessment requires a notified body, that body performs the assessment, not the partner. When choosing help, ask for the written scope, the list of deliverables and a statement of which decisions stay with the importer.
How self-hosted tools can hold importer records
An importer's records are only useful if they show who checked what, when, and who approved the placing on the market. Self-hosted tools can hold that trail: a wiki page for the pre-market checklist under version control, role-based access that limits who can approve an import, and a compliance tool that tracks assessments against frameworks. None of them performs the Article 23 checks itself. The importer still has to verify the conformity assessment, the Annex IV technical documentation, the CE marking with its declaration and instructions, and the appointment of the authorised representative.
XWiki is a practical home for the importer checklist. It keeps every change to a page under version control, recording what changed, when and by whom, and lets reviewers compare any two versions or roll back. For each import, the checklist page can record each verification item with its evidence reference, so a later question about which documents were reviewed before release has a dated answer. XWiki is licensed under LGPL-2.1-or-later, so confirm with your legal team how that license applies to your internal deployment and any modifications you make. Ask your implementation partner to configure page templates so that the verification steps cannot be skipped in the record.
BookStack (MIT) can separate the roles of preparing an import file from approving it. Its permissions come from roles assigned to users, and can be overridden per role at the shelf, book, chapter or page level, so a compliance lead can be the only role able to mark an import as approved while others can edit drafts. Confirm the exact permission set in your version against the BookStack roles and permissions documentation. CISO Assistant (AGPL-3.0-only) ships more than 200 frameworks and can track assessments against them, which helps when an importer also needs to show how a system fits into its wider compliance program. Its automatic mapping between frameworks should be checked by your compliance team before anyone relies on it as a legal finding. The AGPL-3.0-only license has obligations if you modify and offer the software to users over a network, so review those with counsel.
Where the hold decision sits in the import flow
This sequence shows where an EU importer checks a non-EU provider's high-risk system before it reaches the market, and where the decision to hold it is made. Each step closes with a record that a reviewer or authority can later inspect.
Receive the system and its provider documents
Before any placing on the market, the importer confirms that the system carries the name or trademark of a provider established outside the EU, which is the trigger for the importer role. The importer collects the conformity assessment evidence, the Annex IV technical documentation, the CE marking, the declaration and instructions, and the details of the authorised representative. Close the step with a dated intake record listing each document received and the person who received it.
Verify the conformity assessment and technical documentation
Compare the conformity assessment route and the Annex IV technical documentation against the system as it will be placed on the market, not only against the provider's summary. Check that the documentation covers the version, intended purpose and configuration you are importing. Ask the provider to confirm any gaps in writing. The check closes with a verification memo that states what was reviewed, by whom, and any open questions.
Verify the CE marking, declaration and instructions
Confirm that the CE marking is present, that the EU declaration of conformity accompanies the system, and that the instructions for use are in the language the deployers will need. Check the declaration against the version and identifiers of the system you hold, and check any notified body number where a notified body was involved. Record the result against each item so that a missing or mismatched element is visible before the next step.
Confirm the authorised representative appointment
Confirm that the non-EU provider has appointed an authorised representative established in the EU and that the appointment is documented in writing. Obtain the representative's contact details and confirm that the representative accepts the mandate. Without this appointment the system cannot be placed on the market. The step closes when the appointment is on file alongside the other verified documents.
Decide to place on the market or hold
If the checks pass, the importer may place the system on the market. If there is sufficient reason to consider the system non-conforming, falsified, or accompanied by falsified documentation, the importer must not place it on the market until it conforms. The decision, its reasoning and the named approver go into the import file. Keep the system in a controlled state while it is on hold, so that storage and transport do not compromise its compliance.
Inform the provider and authorities where risk exists
Where the system presents a risk, the importer informs the provider, the authorised representative, and the market surveillance authorities. Keep a copy of each notice with the date sent and the recipients. Ask counsel or your compliance lead to confirm the content and format of the notice before it goes out. The step closes with the notices and any replies filed against the import record.
Record the outcome and retain the file
Record the outcome of the import decision, including the name and contact address that the importer must show on the system or its packaging. Retain the certificate, instructions and declaration for 10 years, and keep the record available for cooperation with authorities. Store the file in a system with version history and role-based access so that later changes are traceable. The step closes when the complete import file is indexed and the retention period is set.
How DeployOpen prepares importer checks and evidence
DeployOpen works on the importer side of Article 23 by preparing the systems, records and evidence an EU importer needs to check a non-EU provider's high-risk system before it reaches the market. Scope, build and handover are agreed in writing, and the importer keeps ownership of its own compliance decisions.
How we scope
- Engagements are fixed-scope, with the importer checks, systems and records agreed in writing before work starts.
- The written scope lists which provider documents the importer will verify, including the conformity assessment, Annex IV documentation, CE marking and declaration.
- Scope also records who owns each check, such as the importer's compliance lead, legal team and the provider's authorised representative.
How we build
- We set up a verification checklist that maps each Article 23 check to a named owner, a required document and a recorded decision.
- We configure version-controlled document storage so each provider submission, change and approval can be traced by date and by person.
- We set up access roles so only authorised staff can approve placing a system on the market or change its records.
How we hand over
- You receive the verification checklist, document register and access model, along with the configuration needed to run them.
- Records are structured so the importer can keep the certificate, instructions and declaration for the 10-year period Article 23 requires.
- We document the escalation path for suspect or falsified documentation, including who informs the provider, authorised representative and authorities.
How we support
- Ongoing support, upgrades and continuous testing of the importer's systems are available as retainers after handover.
- Retainers can cover updates to the checklist when the provider's documentation, or the applicable dates in the Act, change.
- The importer's own legal and compliance advisers, and any independent assessor, remain responsible for the conformity determination.
