What Article 24 asks distributors to check before and after they supply a high-risk AI system
Article 24 requires a distributor of a high-risk AI system to verify, before making the system available, that the CE marking, the EU declaration of conformity and the instructions for use are in place, and that the provider and importer have met their labeling and quality management obligations. If the distributor has reason to believe the system does not conform, it must not make it available until it does, and it must tell the provider or importer when the system presents a risk. After supply, the distributor must take or ensure corrective action, withdrawal or recall, and inform the provider or importer and the competent authorities immediately if the system presents a risk. The duty is a check on a product the distributor did not build, so it depends on documents and cooperation from upstream parties.
Distributors are hard to govern for three practical reasons. They often hold systems in warehouses, cloud marketplaces or reseller catalogs where the version, labeling and documentation can drift from what the provider certified. Article 24 also requires them to protect compliance during storage and transport, which means a conforming system can become non-conforming through handling, such as a changed configuration or a missing instruction set. Finally, contracts with upstream providers and importers rarely specify who supplies the declaration of conformity, who receives notice of a defect, or how quickly a recall must happen. Without those terms, the distributor cannot meet its own deadlines.
A useful first step is to list every high-risk system the organization resells or makes available, and for each one record the provider, the importer where one is involved, the version, and where the CE marking, declaration and instructions are held. Ask upstream parties in writing for the current documents and for a named contact for risk notices, and confirm how often those documents are reissued. Decide in advance who may stop a listing, who approves a withdrawal and how the organization will reach authorities. Confirm the penalty exposure under Article 99 with your legal team, since the fine ceiling for distributor breaches is set in that article and depends on turnover and company size.
Which distributors and systems Article 24 reaches
Article 24 applies only to a narrow set of parties and systems, but the boundary is drawn by role and channel rather than by company type. The cards below cover who qualifies as a distributor, where distributors end and importers or deployers begin, and the scoping choices that change the work.
Who counts as a distributor
A distributor is a party in the supply chain, other than the provider or importer, that makes a high-risk AI system available on the EU market without changing its properties. The test is the activity, not the company's name or size. Before you accept the role, confirm whether your organization only resells, ships or stocks a system that someone else built and labeled. Document that conclusion, because it sets which Article 24 checks you own.
Distributor versus importer
An importer is the EU-established party that places a non-EU provider's system on the EU market under that provider's name. A distributor acts later in the chain, usually after an importer or provider has already made the system available. If your organization brings a system in from outside the EU for the first time, you are likely acting as an importer under Article 23, not a distributor. Confirm which role applies before you start the verification steps.
Distributor versus deployer
A deployer uses a high-risk system under its own authority for a professional purpose, and its duties sit in Article 26. A distributor makes the system available to others and does not use it for its own purposes. An organization can be both, for example when it resells a system and also runs it internally. In that case, map each system to each role separately, because the verification duties and the deployer duties apply to different activities.
Marketplaces and resale channels
Reselling through an online marketplace, a reseller network or a partner portal does not remove the distributor's duties. Ask who lists the system, who holds the contractual relationship with the provider and who receives the CE marking documents. Where a marketplace operator only hosts listings, its role may differ from a party that stocks and supplies the system. Record which party performs each verification in your contracts and channel terms.
White-label and rebranded systems
A white-label arrangement can change who is the provider. If you put your own name or trademark on a high-risk system, or substantially modify its intended purpose, Article 25 may treat you as the provider, which brings a much larger set of obligations. Review each rebranding deal against that test before you describe yourself as a distributor. Confirm in writing which party owns the technical documentation and the EU declaration of conformity.
Multi-channel and stored inventory
A single high-risk system can move through several channels, stock locations and transport legs, and each handover is a point where Article 24 checks can lapse. Map each channel and warehouse, the parties that touch the product, and the date each one receives it. The verification and storage duties apply wherever the system sits in your custody. Keep an inventory that links each unit or batch to its conformity documents.
How an assessor tests distributor duties under Article 24
This table sets out how an assessor tests each distributor duty under Article 24, the evidence requested for each, and the findings that appear most often. Read each row as a question the distributor must answer with records, not with a policy statement alone. Assessors typically treat a missing record as a finding even where the underlying check was carried out.
| Duty | What the assessor tests | Evidence requested | Common findings |
|---|---|---|---|
| Pre-supply verification | Whether the distributor checked the CE marking, EU declaration of conformity and instructions for use before making a high-risk system available | Dated checklist per system version, copies of the declaration and marking reviewed, named reviewer | No record of CE marking checks, checks done verbally only, or checks made after the system was already listed for sale |
| Labeling and provider QMS check | Whether the distributor confirmed the provider and importer met their labeling and quality management obligations | Written confirmation or supplier questionnaire on file, with the date and the document version reviewed | Reliance on the supplier's marketing material, or no check of the importer where one is involved |
| Hold-back decision | Whether the distributor stopped making a system available when it had reason to believe the system did not conform, and kept it on hold until it did | Non-conformity log, hold instructions to sales and logistics, release approval after conformity is shown | No hold recorded despite a known defect, or systems released by staff without a second sign-off |
| Escalation to provider or importer | Whether the distributor informed the provider or importer when a system presented a risk | Dated notices sent, reply received, and the internal escalation path showing who decided | No escalation path defined, notices sent to the wrong contact, or no record of a reply |
| Corrective action, withdrawal and recall | Whether the distributor took or ensured corrective action for systems already supplied, and informed the authorities when a risk was present | Customer list by system version, action records, withdrawal or recall completion reports, authority notification copies | Inability to identify which customers received an affected version, or action taken without informing the provider, importer or authorities |
| Storage and transport conditions | Whether the distributor kept the system's compliance intact while stored and shipped | Storage conditions procedure, transport handling records, evidence that packaging and labels were not altered | Labels or documentation damaged or removed in the warehouse, or no condition checks logged |
| Information on request | Whether the distributor can produce the documents and information a competent authority asks for, within a defined response process | Request register, response times recorded, document index linked to each supplied system | Documents held by individual sales staff rather than a controlled repository, or no owner for authority requests |
| Cooperation with authorities | Whether the distributor cooperates with competent authorities on actions taken to bring a system into conformity or to withdraw it | Named contact for authorities, correspondence file, record of cooperation steps and outcomes | No named contact, or responses delayed because no one was assigned to the request |
How a distributor builds the Article 24 verification and response process
The sequence below turns Article 24 into a working routine: know which high-risk systems you make available, check each one before it reaches a customer, stop and escalate when something is wrong, watch what has already been supplied, protect compliance in storage and transport, and prove you can answer authorities.
Map the high-risk systems you make available
Start by listing every AI system your organization offers, resells or otherwise makes available in the EU, and mark which ones fall in the high-risk categories under the Act. Assign an accountable owner to each system and record the provider and importer named on the product. Confirm the classification with legal counsel, because the Article 6(3) exemption and Annex scope decisions change the answer. The output is a distributor register that names each high-risk system, its provider, its importer where one exists, and the person who signs off on supply decisions. You know the step is done when no product reaches the sales channel without a register entry.
Define the pre-supply verification checklist
Write a checklist that matches the Article 24(1) checks: presence and validity of the CE marking, the EU declaration of conformity, the instructions for use, and evidence that the provider and importer have met their labeling and quality management system duties. Assign each check to a named reviewer and state what acceptable evidence looks like, such as a copy of the declaration on file and a matching version number on the instructions. Ask the provider for the documents it holds under its own obligations and keep the request and response in the record. The output is a signed-off checklist, version controlled, that a reviewer completes for each system before the first sale. Done means every high-risk system has a completed checklist on file.
Set the hold-back and escalation rules
Define the conditions that stop a release: a missing or mismatched CE marking, a declaration that does not cover the version being supplied, labeling that is incomplete, or any reason to believe the system does not conform. Under Article 24(2), a system must not be made available until it conforms, so write the rule so that a single open question blocks supply. Set a path for the reviewer to escalate to the provider or importer and, where the system presents a risk, to notify them. The output is a written hold-back procedure with named decision makers and a log of each hold and its outcome. You know it works when a test case with a deliberately incomplete file is stopped at review.
Set up post-sale monitoring and recall procedures
Article 24(4) applies after supply. Establish a way to receive provider notices, complaints, incident reports and market surveillance information for each system in the register, and assign someone to review them. When a system already supplied turns out to be non-conforming or to present a risk, the procedure must cover corrective action, withdrawal or recall, and immediate information to the provider or importer and to the competent authorities. Map which customers hold each affected version so that recall notices can reach them quickly. The output is a monitoring log, a recall playbook and a customer contact map. You know it is done when a tabletop exercise traces a sold unit back to its customers within the procedure.
Protect compliance in storage and transport
Article 24(3) requires distributors to act so that a system does not lose its conformity while it is stored or transported. Define the handling conditions for physical media, hardware appliances and downloadable packages, including who may access stock, how versions are tracked, and how damaged or altered items are quarantined. For software delivered electronically, keep the signed artifact and its checksum with the register entry so the copy delivered matches the copy checked. The output is a storage and transport standard with a stock record that ties each batch to its verified version. You know it is done when a sampled item can be matched to its checklist and checksum without manual reconstruction.
Keep records and answer information requests
Keep the checklists, hold decisions, provider correspondence, monitoring logs and recall records in a version-controlled repository with defined owners and access rights. Article 24(5) requires the distributor to provide information and documents on request, so prepare a retrieval index that can produce the file for any system within a short working period. Confirm with counsel how long records must be retained, since the Act's retention periods vary by document type. The output is a searchable record set with an index. Done means a reviewer can rebuild the full supply file for one system from the repository alone.
Rehearse the authority cooperation path
Article 24(6) requires cooperation with competent authorities. Write the contact path, define who speaks for the organization, and specify how documents will be produced and reviewed by legal counsel before release. Run a scenario exercise in which a market surveillance authority asks for the supply file of one system and a corrective action is needed. Record the time taken, gaps found and fixes assigned. The output is a rehearsal report and an updated procedure. Confirm with national authorities which contact points apply in each member state where you distribute.
Why the pre-supply check is a document trail, not a one-time signature
A distributor that makes a high-risk system available must be able to show that it actually looked at the CE marking, the EU declaration of conformity and the instructions for use for that specific system and version. Article 24(1) sets the duty before the system is made available, so the evidence is a dated record: which document was checked, which system identifier and version it belongs to, who performed the check, what they compared it against, and what they decided. A bare statement that the supplier is trusted, or a signed onboarding form from years ago, will not show what was checked for the product now on the shelf. Design the record so that each release or batch can be traced to its check.
Versions are where an earlier check goes stale. A provider can ship a new version, change the intended purpose in the instructions, or reissue the declaration after a substantial modification, and the distributor's previous sign-off then covers a different product. Build triggers into the process: a provider update notice, a changed version number in the declaration, or a revised instruction set should reopen the check before further supply. Confirm with each provider how it notifies distributors of updates and whether it issues a new declaration for each change. Under Article 24(2), a distributor with reason to consider a system non-conforming must hold it back until it conforms, so the trigger logic needs an owner with authority to stop shipments.
The harder judgment is deciding what counts as reason to consider a system non-conforming. Obvious signs include a missing or mismatched CE marking, a declaration that does not reference the system in hand, instructions that omit information the distributor needs, or information from the provider, an authority or a customer that conflicts with the documents. Write these criteria down, define who may escalate, and record each decision, including decisions to proceed. Where the distributor concludes that the system presents a risk, it must inform the provider or importer, so the escalation path should name those contacts before any incident arises. Legal review of these criteria is a sensible use of outside counsel, since the decision carries a fine exposure under Article 99.
Evidence that shows a distributor meets Article 24
Article 24 puts checks at three points: before a high-risk system is made available, while it sits in storage or transit, and after sale when a problem appears. The six records below cover those points, and each one should be updated as events happen rather than rebuilt before an audit.
Pre-supply verification record
For each system and version, record that you checked the CE marking, the EU declaration of conformity and the instructions for use before making it available. Also record that the provider and importer met their labeling and quality management duties, and who signed off. Keep one entry per system version, so a later version cannot inherit an earlier approval. Review entries whenever the provider issues a new version or changes its documentation.
Hold-back and escalation log
Log every case where you had reason to consider a system non-conforming, the date you withheld it from sale, and the notice you sent to the provider or importer when it presented a risk. Record the decision to release it only after conformity was shown. Check the log at each supplier review and close entries only with written evidence of resolution.
Corrective action and recall records
For systems already supplied, keep the record of each corrective action, withdrawal or recall you took or ensured, the customers reached, and the immediate notice sent to the provider or importer and to competent authorities where the system presented a risk. Note any gap between the time of discovery and notification. Test the customer contact list at least once between audits so recall notices can actually be delivered.
Storage and transport controls
Document the conditions under which high-risk systems and their media are stored and moved, and who can access them. Show that these controls keep the system in conformity while in your custody, such as protected packaging, access restrictions on distribution copies and checks on delivered versions. Review the controls when logistics partners or hosting arrangements change.
Information request register
Record each request from a provider, importer, deployer or authority for information about a system you distributed, with the date received, the owner, the response and the date sent. This shows you provide information on request as Article 24 requires. Confirm with counsel which records you may disclose and how confidential material is marked before the first request arrives.
Authority cooperation file
Keep one file per authority contact that holds correspondence, the documents supplied, the named contact for each authority, and the actions agreed. Include the internal procedure for who answers and who approves a response. Rehearse that procedure with the people named in it, because a delayed reply to a market surveillance authority is harder to explain than a late internal approval.
What meeting Article 24 costs in money and effort
This table lists the cost components a distributor of a high-risk AI system carries under Article 24, who is paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to shape the scope of a quote, since no supplied figures exist for these costs and every amount should come from your own written scope.
| Cost component | Who is paid or who carries it | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Pre-supply verification checks | Internal staff in compliance, procurement or product teams | Recurring, per new high-risk system or supplier change | Number of high-risk systems in the catalogue, quality of provider documentation, and whether CE marking and declarations are checked against a standard checklist |
| Records and version control tooling | Software licence fees, or internal hosting time for self-hosted open source | One-time setup, then recurring hosting and upkeep | Choice of licensed versus self-hosted tools, retention period for conformity records, and how many people need edit rights |
| Legal review of supplier and provider contracts | Internal counsel or external law firm | One-time for template terms, recurring for each new contract or amendment | Use of standard clauses on information requests, corrective action and cooperation, and how often suppliers change their terms |
| Corrective action and withdrawal handling | Internal incident, product and legal teams, plus any external technical support | Recurring and event-driven | Volume of non-conforming systems found after sale, speed of withdrawal or recall process, and how clearly the response roles are defined in advance |
| Notifications to providers, importers and authorities | Internal compliance and legal staff | Recurring and event-driven | Quality of the escalation path, pre-agreed contacts at each supplier, and drafting templates kept ready before an incident |
| Storage and transport safeguards | Internal logistics or operations staff, and any third-party logistics provider | Recurring | Physical handling of goods, whether systems are delivered as software or hardware, and contract terms with logistics partners |
| External review or readiness support | Independent consultant or implementation partner, fixed-scope or retainer | Usually one-time for a readiness review, optional recurring retainer | Size of the high-risk portfolio, existing internal expertise, and whether the review covers only Article 24 or the wider AI Act programme |
| What to ask a quote to include | Requested from any outside provider before work starts | Set once in the written scope | Named deliverables, assumptions about system count and supplier count, tooling assumptions, hours by role, and what is excluded such as legal opinions or audit reports |
Who owns Article 24 work: distributor, implementation partner and auditor
The distributor is the party that makes a high-risk system available on the market and carries the Article 24 obligations. It cannot hand these to a consultant or vendor. Before making a system available, the distributor must itself check the CE marking, the EU declaration of conformity and the instructions for use, and decide whether the provider and importer met their labeling and quality management duties. If it has reason to consider a system non-conforming, the distributor holds it back and decides whether to inform the provider or importer. For systems already supplied, it owns the corrective action, withdrawal or recall decision and any contact with competent authorities.
- Pre-availability checks: Record who checked the CE marking, declaration and instructions, and the date of each check.
- Hold decisions: Document the reason for withholding a system and the condition for releasing it.
- Post-sale action: Decide on withdrawal or recall and who executes it, with the timing set by the risk.
- Authority contact: Name the person who informs the provider, importer and competent authorities and keep a copy of each notice.
- Information requests: Route authority requests to a named owner who answers them.
Confirm with legal counsel how the distributor's obligations interact with contracts in its supply chain before relying on this split.
An implementation partner can prepare the systems that produce Article 24 evidence. This includes the record structures, approval workflows, storage conditions and version history that show what the distributor checked and when. The partner does not decide whether a system conforms, and it does not contact authorities on the distributor's behalf unless the distributor has authorized that in writing. Work of this kind is usually fixed in scope and agreed before it starts, so the distributor knows exactly what it is buying.
- Records and templates: Build checklists for the CE marking, declaration and instructions checks that the distributor's staff complete and sign.
- Version control: Set up a wiki or document system that keeps every change to a procedure, recording what changed, when and by whom, with the ability to compare and roll back versions.
- Access roles: Configure permissions so that only named roles can approve holds, releases and recall decisions.
- Storage and transport controls: Document the procedures that protect conformity during storage and transport.
- Evidence exports: Produce the records an assessor or authority will request in a consistent format.
Ask any partner to state in writing which tasks it performs, which it does not, and who signs off each record.
An independent auditor, assessor or certification body tests whether the distributor's controls operate as described. Only an independent party can issue an audit report, attestation or certificate. The auditor samples records, checks whether decisions were made by the right people at the right time and compares what the procedure says with what happened. Its independence means it cannot design the controls it later tests, and it cannot prepare the evidence it reviews as if it were the distributor's own work.
- Sample testing: Select releases, holds and corrective actions and trace each to a signed decision and its supporting checks.
- Timing checks: Compare the date of each check with the date the system was made available.
- Walkthroughs: Ask staff to explain the hold and recall procedure and test whether they follow it.
- Gap findings: Report deviations to the distributor, who decides on remediation.
- Scope confirmation: Agree in advance which systems, suppliers and periods are in scope.
Confirm whether the assessor you engage is able to test against this article, since the reference point is a legal duty rather than a published certification standard.
Organizations usually outsource the build and maintenance of supporting systems, the drafting of procedure templates and the preparation of evidence packs. They usually keep the legal judgments, the release and hold decisions, and direct contact with authorities. Independence draws the line at the point where a party would be testing its own work. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Those come only from independent auditors and certification bodies.
- Typically outsourced: Workflow setup, version-controlled procedure libraries, evidence formatting and staff training on the procedures.
- Typically retained: Conformity decisions, hold and recall authority, and communications with the provider, importer and authorities.
- Shared with counsel: Interpretation of the article and the contract terms that allocate responsibility in the supply chain.
- Independent only: Testing of controls, opinions on operating effectiveness and any certificate.
- Quote request: Ask for a written scope listing deliverables, responsibilities and exclusions before work starts.
Check that the partner's and the assessor's written scopes do not overlap in a way that leaves a control untested or tested only by its own builder.
Where distributors usually fall short of Article 24
Distributors of high-risk AI systems carry verification and corrective duties that often sit outside procurement and sales processes. The gaps below tend to appear together, and each one weakens the distributor's ability to show it checked the system before making it available and acted after it was sold.
No pre-supply record per version
Article 24(1) asks the distributor to verify the CE marking, the EU declaration of conformity and the instructions for use before a high-risk system is made available. Many distributors check the first version they list and never record the check again when the provider ships an update. Keep a dated verification record for each version and build number, naming who checked it and which documents were seen. Ask the provider which version each delivered document covers.
No defined hold-back authority
Under Article 24(2), a distributor with reason to consider a system non-conforming must not make it available until it conforms. In practice, the staff who hold the sales or listing controls often lack authority to stop a release. Write down who can suspend availability, what evidence triggers a hold, and who signs off on lifting it. Test the hold path once before it is needed.
Contracts without conformity document duties
A distributor can only verify what the provider or importer hands over. Supply agreements often omit any duty to deliver the declaration of conformity, updated instructions for use, or notice of non-conformity. Add clauses requiring these documents for each version, prompt notice of problems, and cooperation in corrective action. Confirm that the provider's labeling and quality management obligations are covered by the contract terms.
Slow escalation of identified risks
Article 24(4) requires the distributor to inform the provider or importer and the competent authorities immediately when a system presents a risk. Support tickets, customer complaints and partner reports often reach a manager before they reach the compliance owner, and the delay is rarely documented. Define the triggers, the internal route and the named recipients for each notice. Keep a timestamped log of when each signal was received and when it was passed on.
No recall path for systems already sold
For systems already supplied, Article 24(4) requires the distributor to take or ensure corrective action, withdrawal or recall. Many distributors hold customer lists only in sales tools, so they cannot quickly identify which customers received the affected version. Maintain a deployment register that links each customer to the versions supplied. Agree with the provider in advance how withdrawal notices reach customers.
Records that cannot be produced on request
Article 24 requires distributors to provide information on request and to cooperate with authorities, including during storage and transport. Verification checks, hold decisions and notices are often spread across email and chat, which makes them hard to retrieve. Keep one controlled repository with version history and role-based access, and run a periodic request drill. Confirm with counsel how long these records must be kept under the rules that apply to your sector.
Questions distributors ask about Article 24 cost, effort and outside help
How much work does Article 24 add for a distributor?
For most distributors, Article 24 adds verification and record-keeping steps to existing product intake and stock handling. The Article asks you to check the CE marking, the EU declaration of conformity and the instructions for use before a high-risk system is made available, to hold back systems you have reason to consider non-conforming, and to act when a supplied system presents a risk. The main cost drivers are the number of high-risk systems you distribute, the number of providers and importers behind them, and whether your current intake records can show that each check was made. Your cost comes from internal staff time, legal review of supplier contracts, and any outside help you buy. Ask for the scope in writing before you commit to a budget.
Can a distributor meet Article 24 without an outside consultant?
Yes, a distributor can meet Article 24 with its own staff, provided it names owners for intake, storage, sales and supplier contact. The duties are procedural: verify documents, pause non-conforming systems, inform the provider or importer, take corrective action where systems are already supplied, keep records and cooperate with authorities. Many organizations keep ownership of these decisions and bring in help only for specific gaps, such as reviewing supplier paperwork, writing the verification procedure or setting up evidence storage. An implementation partner prepares your procedures, systems and evidence, but it does not issue reports or certificates. A good first step is an internal review of your current intake process against the Article, so you can see which gaps need outside support.
What does Article 24 require from our staff day to day?
Article 24 work falls to people in four areas, and each needs a named owner:
- Procurement or product intake, who checks CE marking, the declaration of conformity and instructions for use before a system is listed.
- Compliance or legal, who reviews supplier contracts and confirms that the provider and importer met their labeling and quality management duties.
- Warehouse and logistics, who keep systems in conditions that protect conformity during storage and transport.
- Sales or account operations, who hold back systems that have not been cleared and answer buyer requests for information.
Each role also needs a way to escalate a suspected risk quickly, because the Article expects prompt notice to the provider or importer and, where a risk exists, to competent authorities.
How long does Article 24 setup take for a distributor with many systems?
Setup time grows with the number of high-risk systems, suppliers and product lines you distribute, and with how much of your intake documentation already exists. A distributor with a few systems from one provider has a narrow task. A distributor with many suppliers, mixed documentation and several sales channels needs more time to map each system, collect its documents and set up holds, records and escalation paths. The Act does not set a fixed setup duration. For planning, note that the high-risk rules apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, as amended in 2026. Before you accept a schedule, ask for a breakdown by system group and phase, and identify which steps depend on documents your suppliers must provide.
What fines apply under Article 99 for distributor breaches?
Breaches of Article 24 fall under the operator obligations tier of Article 99, with fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs, the lower of the two figures applies. The fine ceiling is not the only exposure. A non-conforming system that reaches customers can trigger corrective action, withdrawal or recall, and cooperation with authorities, and buyers may pursue contractual remedies. National market surveillance authorities enforce the Act for AI systems, and any penalty depends on the facts of the case. Treat the ceiling as a risk figure rather than a budget line, and ask your legal counsel to confirm how the tiers apply to your role and to any sector rules that also apply.
What should a fixed-scope quote for Article 24 include?
A fixed-scope quote should list each deliverable and the systems, suppliers and sales channels it covers. Ask that it include:
- An inventory of the high-risk systems and suppliers in scope, with the ones you distribute marked.
- The verification procedure, the documents checked, the owners and the record format.
- The hold and release process for non-conforming systems, and who clears them.
- Notification steps and contacts for providers, importers and authorities.
- Storage and transport controls, plus the corrective action and recall workflow.
- Training, a test run, handover, and evidence storage with version history, such as the approach described in XWiki's document version control overview.
- Exclusions, assumptions, your responsibilities and acceptance criteria.
DeployOpen works to a written scope, and its quotes follow from that scope. Confirm that the quote states which supplier documents it depends on, because no partner can verify documents a provider has not supplied.
Does an implementation partner issue an Article 24 compliance certificate?
No. An implementation partner prepares systems, procedures and evidence, but it does not issue reports, attestations or certificates. Conformity of a high-risk system is established through the provider's assessment and, where the route requires it, a notified body. Your Article 24 checks are your own duties, which you perform and record yourself. A partner can help design the checks, set up the records, and test the hold and corrective action processes, while you remain accountable for the decisions you make. If you need an independent opinion on conformity, look to an independent assessor or certification body, not to your implementation partner.
How DeployOpen prepares distributor evidence for Article 24
DeployOpen treats Article 24 as an evidence problem: a distributor needs to show, before and after making a high-risk system available, that it checked the CE marking, the declaration of conformity and the instructions for use. We prepare the systems, records and procedures that make those checks repeatable, while the organization keeps ownership of its controls and the decisions it makes.
How we scope
- Each engagement starts with a written scope that names the high-risk systems, the distribution channels and the roles covered.
- Scope records which Article 24 checks the distributor performs before availability and which it performs after supply.
- Scope states which storage, transport and recall processes are in or out, and who in the organization approves them.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work begins.
How we build
- We configure a verification workflow that holds each system until CE marking, declaration and instructions are checked and recorded.
- We set up a version-controlled register of supplied systems, provider contacts and the importer where one applies.
- We draft procedures for withholding non-conforming systems, notifying the provider or importer, and escalating risk to authorities.
- We test the workflow with sample cases so the organization sees how a hold, a notification and a recall are recorded.
How we hand over
- You receive the verification procedures, checklists, role assignments and access settings in the organization's own environment.
- Evidence records are arranged so that a reviewer can trace each system from receipt through verification to any corrective action.
- Documentation covers how to produce information on request and how to route cooperation requests from competent authorities.
- Handover includes a walkthrough with the staff who will run the workflow day to day.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- A retainer can cover periodic review of verification records, updates to procedures and changes to the systems in scope.
- Before relying on any assessment result, confirm with an independent auditor or competent authority which evidence they will request.
