Builds on AR-000142 (Human Oversight), AR-000210 (High-Risk AI Systems), AR-000240 (Provider Obligations), and AR-000280 (Market Surveillance and Enforcement) — none of their content is re-derived here. This article specifically checked and confirmed AR-000280's provider/deployer-only scoping for Article 73 serious-incident reporting.
Executive summary
What this means
Who this applies to
Regulatory context
Requirements
What organizations must do
- Build the Article 23(1) four-point check into a standard pre-placement gate — all four are binary, verifiable facts rather than judgment calls.
- Track two separate trigger points as a distributor — the one-time pre-availability check and the ongoing post-availability corrective-action duty.
- Maintain a direct channel to the provider (and authorised representative, for importers) specifically for Article 79(1) risk notifications, separate from any general commercial relationship.
- Plan storage and retrieval systems for the Article 23(5) ten-year record-retention duty well in advance, not as a paperwork afterthought.
Common mistakes
Assuming importer and distributor obligations are essentially identical is a common mistake — only the importer verifies the Article 43 conformity assessment and Article 22 authorised-representative appointment directly; the distributor instead verifies the importer's own Article 23(3) identification obligation.
Treating the distributor's obligations as satisfied once the initial pre-availability check is passed is a second mistake — the post-availability corrective-action duty is separate and ongoing.
Assuming the Article 79(1) risk-notification duty satisfies the Article 73 serious-incident reporting duty is a third mistake — the two are structurally separate, tied to different definitions and running through different notification chains.
Overlooking the storage and transport condition duties is a fourth mistake — the Regulation frames these explicitly as compliance obligations, not purely logistical concerns.
Open questions
- How Article 23(6)'s "easily understood" language standard is applied in practice — not addressed by any source consulted on this pass.
- Whether Commission guidance addresses edge cases at the boundary between "importer" and "distributor," such as an EU-based reseller of a non-EU system — not identified on this research pass.