Article 22 requires the authorised representative, as mandated in writing by a provider established outside the Union, to keep a copy of the EU declaration of conformity, the technical documentation, and, where applicable, the notified body certificate, available to national competent authorities; to provide authorities, on a reasoned request, with all information and documentation necessary to demonstrate conformity; to cooperate with authorities in action to eliminate risks; and to comply with the registration obligation where the mandate provides for it. The representative must also inform the provider where it has reason to consider that the system presents a risk, and must terminate the mandate where the provider acts contrary to its obligations, informing the authority. The representative does not assume the provider's design, manufacture or conformity duties.
What must the representative keep available?
The representative must keep a copy of the EU declaration of conformity, the technical documentation, and, where applicable, the certificate issued by the notified body, and must keep those documents available to national competent authorities for ten years after the system was placed on the market or put into service, in the circumstances Article 22 sets. Keeping available means the representative can produce the current documents promptly, in a form the authority can use, without needing to obtain them afresh from the provider for each request. The representative should maintain a file per system and version, with the declaration, the documentation index, the certificates, and the mandate itself, and should check the file on receipt and on each update. A file that is incomplete, outdated, or held only by the provider does not satisfy the duty.
What information must be provided on request?
On a reasoned request from a national competent authority, the representative must provide all information and documentation necessary to demonstrate the conformity of the system, in an easily understandable form and in a language determined by the Member State. The representative should therefore know the file, know the contact for the provider, and be able to respond within the time the authority sets. A response that only forwards a request to the provider, without providing the information, is not cooperation. The representative should record each request, the information provided, and the date, so that the cooperation can be shown. Where the provider has not supplied the information, the representative should record the gap and inform the authority of the position, rather than providing incomplete information as if it were complete.
For the broader regulatory framework, see deployer responsibilities.
How does cooperation on risk work?
The representative must cooperate with national competent authorities in any action taken to reduce and mitigate the risks posed by the system, including corrective action, withdrawal, disabling or recall. Cooperation can include informing deployers and distributors, providing information about the systems supplied, and supporting the provider's corrective action. The representative must also inform the provider where it considers or has reason to consider that a system presents a risk, so that the provider can take corrective action under Article 20. The representative's cooperation duty is active: it requires engagement with the authority and the provider, not only holding documents. A representative that is uncontactable, or that cannot act, is not performing the mandated role.
What are the limits of the representative role?
The mandate cannot include the provider's core duties, and the representative does not become the provider. The representative does not design or manufacture the system, does not prepare the technical documentation, and does not carry out the conformity assessment. The representative's duties are those specified in Article 22 and in the mandate: holding documentation, providing information, cooperating, and, where mandated, registration. A contract that purports to transfer provider responsibility to the representative does not change the statutory allocation. The representative should therefore resist instructions that would require it to act as provider, and should record any such instruction and the response given, so that the limit of the role is visible.
When must a mandate be terminated?
The representative must terminate the mandate where it considers or has reason to consider that the provider acts contrary to its obligations under the Act, and must immediately inform the market surveillance authority of the Member State in which it is established and, where applicable, the notified body, of the termination and the reasons for it. Termination is a protective step, not a commercial one: it signals to the authority that the provider is not meeting its obligations and that the representative can no longer perform the mandated tasks on a reliable basis. The representative should document the reasons, the evidence, and the communications with the provider that preceded termination, and should handle the transition of documentation and open matters so that authorities are not left without a contact during the gap.
Continue with appointing an authorised representative.
What is not decided by this guide?
This guide explains the representative's duties from the representative's side, complementing the provider appointment guide. It does not draft a mandate, does not decide whether a particular representative has met its duties, and does not advise on the commercial terms of a representation arrangement. Those questions need the mandate, the file, the authority requests, and the provider's conduct, read against Article 22 in the consolidated text. Representatives handling high-risk systems should confirm their arrangements with a competent authority or legal adviser in the Member State where they are established, before accepting a mandate.
Frequently asked questions
Is the authorised representative liable as provider?
No, not as provider. The representative performs the mandated tasks in Article 22 and is subject to the duties and, where applicable, penalties for its own failures, but it does not assume the provider's design, manufacture, documentation or conformity duties.
Must the representative be established in the Union?
Yes. The authorised representative must be established in the Union, so that authorities have a Union-based contact for documentation, information and cooperation. A representative outside the Union does not meet the Article 22 requirement.
Can one representative act for several providers?
Yes, where each appointment is mandated in writing, the systems and tasks are named, and the representative can perform the duties for each provider. The files must be kept separately per provider and per system, so that an authority request for one provider is answered from that provider's file.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗