A provider of a high risk AI system that is not established in the Union must, by written mandate, appoint an authorised representative established in the Union before placing the system on the market, under Article 22. A provider of a general purpose AI model established outside the Union must appoint an authorised representative established in the Union before placing the model on the market, under Article 54, subject to the open source relief in Article 54(6). The authorised representative is defined in Article 3 as a person located or established in the Union who has received and accepted a written mandate to perform and carry out on the provider behalf the obligations and procedures established by the Regulation. The mandate, the representative duties and the provider duties must all be checked in the consolidated Articles 22 and 54, and the representative does not remove the provider duties.
Who must appoint an authorised representative?
Article 22 applies to providers of high risk AI systems that are not established in the Union. Such a provider must, prior to placing the high risk system on the Union market, appoint an authorised representative established in the Union by written mandate. Article 54 applies to providers of general purpose AI models that are established outside the Union, who must appoint an authorised representative established in the Union before placing the model on the market, subject to the Article 54(6) relief for open source models that meet its conditions. The two duties are parallel but distinct, and a company that provides both high risk systems and general purpose models must check both Articles. A provider that is established in the Union does not need an authorised representative on that ground, although it may appoint a representative for other reasons. A provider that has a Union subsidiary, branch or office is not necessarily established in the Union for this purpose, and the establishment facts, including the legal entity, the place of establishment and the mandate, must be recorded. A provider that changes its establishment, for example by opening a Union entity, should reassess the authorised representative duty at the time of the change, and should record the reassessment.
What must the written mandate contain?
The written mandate must be received and accepted by the authorised representative, and must specify the obligations and procedures that the representative is to perform on behalf of the provider. For high risk systems, Article 22(3) sets out the tasks that the mandate must enable the representative to perform, including keeping the technical documentation and the EU declaration of conformity at the disposal of authorities, providing information and documentation on request, cooperating with authorities on action to eliminate risks, and, where relevant, registering the system. For general purpose models, Article 54 sets out parallel tasks, including keeping documentation at the disposal of the AI Office, providing information on request and cooperating with the AI Office and national authorities. The mandate should be in writing, should be dated, should name the systems or models covered, should state the duration and the termination arrangements, and should state the information and access the provider will give the representative. A mandate that is oral, that is not accepted, that does not name the systems covered, or that does not enable the representative to perform the Article tasks will not satisfy the duty. The mandate should be kept with the conformity file and should be producible to an authority on request.
For the broader regulatory framework, see non-EU and international overview.
What duties does the authorised representative carry?
The authorised representative carries the duties set out in the mandate and in Articles 22 and 54, including keeping documentation available, providing information, cooperating with authorities, and taking action where required. The representative must be able to contact the provider, to obtain the documentation and information needed, and to respond to authority requests within the time limits that apply. The representative should not be a mere mailbox. A representative that cannot obtain the file, cannot contact the provider, or cannot answer authority questions will not be able to perform the role, and the provider will remain exposed. The representative and the provider should agree, in the mandate and in a service agreement, the information flows, the response times, the escalation route, the language arrangements, and the action to be taken on a serious incident, a non compliance finding or a market surveillance request. The agreement should also address confidentiality, data protection and the handling of trade secrets, so that the representative can provide information to authorities without breaching a confidentiality duty to the provider. The representative duties should be tested with a hypothetical authority request, to check that the file can be produced and the questions can be answered in time.
What duties remain with the provider?
Appointing an authorised representative does not transfer the provider duties to the representative. The provider remains responsible for the design, development, conformity assessment, documentation, registration, post market monitoring and corrective action duties that apply to it, and for ensuring that the representative has the mandate, the information and the access to perform the representative tasks. Where the representative fails to perform a task, the provider cannot rely on the failure as a defence, where the provider did not give the representative the means to perform it. The provider should therefore monitor the representative arrangement, keep the mandate up to date when systems, models or contact details change, and review the arrangement at a planned interval. Where the representative arrangement ends, for example through termination, insolvency or a change of provider, the provider must appoint a new representative before continuing to place systems or models on the market, and must record the change. A gap in representative cover, during which a system is placed on the market without a representative, is a compliance gap that should be avoided by planning the transition in advance.
How do importers and distributors fit in?
Importers and distributors have their own duties under the AI Act, in addition to the authorised representative duties. An importer is defined as a person located or established in the Union that places on the market an AI system bearing the name or trademark of a person established outside the Union. A distributor is a person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market. Importers must verify that the provider has carried out the conformity assessment, has drawn up the technical documentation and the declaration, has appointed an authorised representative where required, and has met the labelling and information duties, and must keep the documentation available and cooperate with authorities. Distributors must verify, with due care, that the system bears the required markings and documentation, and must take action where they consider that a system is not in conformity. A third country provider should therefore coordinate the authorised representative, importer and distributor arrangements, so that each party has the information it needs and the arrangements are consistent. A supply chain in which the representative, the importer and the distributor each hold different versions of the documentation will create confusion for authorities and for customers.
Continue with territorial reach in Article 2.
What does this guide not decide?
This guide does not decide whether any named provider must appoint a representative, does not draft a mandate, and does not reproduce Articles 22 and 54 in full. The establishment facts, the systems and models covered, the mandate tasks and the open source relief must all be checked in the consolidated text for the specific provider. A third country provider with a specific system or model should confirm the representative duty, the mandate and the supply chain arrangements with a competent authority or legal adviser before placing the system or model on the market. The representative role is a legal role with defined tasks, not a commercial agency arrangement that can be described in general terms.
Frequently asked questions
Must every non-EU provider appoint an authorised representative?
No, only where Articles 22 or 54 require it. Article 22 covers providers of high risk systems not established in the Union, before placing on the market. Article 54 covers providers of general purpose models established outside the Union, subject to the Article 54(6) open source relief. Other providers, such as providers of non high risk systems that are not general purpose models, must check whether any representative duty applies to their category.
Can a representative be a mailbox only?
No. The representative must be able to perform the mandate tasks, including keeping documentation available, providing information and cooperating with authorities. A representative that cannot obtain the file or contact the provider cannot perform the role. The mandate and service agreement should set out information flows, response times and escalation, and should be tested with a hypothetical authority request.
Does appointing a representative transfer provider duties?
No. The provider remains responsible for its provider duties, and for giving the representative the means to perform the representative tasks. A failure by the representative does not remove the provider responsibility where the provider did not provide the mandate, information or access needed.
What happens if the representative arrangement ends?
The provider must appoint a new representative before continuing to place systems or models on the market that require one, and must record the change. A gap in cover should be avoided by planning the transition in advance, with the mandate, documentation and contact arrangements transferred in an orderly way.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗