The EU Authorised Representative: When Non-EU Providers Must Appoint One

A provider based outside the EU cannot place a high-risk AI system on the EU market and stay out of reach. The EU AI Act, Regulation (EU) 2024/1689, requires a non-EU provider to appoint an EU authorised representative — a point of accountability inside the Union. The duty sits in Article 22 for high-risk systems and Article 54 for general-purpose AI models.

When you must appoint one

If you are a provider established outside the EU and you place a high-risk AI system on the EU market or put it into service, you must, by written mandate, appoint an authorised representative established in the Union before doing so (Article 22). A parallel obligation applies to GPAI model providers outside the EU under Article 54. EU-based providers do not need one — they are already within reach of the authorities.

What the authorised representative does

The representative is defined in Article 3(5) and acts on the provider's mandate. Its tasks under Article 22 include:

• verifying that the Declaration of Conformity and technical documentation have been drawn up and the conformity assessment carried out;
• keeping the technical documentation, the Declaration of Conformity, and the provider's contact details available to authorities for 10 years;
• providing authorities, on a reasoned request, with the information and documentation needed to demonstrate conformity;
• cooperating with competent authorities on any action regarding the system;
• terminating the mandate and informing the authority if it considers the provider is acting contrary to its obligations.

It is an accountability bridge, not a transfer of duties

Appointing a representative does not move the provider's substantive obligations onto it. The provider still must meet Articles 9–15, run the conformity assessment, and so on. The representative is the EU-side contact and document-keeper that gives authorities someone to deal with — a bridge, not a substitution. Importers and deployers should check that a non-EU provider has appointed one.

Worked example: a US high-risk AI vendor

A US company sells a high-risk recruitment-screening system into the EU. Before placing it on the market, it must appoint an EU authorised representative by written mandate (Article 22), who verifies the technical documentation and Declaration of Conformity exist, holds them for 10 years, and is the contact for national authorities. The US provider still carries all the substantive high-risk duties; the representative makes those duties enforceable inside the EU.

How Confir helps

Confir flags where a system's provider is established outside the EU and an Article 22 (or Article 54 for GPAI) authorised representative is required, and keeps the technical documentation and Declaration of Conformity the representative must hold in one place. For deployers and importers, it surfaces the check that a non-EU provider has appointed one. The engine is deterministic and rule-based.

Frequently asked questions

Who needs an EU authorised representative under the AI Act?

Providers established outside the EU that place a high-risk AI system on the EU market or put it into service must appoint one by written mandate under Article 22. GPAI model providers outside the EU must appoint one under Article 54. EU-based providers do not need a representative.

What does the authorised representative do?

It acts on the provider's mandate: verifies the Declaration of Conformity and technical documentation exist, keeps them available to authorities for 10 years, supplies information on reasoned request, cooperates with authorities, and can terminate the mandate if the provider appears non-compliant. It is the EU-side point of accountability.

Does appointing a representative move our obligations to them?

No. The provider keeps all substantive obligations — Articles 9–15, the conformity assessment, and the rest. The representative is an accountability bridge and document-keeper inside the EU, not a transfer of the provider's duties.

Do importers and deployers need to check for one?

Yes, in practice. Importers must verify a non-EU provider has met its obligations, including appointing an authorised representative, before placing the system on the market, and deployers should confirm it as part of vendor due diligence.

When does the requirement apply?

For high-risk systems, with the rest of the high-risk regime: stand-alone Annex III obligations apply from 2 December 2027, the date set by the Digital Omnibus adopted in June 2026; product-embedded Annex I systems follow on 2 August 2028. GPAI authorised-representative duties under Article 54 follow the Chapter V timeline (since 2 August 2025).

Related guides

• Authorised representative, defined
• AI value-chain roles
• Importer obligations
• Extraterritorial scope of the EU AI Act
• Annex III high-risk use cases