EU AI Act Article 22: The Authorised Representative Requirement for Non-EU Providers of High-Risk AI

You are a software company in San Francisco or Singapore, and you have built a high-risk AI system that EU customers want to buy. Before you can place it on the Union market, you must appoint — by written mandate — an authorised representative established in the EU. Under Article 22 of Regulation (EU) 2024/1689, that appointment is a precondition to market access, not a post-launch formality.

This guide is an operational walkthrough of Article 22 for the non-EU high-risk provider who must appoint: the written mandate, the five enumerated tasks the representative carries out, the ten-year retention window, the termination right, and what a breach costs. It covers high-risk AI systems specifically; the parallel requirement for general-purpose AI models lives in Article 54 and is out of scope here.

---

What Article 22 Requires of a Non-EU Provider

Article 22(1) is direct: a provider established in a third country must, prior to making its high-risk AI system available on the Union market, appoint by written mandate an authorised representative established in the Union.

Three words in that sentence carry the weight. Prior to — the appointment must be in place before placing on the market or putting into service, not bolted on after launch. Written mandate — this is a documented role appointment that the representative receives and accepts, not an administrative filing. And established in the Union — the representative must have a registered presence inside an EU Member State, because the entire point is to give EU authorities a reachable address.

An honest framing matters here. Most general business AI — productivity assistants, coding tools, internal search — is not high-risk, so Article 22 bites only when a non-EU provider actually places an Annex III stand-alone system or an Annex I product-embedded high-risk system on the EU market. If your system is not high-risk under Article 6, you do not need an Article 22 representative at all. When it is, the appointment is non-negotiable.

---

Who Must Appoint One — and When the Clock Starts

The obligation triggers when three facts coincide. Get any one of them wrong and you may misjudge whether Article 22 applies to you.

The three triggering conditions

1. The provider is established outside the EU — a company or individual whose registered seat is in a third country.
2. The system is high-risk under Article 6 — either via the Annex III stand-alone route (Article 6(2)) or the Annex I product route (Article 6(1)).
3. The system is being placed on the Union market or put into service in the EU.

The second and third conditions interact with timing. Placing on the market means making the system available in the EU for the first time; putting into service means supplying it for first use directly to a deployer or for the provider's own use. A non-EU vendor should self-identify which event applies, because it fixes the moment the mandate must already exist.

The broader extraterritorial reach — how the Act catches non-EU companies in the first place — is governed by Article 2 and handled in the dedicated scope guide; this page assumes you have already concluded you are in scope.

Statutory vs deferred dates — what to plan against

The statute originally read 2 August 2026 for stand-alone Annex III high-risk obligations, and 2 August 2027 for product-embedded Annex I high-risk obligations.

The Digital Omnibus — adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026 — defers these to 2 December 2027 and 2 August 2028 respectively. It enters into force on publication in the Official Journal, expected before 2 August 2026; that publication is a formality, not an open legislative step. Plan against 2 December 2027 for stand-alone Annex III and 2 August 2028 for product-embedded Annex I. The deferral is a set of fixed calendar dates; the "stop the clock" variant was rejected, so do not assume an open-ended pause.

---

The Five Core Tasks of an Article 22 Representative

Article 22(3) sets out the mandate's minimum contents in four points (a) to (d); Article 22(4) adds the termination duty. Taken together, the representative performs these five tasks on the provider's behalf:

1. Verify the conformity record exists. Check that the EU declaration of conformity (Article 47) and the technical documentation (Article 11 / Annex IV) have been drawn up, and that an appropriate conformity assessment procedure (Article 43) has been carried out.
2. Keep documentation at the disposal of authorities. For the retention period, hold the contact details of the provider, a copy of the EU declaration of conformity, the technical documentation, and any certificate.
3. Respond to reasoned requests. Provide a competent authority, on a reasoned request, with all information and documentation necessary to demonstrate conformity — including access to the logs automatically generated by the system (Article 12) where those logs are under the provider's control.
4. Cooperate on authority actions. Work with competent authorities on any action taken regarding the high-risk system, including the registration duties tied to Article 49 where applicable.
5. Terminate the mandate where warranted. Exercise the Article 22(4) termination right, covered in detail below.

What the representative does not take on

Here is the trap. A non-EU provider that reads Article 22 as outsourcing its compliance is wrong. The representative is a reachable contact and document-keeper — it does not absorb the provider's substantive obligations. Design and conformity remain the provider's. Post-market monitoring (Article 72) remains the provider's. Serious-incident reporting (Article 73) remains the provider's. All of these sit on the provider under Article 16, and appointing a representative changes none of them. Article 22 buys EU authorities an address inside the Union; it does not buy the provider a compliance shield.

---

The Retention Period and the Mandate's Termination Right

The documentation in task two is not held briefly. The representative must keep it available to authorities for ten years after the high-risk AI system has been placed on the market or put into service — a window that aligns with the provider's own record-keeping duties under Article 18. Ten years is long enough that retention has to be designed into the mandate and the document-management process from the outset, not retrofitted when an authority calls.

Article 22(4) then arms the representative with a lever. If the representative considers or has reason to believe the provider is acting contrary to its obligations under the Regulation, it must terminate the mandate. On termination it must immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body.

That is a genuine accountability mechanism, not boilerplate. A non-EU provider that ignores its obligations can lose its EU-market interface — and without a lawful representative, the high-risk system can no longer be placed on the market. As a practical drafting note, providers and representatives commonly allocate liability and the mechanics of termination in the mandate agreement itself; the Regulation sets the floor, not the ceiling, so the commercial contract can add detail the statute leaves open.

---

Article 22 Tasks at a Glance

The table maps each statutory task to its grounding Article, a plain-language action, and — to reinforce the no-shield point — who actually acts.

---

Worked Example: A US Provider Appointing an EU Representative

NorthStar Analytics, a 140-person US software company, has built a creditworthiness-scoring AI system and is selling it to German and Irish lenders. Credit scoring for natural persons sits in Annex III point 5(b), so the system is high-risk, and NorthStar is a third-country provider. Article 22 applies.

Before any EU placement, NorthStar signs a written mandate with an Ireland-based compliance firm, which receives and accepts the appointment. The representative then:

• Verifies NorthStar's Article 47 declaration of conformity and the Article 11 / Annex IV technical file have been drawn up.
• Confirms the Article 43 conformity assessment was carried out.
• Is named in the Article 49 registration and on the system documentation as the EU contact point.

Eighteen months in, NorthStar ships a material model change but fails to update its technical documentation, then stops responding to the representative's requests for the revised records. The representative now has reason to believe NorthStar is acting contrary to its obligations. Under Article 22(4) it terminates the mandate and notifies the relevant national market surveillance authority. NorthStar is left without a lawful EU-market interface — its high-risk system cannot lawfully remain on the market — until it remedies the documentation and appoints a new representative. The ten-year retention obligation, meanwhile, still attaches to the records the former representative held, and the penalty exposure below remains live throughout.

---

Penalties and How This Connects to the Wider Supply Chain

Failure to appoint a required authorised representative is a breach of provider obligations under Article 16, and it falls under Article 99(4): up to €15,000,000 or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher.

Supplying incorrect, incomplete, or misleading information to authorities — including via the representative — falls under the lower Article 99(5) tier: up to €7,500,000 or 1% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount and the percentage — a proportionality protection, not an exemption from the obligation itself. The penalty machinery has been applicable since 2 August 2025, even though the high-risk obligations it backstops phase in later.

Article 22 is one node in a wider supply-chain map. Importers must verify that the Article 22 appointment exists as part of their pre-market checks (Article 23). The representative requirement is one piece of the role map — provider versus deployer — and the full provider stack lives in Article 16. Understanding where the representative's duties stop and the provider's begin is the whole point of Article 22.

---

How Confir helps

When you answer Confir's intake questions, it derives whether you are a third-country provider of a high-risk system — and therefore whether Article 22 applies — using rule-based, deterministic logic. Same intake, same finding, every time: no model inference, no hallucination.

For providers who must appoint, Confir records the mandate checklist as a structured task: declaration of conformity confirmed, Annex IV technical file verified, conformity assessment checked, representative named in the Article 49 registration. The ten-year retention obligation is tracked against each registered system, so the window is monitored rather than left to a calendar reminder set today and forgotten. If a market surveillance authority issues a reasoned request, the evidence of your appointment and pre-placement diligence is a timestamped record, not a reconstruction.

---

Related guides

• authorised representative definition (Article 3(5))
• how the EU AI Act reaches non-EU companies
• the full Article 16 provider obligation stack
• importer verification duties (Article 23)
• provider vs deployer roles