For US companies providing high-risk AI systems to the EU market, the authorized representative is not optional. Article 22 of Regulation (EU) 2024/1689 creates a mandatory gatekeeper: no EU-established representative means no lawful placement on the EU market. This guide explains what the representative must do, how the appointment works, and what US companies should look for. Under Article 22 of the EU AI Act, non-EU providers of high-risk AI systems must appoint an authorized representative established in the EU before placing the system on the EU market. The representative must have a written mandate, perform defined cooperation and documentation tasks, and serve as the primary contact point for national authorities. The representative does not assume the provider's compliance liability.
What This Means
The EU AI Act requires a local point of contact for regulatory oversight. Article 22 ensures that national authorities have an EU-based entity to communicate with, inspect, and serve enforcement actions against. For US providers, this means identifying and appointing a representative before the first high-risk system is placed on the EU market. The representative is not a compliance consultant in the colloquial sense. It is a specifically designated legal entity with defined statutory duties under the AI Act. The representative must be established in the EU, must have a written mandate from the provider, and must be able to perform the tasks listed in Article 22(2). The appointment is a prerequisite, not an afterthought. A provider that places a high-risk AI system on the EU market without an authorized representative violates Article 22. This is a Tier 2 violation under Article 99, carrying fines of up to €15 million or 3% of worldwide annual turnover. The penalty structure is established in Article 99 of the Regulation.
Key Requirements
Mandatory appointment.
Article 22(1) states that providers of high-risk AI systems not established in the Union shall, before placing the system on the market or putting it into service, appoint an authorized representative established in the Union. The obligation applies only to high-risk systems. Providers of limited-risk or minimal-risk systems do not need an authorized representative.
Written mandate.
Article 22(2) requires the representative to have a mandate from the provider to perform specified tasks. The mandate must be in writing and must authorize the representative to: verify the conformity assessment and technical documentation; cooperate with competent authorities; and provide information and documentation to authorities upon request. The mandate should clearly delineate what the representative is authorized to do and what remains with the provider. The representative must be established in the EU. There is no requirement that the representative be in a particular Member State, though practical considerations may favor a jurisdiction with strong rule-of-law traditions, accessible regulators, and language compatibility. SecureFound maintains representation capacity in Spain and other EU jurisdictions.
Documentation retention.
The representative must retain a copy of the technical documentation, the EU declaration of conformity, and any other relevant documentation at the disposal of national authorities for a period of ten years after the high-risk AI system has been placed on the market. This is a statutory record-keeping obligation, not a discretionary convenience.
Cooperation with authorities.
Upon a reasoned request from a competent national authority, the representative must provide all documentation and information necessary to demonstrate conformity of the high-risk AI system. The representative must also cooperate with authorities on any action taken to eliminate risks posed by the system. This is an active, not passive, duty.
Communication conduit.
The representative serves as the primary communication channel between the provider and EU authorities. If a market surveillance authority initiates an investigation or requests information, the representative is the first point of contact. The provider remains ultimately responsible for compliance, but the representative handles the interface.
Termination and transition.
If the mandate is terminated, the provider must appoint a new representative before the termination takes effect. A gap in representation leaves the provider in violation of Article 22 and may trigger market withdrawal obligations. Transition planning should be built into representation agreements from the outset.
Practical Steps
The obligation applies only to providers of high-risk AI systems. If your systems are limited-risk or minimal-risk, no representative is required. If you are a deployer rather than a provider, no representative is required. However, deployers have their own obligations under Articles 26 and 27.
2. Select a representative with relevant capacity.
The representative must understand the AI Act's technical and legal requirements. It should have staff or partners capable of reviewing technical documentation, interacting with authorities, and responding to information requests under time pressure. A law firm without technical capacity may struggle; a pure technology consultant without legal expertise may miss regulatory nuances.
3. Negotiate the mandate carefully.
The mandate should specify the tasks the representative will perform, the documentation it will retain, the jurisdictions it covers, and the procedure for cooperation with authorities. It should also address confidentiality, data protection, and termination. The mandate is a legal document, not a formality.
4. Provide complete documentation.
The representative can only perform its duties if it has the documentation. Providers should establish a secure document transfer process and maintain the representative's access to updated versions. Documentation gaps at the representative level are documentation gaps at the provider level.
5. Integrate representation into your compliance calendar.
Appointment should be completed before the system is placed on the market. For Annex III stand-alone systems, the operative date is 2 December 2027 under the Digital Omnibus provisional agreement. For Annex I embedded systems, the date is 2 August 2028. Appointment should be scheduled at least six months before the operative date to allow for mandate negotiation, documentation transfer, and system registration.
6. Maintain the relationship.
Representation is not a set-and-forget arrangement. The representative should be included in product updates, incident response planning, and regulatory monitoring. Regular check-ins ensure that the representative is prepared to respond to authority requests and that the provider is aware of any regulatory developments in the representative's jurisdiction.
Related Resources
EU AI Act Overview
EU AI Act database registration for US companies:
Database Registration for US Companies
Frequently Asked Questions
Q: Does every non-EU AI company need an EU representative?
No. Only providers of high-risk AI systems not established in the EU must appoint an authorized representative under Article 22. Providers of limited-risk or minimal-risk systems, and deployers of any risk tier, do not need a representative.
Q: Can the EU representative be held liable for non-compliance?
The representative is not the provider and does not assume the provider's compliance liability. However, the representative has independent duties under Article 22 and may face penalties for failure to cooperate with authorities or retain documentation. The provider remains responsible for the system's conformity with the AI Act.
Q: Can a US company use its EU subsidiary as its authorized representative?
Yes, if the subsidiary is established in the EU and has the capacity to perform the Article 22 tasks. However, the subsidiary must be formally designated as the authorized representative in a written mandate, and the relationship must be disclosed to authorities. Many US companies prefer an independent representative to avoid conflicts and ensure dedicated focus.
Q: What documentation must the representative retain?
The representative must retain technical documentation, the EU declaration of conformity, and any other documentation relevant to conformity assessment for ten years after the system is placed on the market. This is a statutory minimum; providers may choose to retain additional records.
Q: When should a US company appoint its representative?
Before placing the high-risk system on the EU market. For stand-alone Annex III systems, the operative date is 2 December 2027 under the Digital Omnibus provisional agreement. Appointment should be completed at least six months before that date to allow for mandate negotiation, documentation assembly, and database registration.
2026-06-27 Regulation (EU) 2024/1689 (EU AI Act), Articles 22, 26, 27, 28, 71, 99; Digital Omnibus provisional agreement, 7 May 2026. Non-EU providers of high-risk AI systems must appoint an EU authorized representative under Article 22 before placing the system on the EU market. The representative must have a written mandate, retain documentation for ten years, and cooperate with authorities. The Digital Omnibus extended Annex III deadlines to 2 December 2027.