Authorized Representative in the EU AI Act

The European Union''s Artificial Intelligence Act (AI Act) is reshaping the global artificial intelligence (AI) landscape, setting clear rules for how AI systems enter and operate within the European market. Among its key provisions is the introduction of one of the key roles in the AI value chain: Authorized Representatives (ARs), intermediaries tasked with bridging the gap between non-EU AI providers and EU regulators.

Authorized Representatives are not just a formality, but a compliance necessity. According to the European Commission''s 2025 AI Act Implementation Report, more than 40% of AI systems currently marketed in the EU originate from providers established outside the Union, underscoring why the authorized representative obligation is critical to the Act''s enforcement architecture (European Commission, 2025). For providers of high-risk AI systems or general-purpose AI models (GPAI) established outside of the EU, the appointment of the AR within the EU is mandatory. These EU-based representatives serve as the official contact point for regulatory authorities, confirming that obligations under the AI Act are consistently and transparently met.

For global AI providers seeking to enter or scale within the EU market, understanding the role of Authorized Representatives is crucial. In the sections that follow, we provide a business-oriented overview of the ARs under the AI Act, focusing on their functions, strategic importance, and what organizations should consider when appointing one.

1. Why do you need an Authorized Representative Under the EU AI Act?

For companies based outside of the EU, the requirement to appoint an Authorized Representative is not just a legal formality. It is part of a broader regulatory model designed to facilitate communication with EU authorities and build trust with European stakeholders. Understanding this framework is key for global AI providers planning to access or expand within the EU market.

A. Rationale Behind the Requirement for Authorized Representatives

The duty to appoint a "representative" within EU territory has long been embedded in Europe's regulatory frameworks for market participants established outside of the EU. This obligation is a cornerstone of digital and product safety regulations, appearing in regulations such as the General Data Protection Regulation (GDPR), the Digital Services Act, the NIS2 Directive, and the Data Governance Act, among others.

At its core, this obligation means that non-EU businesses operating in the European market must have a designated, accessible, and accountable point of contact for regulators and European stakeholders. The pattern is deliberate. The AI Act follows this established model by requiring certain non-EU providers of high-risk AI systems and general-purpose AI models to designate an Authorized Representative within the EU.

This rationale is not unique to the AI Act. Comparable requirements exist in international data protection and governance laws. For global businesses, the consistency of this approach underscores the importance of appointing an Authorized Representative as both a compliance measure and a practical enabler of market entry.

Under the AI Act, however, the authorized representative takes on additional responsibilities, similar to those in product liability law. In addition to serving as a local point of contact for authorities and stakeholders, the representative is also responsible for contributing to the assurance of product safety and compliance with regulatory requirements.

B. Role and Function of Authorized Representatives Under the EU AI Act

An Authorized Representative acts as the official bridge between non-EU AI providers and relevant EU authorities, including the AI Office. For providers of high-risk AI systems or general-purpose AI models established outside the EU (i.e., based in third countries), appointing the AR within the EU is a prerequisite to market entry. No AR, no market access. This requirement underscores the importance of a local presence to effectively navigate and comply with the EU''s regulatory framework.

In practice, Authorized Representatives operate as intermediaries between non-EU AI providers and EU authorities mandated to act on behalf of providers. Their role is not symbolic but highly operational, and within the scope of their mandate, they verify that the provider has taken all required measures and possesses the documentation necessary to demonstrate compliance with the strict obligations of the EU AI Act.

According to the EU AI Act, an Authorized Representative may be either an individual or an entity located or established in the EU who have received and accepted a written mandate from the provider of a high-risk AI system or a general-purpose AI model. Their principal duty is to perform and carry out, on behalf of the provider, the obligations and procedural steps prescribed under the EU AI Act.

In essence, an Authorized Representative simplifies regulatory engagement for non-EU providers, safeguards adherence to compliance requirements, and enhances trust and transparency within the EU''s AI ecosystem. For businesses seeking access to Europe, appointing the right AR is not only about meeting the legal requirements but also about making a strategic decision that directly influences regulatory readiness and market success.

Practical example: consider a South Korean company that develops an AI-driven medical diagnostic tool classified as a high-risk AI system under the EU AI Act. Before the tool can be marketed in the EU, the company must appoint an EU-based Authorized Representative. This AR will be responsible for engaging with EU regulators, verifying that the provider has completed the required <a href="/eu-ai-act-conformity-assessment">conformity assessments</a>, and confirming that all required documentation is available and accurate. Only after these compliance steps are fulfilled can the medical AI system be lawfully introduced to the European market.

2. When Do Businesses Need to Appoint an Authorized Representative under the AI Act?

The EU AI Act establishes a phased timeline for appointing Authorized Representatives, reflecting the different levels of risk associated with the AI systems. Non-EU providers cannot delay this obligation, as the deadlines are tied directly to market access: without an EU-based representative, their systems cannot be lawfully placed on the Union market.

• By 2 August 2025 -> Non-EU providers of general-purpose AI (GPAI) models must appoint an Authorized Representative in the EU before they can introduce their AI models to the EU market.
• By 2 August 2026 -> Non-EU providers of high-risk AI systems must appoint an Authorized Representative in the EU before making their AI systems available to EU customers.

This phased implementation gives companies some lead time, but the requirement itself is non-negotiable. For global AI providers, early planning is critical. Delaying the appointment of the AR risks missed deadlines, blocked access to the EU market, and heightened exposure to regulatory scrutiny. Conversely, engaging the AR well in advance allows businesses to align internal documentation with EU standards and enter the market with greater confidence. An AI governance platform can centralise the documentation and compliance workflows that the AR will need to manage. Providers that miss these windows face significant fines under the Act''s tiered penalty framework.

3. Qualifications Required to Act as an Authorized Representative

The AI Act does not prescribe a formal list of qualifications for the ARs. However, the scope of responsibilities attached to the role makes it clear that the position demands both regulatory knowledge and practical expertise. Simply appointing any entity established in the EU will not be sufficient: the effectiveness of the AR depends on its ability to carry out compliance functions reliably and competently.

At a minimum, an Authorized Representative should possess:

• Regulatory and legal knowledge: a strong understanding of the AI Act, related EU laws, and the obligations imposed on providers;
• Technical competence: the ability to review and verify EU declarations of conformity and technical documentation, confirming that the AI system meets regulatory standards, as well as a strong understanding of the technical aspects of the AI systems;
• Communication and liaison skills: the capacity to engage effectively with competent national authorities, respond to information requests, and provide clear documentation when required;
• Local presence in the EU: since the AR must be located or established within the EU, familiarity with EU administrative processes and regulatory culture is essential.

The bar is high. In practice, these requirements mean that many businesses appoint specialized consultants or compliance organizations. For global AI providers, choosing the appropriate AR is not only about meeting the legal requirements but also about confirming that compliance obligations are handled proactively, reducing risk, and building credibility with EU regulators.

4. Step-by-step Checklist: Does Your Business Need to Appoint an Authorized Representative in the EU?

Not every AI provider will need to designate an Authorized Representative under the EU AI Act, but for many non-EU businesses, this step is unavoidable. Use the following checklist to determine whether your organization falls under this obligation:

1) Are you a provider of a high-risk AI system or a general-purpose AI (GPAI) model?

Under the AI Act, a provider is any natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. If this describes your business, you should assess whether your product falls into one of the categories that trigger the obligation to appoint an Authorized Representative.

High-risk obligations arise in two ways. First, if your AI system functions as a safety component of a product, or such an AI system itself is a product, and is covered by Annex I of the EU AI Act, then a third-party conformity assessment applies. This includes areas like medical devices, where AI-enabled diagnostic devices are reviewed under strict product safety rules.

Second, if your AI system falls within the sensitive use cases set out in Annex III of the EU AI Act, you are also considered a high-risk provider. These include systems used for biometric identification, managing critical infrastructure, education and vocational training, employment and recruitment, credit scoring and access to essential services, law enforcement, migration and border control, and even the administration of justice or electoral processes.

Finally, providers of general-purpose AI models must also plan for this obligation. While some exemptions apply, any GPAI model that presents systemic risk automatically triggers the requirement to appoint the AR, without exception.

2) Are you offering your AI system product or model on the EU market while being established outside the EU?

If your business is:

• introducing a high-risk AI system or GPAI model onto the EU market, OR making such AI systems or models available in the EU for distribution or use on the EU market during commercial activity, whether sold or provided free of charge; and
• legally established outside of the EU;

Then you are obliged to appoint the Authorized Representative within the EU. This requirement means that EU regulators and stakeholders always have a responsible, accountable, and accessible point of contact inside the EU.

3) Does your GPAI model fall outside the open-source exception, or does it present systemic risk?

If you are a provider of a general-purpose AI model that is not genuinely open-source, meaning it is not released under a free licence that allows users to access, modify, and distribute the model, including disclosure of parameters such as weights, architecture, and usage, then you must appoint an Authorized Representative.

All GPAI models that are deemed to present systemic risks automatically trigger the AR requirement, without exception. This confirms closer regulatory oversight of large-scale models with far-reaching societal and economic impact.

5. Key Responsibilities and Functions of Authorized Representatives

Both types of AI providers are subject to a largely identical set of duties. Most importantly, they must appoint, by written mandate, the Authorized Representative before making their system or model available in the EU.

Considering the AR role at a high level, the AR acts as a key point of contact within the EU, verifying that all documentation demonstrating compliance with the high-risk AI system or general-purpose AI model with the EU AI Act is maintained and available to EU regulators. They are responsible for receiving serious incident reports, responding to regulatory requests, and, where necessary, registering high-risk AI systems in the EU database.

Crucially, the ARs do not merely store documents; they have a duty to step into the provider''s role if required. If the AR considers or has a reason to consider the provider to be acting contrary to its obligations pursuant to the AI Act, it must terminate the mandate and immediately inform the relevant market surveillance authority, as well as, where applicable, the relevant notified body, about the termination of the mandate and the reasons.

Example: Imagine a Canadian company developing an AI-powered tool for biometric identification, classified as a high-risk AI system under the EU AI Act. Before this tool can be marketed in Europe, the company must appoint an Authorized Representative established within the EU. The AR will not only confirm that the company has appropriate documentation and measures in place that verify that the AI system meets all regulatory requirements but will also act as the first point of contact if EU regulators raise questions or initiate an investigation. Should the AR discover that the provider is not fulfilling its obligations, it would be required to end the mandate and immediately inform the relevant authorities, confirming that compliance gaps do not go unnoticed.

For a comparative overview of the obligations applying specifically to high-risk AI systems and GPAI models, please see the table below.