Non-EU Providers
·
9 min read
·
Updated March 2026
If your company is headquartered outside the European Union — in the US, UK, Canada, Singapore, or anywhere else — and you place a high-risk AI system on the EU market or make one available to EU users, you are legally required to appoint an EU Authorised Representative before doing so. This is not optional and cannot be deferred until after market entry. This guide explains exactly what an Authorised Representative is, what they must do, how to find and appoint one, and what happens if you don’t.
Key Takeaways
- Article 22 of the EU AI Act mandates that all non-EU providers of high-risk AI systems appoint an EU-based Authorised Representative before placing their system on the EU market.
- The Representative must be established in an EU member state and hold a written mandate from the provider.
- The Representative acts as the single point of contact for EU national authorities and the EU AI Office — they can be investigated and held accountable alongside the provider.
- Failure to appoint a Representative before market placement is itself an infringement attracting fines of up to €15M or 3% of global turnover.
Table of Contents
1. Who Needs to Appoint an Authorised Representative?
The obligation applies to non-EU providers of high-risk AI systems. Specifically, you must appoint an Authorised Representative if all three of the following apply:
✓
Your organisation is not established in the EU. This covers companies headquartered in the US, UK (post-Brexit), Canada, Australia, Singapore, Israel, or any other non-EU jurisdiction. Even having a subsidiary or branch office in the EU does not automatically exempt you — the obligation falls on the legal entity that placed the AI system on the market.
✓
Your AI system is classified as high-risk under Annex III or Annex I. Use our free risk assessment tool to determine whether your system falls under the high-risk classification. If it does not — if it is limited risk (chatbot transparency obligations only) or minimal risk — no Authorised Representative is required.
✓
You place the AI system on the EU market or into service in the EU. This includes making the system available to EU-based customers (even if the contract is governed by non-EU law), embedding the AI in a product sold in the EU, or providing the system to EU deployers who use it in EU operations.
⚠️
UK companies note: Brexit means UK-established companies are treated as non-EU providers for the purposes of the EU AI Act — exactly as a US or Canadian company would be. UK companies placing high-risk AI on the EU market must appoint an EU-based Authorised Representative, even if they previously relied on their UK establishment for GDPR compliance purposes.
2. The Legal Basis: Article 22 Explained
Article 22 of the EU AI Act (Regulation EU 2024/1689) states that before placing a high-risk AI system on the EU market, a non-EU provider must — by written mandate — appoint an authorised representative established in the Union.
The Authorised Representative obligation mirrors a well-established mechanism in EU product safety law — particularly the approach used in the Medical Devices Regulation (MDR), the Machinery Regulation, and the Radio Equipment Directive. If your organisation has navigated EU CE marking requirements for physical products before, the Authorised Representative concept will be familiar.
Key legal points from Article 22:
| Requirement | Detail |
|---|---|
| Timing | Must be appointed before the system is placed on the EU market. Retroactive appointment after market entry does not cure the violation. |
| Form | Must be established by written mandate — a formal legal document signed by both parties specifying the scope of authority. |
| Location | Representative must be established in a member state of the EU — not the EEA, not Switzerland, not the UK. |
| Accountability | The Representative can be held liable alongside the provider if they knowingly allow non-compliant systems to remain on the market. |
| Revocation | Either party may terminate the mandate, but the provider cannot terminate without having a replacement Representative already appointed. The system must be withdrawn from the EU market if no Representative exists. |
3. What an Authorised Representative Must Do
The Authorised Representative is not a passive figurehead. Article 22(2) assigns specific active obligations that the Representative must fulfil on the provider’s behalf. Providers must give their Representative the resources and access necessary to perform these functions.
Register the AI system in the EU AI database
The Representative must carry out the EU AI Act database registration (Article 49) on behalf of the provider, or verify that the provider has done so before market placement. The registration entry must include the Representative’s own contact details as the EU point of contact.
Maintain a copy of the Declaration of Conformity and technical documentation
The Representative must hold copies of the provider’s Declaration of Conformity (Article 47) and Annex IV technical documentation, or have on-demand access to them. National market surveillance authorities can request these documents from the Representative directly — the provider does not need to be the direct point of contact.
Act as contact point for national market surveillance authorities
National authorities will communicate with the Representative as their primary contact for all compliance enquiries, surveillance activities, and investigation requests. The Representative must be responsive and capable of escalating requests to the provider within reasonable timeframes.
Cooperate with competent authorities on corrective actions
If a national authority orders corrective action — documentation updates, system modifications, market withdrawal — the Representative must cooperate fully and facilitate the provider’s response. They cannot act as a buffer to delay or obstruct legitimate regulatory oversight.
Terminate the mandate if the provider is non-compliant
Article 22(3) states that where the Representative has reason to believe the provider is acting contrary to their obligations under the EU AI Act, they must terminate the mandate and inform the national competent authority. This creates a professional duty of care — the Representative cannot remain in post if knowingly shielding a non-compliant provider.
4. Who Can Act as an Authorised Representative?
The Act does not specify professional qualifications for Authorised Representatives — but in practice, the role demands a combination of legal awareness, regulatory familiarity, and operational capability. The Representative must be able to respond to national authority enquiries, hold and produce compliance documentation, and take action if directed to do so.
✅ Law Firms & Legal Consultancies
EU law firms experienced in technology regulation are natural candidates. They offer legal expertise, regulatory contacts, and professional indemnity insurance. Cost is typically higher than other options — €5,000–€20,000 per year per system — but the expertise level is unmatched.
✅ Compliance Service Providers
A growing market of specialist EU AI Act compliance firms are offering Authorised Representative services. These typically offer lower cost than law firms (€2,000–€8,000 per year) with dedicated regulatory expertise. Emerging market — vet thoroughly before appointing.
✅ EU Subsidiary or Affiliate
If you have an EU-established subsidiary, it can act as your Authorised Representative — but the mandate must be formal, documented, and the subsidiary must have the capacity and resources to fulfil the role. The subsidiary cannot be a shell company with no operational capability.
❌ Cannot Be: EU Customers or Deployers
Your EU customers — even major enterprise clients — cannot serve as your Authorised Representative. The roles of Authorised Representative and Deployer are legally distinct. A deployer has their own compliance obligations; they cannot simultaneously serve as your regulatory liaison.
💡
Comparison with GDPR Article 27: If you already appointed a GDPR Article 27 Representative in the EU, they cannot automatically serve as your EU AI Act Authorised Representative — the two roles have different obligations and legal bases. You may be able to use the same firm or person, but you will need a separate written mandate for the EU AI Act role.
5. The Written Mandate: What It Must Contain
The written mandate is the legal foundation of the Authorised Representative relationship. The Act requires it to be in writing, but does not prescribe a specific form. Based on the Article 22 obligations and analogous requirements under the EU Medical Devices Regulation (which has a similar representative requirement), a compliant mandate should include:
| Mandate Element | What to Include |
|---|---|
| Parties | Full legal name, registration number, registered address, and jurisdiction of incorporation for both the provider and the Representative |
| Scope of AI systems covered | Specific identification of the high-risk AI system(s) covered — by name, version, intended purpose, and Annex III category. Must be updated when new systems are added. |
| Authorised tasks | Explicit listing of all Article 22 tasks the Representative is authorised to perform — database registration, documentation holding, authority liaison, corrective action cooperation |
| Information access rights | Provider’s obligation to give the Representative access to all compliance documentation, incident reports, and regulatory correspondence on demand |
| Response time obligations | Maximum timeframes for the provider to respond to information requests escalated by the Representative from national authorities |
| Term and termination | Duration of the mandate (typically open-ended or matching product lifecycle), termination notice period, and obligations on termination (replacement Representative or market withdrawal) |
| Liability allocation | Indemnification provisions — what happens if the Representative incurs liability due to the provider’s non-compliance; professional indemnity insurance requirements |
| Governing law | The mandate should be governed by the law of the Representative’s member state to ensure enforceability within the EU regulatory system |
6. How to Find and Appoint a Representative: Step-by-Step
1
Confirm You Need One (Weeks 1–2)
Classify your AI system using our free risk assessment tool. If high-risk classification is confirmed, immediately flag this as a compliance priority. Note the August 2026 deadline — back-calculate to determine your appointment deadline (allow at least 8 weeks for the contracting process).
2
Identify Candidate Representatives (Weeks 2–4)
Options: EU law firms with AI/technology practice groups; specialist EU AI Act compliance firms; your EU subsidiary (if sufficiently resourced). Prepare a shortlist of three to five candidates. Request references from other non-EU technology companies they have represented under similar EU product safety regulations.
3
Due Diligence on Candidates (Weeks 3–5)
Assess each candidate against: EU member state establishment (verify registered address), professional indemnity insurance coverage, experience with EU regulatory compliance, understanding of the EU AI Act’s Article 22 obligations, capacity to respond to national authority requests within required timeframes, and conflict of interest screening (do they represent competing AI systems?).
4
Negotiate and Execute the Written Mandate (Weeks 5–7)
Draft the mandate using the elements in Section 5 above. Have your own legal counsel review it before signing — do not rely solely on the Representative’s template. Negotiate clear liability allocation, particularly indemnification for enforcement costs arising from your non-compliance.
5
Update All Compliance Documentation (Week 7–8)
Once the mandate is executed, update your Declaration of Conformity (include Representative’s details), EU AI Act database registration entry, technical documentation, and all public-facing compliance documentation. The Representative’s name, address, and contact details must appear in the EU AI database registration.
See the full compliance programme
Appointing an Authorised Representative is Phase 1, Step 3 of our compliance checklist. See what comes next — and plan your full August 2026 compliance programme.
7. Consequences of Failing to Appoint
Placing a high-risk AI system on the EU market without an Authorised Representative is a compliance violation in its own right — distinct from and additional to any other compliance failures. The consequences are:
💸
Financial penalties up to €15M or 3% of global annual turnover — whichever is higher. The failure to appoint a Representative is categorised as a violation of a provider obligation, placing it in the second-tier penalty band.
🚫
Market access restriction or withdrawal order — national market surveillance authorities can order the AI system withdrawn from the EU market until a compliant Representative is appointed.
📢
Public disclosure — national authorities may publicly disclose the violation and the corrective action required, creating reputational damage with EU customers and partners.
🔗
Downstream deployer liability — EU deployers who discover their vendor has no compliant Authorised Representative may face their own compliance exposure for using a non-conformant high-risk AI system. This creates commercial pressure on providers to comply.
