What does Article 22 of the EU AI Act require?

Article 22 requires providers established outside the EU to appoint, by written mandate and before making their high-risk AI systems available on the Union market, an authorised representative established in the Union to perform defined compliance tasks and act as a contact point for authorities.

What tasks must an authorised representative perform?

At minimum: verify that the EU declaration of conformity and technical documentation were drawn up and a conformity assessment carried out, keep key documents available for authorities for ten years, provide information and log access on reasoned request, cooperate on risk mitigation, and handle or verify EU database registration where applicable.

Can the authorised representative be held responsible by regulators?

The mandate must empower the representative to be addressed by competent authorities, in addition to or instead of the provider, on all compliance issues, so authorities can direct requests and actions to the representative within the Union.

What happens if the representative believes the provider is non-compliant?

Article 22(4) requires the representative to terminate the mandate if it considers or has reason to consider the provider is acting contrary to its obligations, and to immediately inform the relevant market surveillance authority and any relevant notified body of the termination and its reasons.

Do GPAI model providers also need an authorised representative?

Yes, providers of general-purpose AI models established in third countries must appoint an authorised representative under Article 54, which is a separate provision with tasks adapted to the GPAI obligations rather than the high-risk system regime of Article 22.

Quick answer

Article 22 of the EU AI Act requires providers established in third countries to appoint, by written mandate, an authorised representative established in the Union before making their high-risk AI systems available on the EU market. The representative verifies and holds key compliance documents and acts as the contact point for EU authorities.

Updated June 2026 · MmowW AI Compliance

EU AI Act Article 22: Authorised Representatives for Non-EU Providers

What Article 22 Covers

Article 22 of Regulation (EU) 2024/1689 ensures that EU authorities always have someone inside the Union to deal with, even when the provider of a high-risk AI system sits in San Francisco, Tokyo or London. Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union.

The mechanism is borrowed from EU product law, where it has operated for decades for machinery, medical devices and electronics. For many software companies selling into Europe, however, it is a new institutional requirement: a named EU-established entity, with a written mandate, that regulators can address directly.

The Written Mandate and Its Scope

The provider must enable its authorised representative to perform the tasks specified in the mandate, and the representative must provide a copy of the mandate to the market surveillance authorities upon request, in one of the official languages of the Union as indicated by the competent authority. Crucially, the mandate empowers the representative to be addressed, in addition to or instead of the provider, by the competent authorities on all issues related to ensuring compliance with the regulation. The representative is therefore not a mailbox; it is a legally addressable compliance counterpart.

The Tasks of the Authorised Representative

Article 22(3) requires the representative to perform the tasks specified in the mandate, which shall at least include the following:

Verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up, and that an appropriate conformity assessment procedure has been carried out by the provider.
Keep at the disposal of the competent authorities and national authorities or bodies, for a period of ten years after the high-risk AI system has been placed on the market or put into service, the contact details of the provider, a copy of the EU declaration of conformity, the technical documentation and, where applicable, the certificate issued by the notified body.
Provide a competent authority, upon a reasoned request, with all the information and documentation necessary to demonstrate the conformity of the system, including access to the logs referred to in Article 12(1), as far as such logs are under the control of the provider.
Cooperate with competent authorities, upon reasoned request, in any action they take in relation to the high-risk AI system, in particular to reduce and mitigate the risks it poses.
Where applicable, comply with the registration obligations referred to in Article 49(1) or, if registration is carried out by the provider itself, verify that the information referred to in point 1 of Section A of Annex VIII is correct.

The Termination Duty: A Built-In Whistle

Article 22(4) contains a provision providers should take seriously when selecting a representative. The authorised representative shall terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations under the regulation. In such a case, it shall immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body about the termination of the mandate and the reasons for it. An authorised representative is thus structurally incentivised to scrutinise its provider, because remaining mandated for a non-compliant provider carries its own exposure.

How to Implement Article 22 in Practice

Decide the route to the EU market. If the company has an EU subsidiary that acts as the provider, the analysis differs; if the provider entity remains outside the Union, an authorised representative must be appointed before market availability.
Select a representative with substance: the capacity to actually verify documentation, hold it securely for ten years and respond to authorities in the relevant languages. Specialist representation firms exist, and an EU group company can also serve.
Draft the mandate to cover at least the Article 22(3) tasks, allocate liability and indemnities, define document transfer and update processes, and set service levels for authority requests.
Operationalise document flow: every new version of the technical documentation, declaration of conformity and certificates must reach the representative, or the ten-year availability duty fails in practice.
Put the representative's identity and contact details where they belong: Article 13 requires them in the instructions for use, and registration data under Article 49 and Annex VIII includes the representative where applicable.
Review the relationship periodically, since a terminated mandate is reported to regulators and leaves the provider unable to lawfully continue making systems available until a successor is appointed.

A Concrete Example

A US company sells an AI-based employee monitoring and task-allocation system to EU logistics firms, a use case within Annex III point 4. Before making the system available on the Union market, it signs a written mandate with a representation firm in Dublin. The firm receives and checks the EU declaration of conformity and Annex IV technical documentation, confirms the internal-control conformity assessment was performed, stores the documents, and is named in the instructions for use. When a market surveillance authority later requests evidence of conformity, the Dublin firm responds within the agreed service level, with the US provider supplying log extracts under Article 12.

How Article 22 Connects to Other Provisions

Article 22 applies to providers established in third countries, complementing the extraterritorial scope of Article 2. It interlocks with Article 16 provider obligations, the documentation regime of Articles 11, 18 and 47, registration under Article 49 and the import chain in Article 23, since importers must verify, where applicable, that an authorised representative has been appointed. For general-purpose AI models, a parallel but distinct obligation appears in Article 54. Operating without a required representative is an enforcement matter for market surveillance authorities under Chapter IX and sanctionable under Article 99.

Actions to Take Before August 2, 2026

Non-EU providers planning to have high-risk AI systems on the EU market from August 2, 2026 should select and contract their authorised representative well in advance, because the appointment must exist before systems are made available and the representative needs verified documentation in hand. Treat the mandate as part of the compliance architecture, not a formality signed in the last week. This article provides general information about Regulation (EU) 2024/1689 and is not advice for any specific market entry.

Check your AI compliance readiness — free.

Take the Readiness Check 3 minutes · 10 questions · no signup required

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.