Who needs an AI Act authorised representative, and what does one do?

This applies if your company is outside the EU and offers AI there under its own name. Two kinds of product trigger it. One is high-risk AI, such as AI for hiring, credit scoring or grading students, or AI that is a safety part of a regulated product. The other is a general-purpose AI model, which others build into many products. If either fits, you appoint a representative in the EU, in writing, before launch.^[1] Merely using other companies' AI tools does not count, unless you rebrand or repurpose a high-risk system.

Are you a provider, or only a user of AI?

Only the provider needs a representative. A provider is a company that develops an AI system or model, or has one developed, and offers it under its own name or trademark, paid or free.^[1] Both duties to appoint apply only to providers established outside the EU.^[1]

Other roles in the supply chain do not have to appoint one:

• A deployer uses an AI system under its own authority,^[1] for example a company whose HR team runs a screening tool it bought.
• A distributor makes an AI system available in the EU without being its provider or importer,^[1] such as a reseller selling under the original brand.

You can become a provider without building anything. Putting your name on a high-risk system already on the market does it, as does substantially modifying one or changing a system's purpose so it becomes high-risk.^[1]

Is your AI system high-risk?

For AI systems, only high-risk ones are covered, and there are two ways in. The first is Annex III, a list of sensitive uses.^[1] The second is Annex I, a list of EU product laws. AI qualifies if it is a product under those laws, or a safety component of one, and that product needs a third-party conformity assessment (an outside check) before sale.^[1]

Annex III has eight areas, unchanged by the 2026 amendments.^[2] In plain words:^[1]

In our view, the closest areas for SaaS are HR screening, credit scoring (fraud detection is excluded) and education.^[1]

The narrow exception. An Annex III system is not high-risk if it poses no significant risk to people's health, safety or rights. Not materially shaping a decision is one sign.^[1] Two of the four listed cases are a narrow procedural task and a preparatory task for an assessment.^[1] A system that profiles individuals is always high-risk.^[1] If you rely on the exception, you must document why before launch and still register the system in the EU database.^[1]

Do you provide a general-purpose AI model?

The second duty is for providers of general-purpose AI models established outside the EU.^[1] The Act defines these as models that can competently do a wide range of tasks and can be built into many other systems.^[1] You must appoint before placing the model on the EU market, for example through an API or a download.^[4]

The Commission's page on its guidelines says only companies that significantly modify a model take on the model provider's duties.^[5] So if your app calls a third-party model through an API, in our reading you are not that model's provider. You may still provide your own AI system.^[1]

The open-source exemption

Open-source models are exempt from the representative duty if all three conditions hold:^[1]

1. A free and open-source licence allows access, use, modification and distribution.
2. The parameters, including weights, and information on architecture and use are public.
3. The model has no systemic risk.

The AI Act Service Desk adds that the licence must allow these uses without monetisation.^[6] Models with systemic risk get no exemption.^[6]

When do the rules apply?

The model duty has applied since 2 August 2025.^[1] Models already on the market before then, say one released through an API in June 2025, have until 2 August 2027.^[1] In our reading, that deadline includes the representative.

The high-risk dates moved when the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026.^[2] Article 22 now applies from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.^[2] The model dates did not change.^[2]

A high-risk system already on the market or in service before its date is caught only if its design later changes significantly.^[2] Two groups get no such pass: systems meant for public authorities, which must comply by 2 August 2030,^[2] and some large-scale EU IT systems.^[1] Our sources do not settle how this works for software that keeps shipping new versions. In our view, plan for a representative by your date.

What does an authorised representative actually do?

Your representative is a person or company in the EU that has accepted your written mandate (a written appointment) to act for you under the Act.^[1]

The mandate must let it carry out the tasks below.^[1] A conformity assessment is the process of showing that a high-risk system meets the Act's requirements.^[1] The EU declaration of conformity is your written statement that it does.^[1]

The mandate must also let authorities address the representative (contact it and send it requests), in addition to or instead of you, on any compliance issue.^[1] Say an authority asks in 2031 for the documents of a hiring tool launched in 2028. Your representative must hand them over, because the ten years run from launch.^[1]

If the representative has reason to think you are breaking the Act, it must end the mandate. It must then tell the national authority or, for a model, the AI Office straight away, with its reasons.^[1] This is why we check your documents before we sign (what our AI Act service covers).

Does an authority have to sign off the appointment?

No. The Act asks for a written mandate and requires a copy only when an authority asks.^[1] But the EU database entry for most Annex III systems does list the representative's name, address and contact details.^[1]

What happens if you do not appoint one?

Both duties apply before launch, so without a representative you should not launch in the EU at all.^[1]

High-risk systems. National authorities enforce most of these.^[7] The middle fine tier reaches €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)).^[1] It covers the provider duties in Article 16 and the representative's own Article 22 tasks, among others. Article 16 does not mention appointing a representative, so no tier names that failure.^[1] Member states must still set penalties for any breach by operators,^[2] which include providers.^[1] In our reading, that covers failing to appoint.

Models. The Commission's AI Office enforces these.^[7] The Commission said it would enforce all model-provider obligations from 2 August 2026, including through fines.^[4] The cap is €15 million or 3% of worldwide annual turnover, whichever is higher, for intentional or negligent breaches (Art. 101).^[1]

SMEs (small and medium-sized enterprises), including start-ups, get the lower of the two amounts under Article 99.^[1] Say an SME with €10 million turnover launches a high-risk system without the required conformity assessment. Its cap is 3%, or €300,000, not €15 million.^[1] That example is not about a missing representative.

A representative for a high-risk system can be fined for failing its own tasks.^[1] In our reading, appointing one does not move your provider duties onto it.

How is this different from a GDPR representative?

The AI Act says that, with two exceptions, it does not affect the GDPR.^[2] The GDPR has its own duty: companies outside the EU that fall under its territorial scope rule must designate a representative in the EU in writing.^[3] In our view, most AI products with EU users fall under that rule.

Say a US company sells an AI writing assistant, built on a third-party model, to EU consumers. In our view it needs no AI Act representative, but it should check whether it needs a GDPR one.

Not sure whether this applies to you? Take the 3-minute check →

How to appoint an AI Act representative, in five steps

1. List what you provide. For each system or model, note whether you provide it, whether it is high-risk and whether it is a general-purpose model (Figure 1). The Seattle start-up lists one high-risk system and no model.
2. Gather the documents. For a high-risk system: the technical documentation, the EU declaration of conformity and evidence of the conformity assessment. For a model: the Annex XI technical documentation and evidence you meet the model duties.^[1]
3. Choose a representative established in the EU. Any member state works.^[1] Ask who will check your documents and answer authority requests.
4. Sign the written mandate. It must give the representative at least the tasks the Act lists, and let authorities address it on all compliance issues.^[1] Keep a copy ready: authorities can ask for one in an official EU language.^[1]
5. Settle registration and the GDPR. For most Annex III systems, agree who registers the system in the EU database with your representative's details.^[1] Then check whether you need a GDPR representative with the 3-minute self-assessment.

What it costs

Gabsor quotes the AI Act authorised representative per system or model, because the work depends on what you provide. Request a quote with a short description of each and your planned EU launch date, as the Seattle start-up would for its ranking tool.

Separately, for the GDPR: our pricing page plans cover GDPR representation only.