A Practical Checklist for AI Providers under EU Law
As the EU Artificial Intelligence Act (EU AI Act) deadlines for implementation draw closer, a key question is emerging for providers outside the EU: “Do we need to appoint an Authorised Representative?“
In this article, we break down the nature of the role of the Authorised Representative and provide a practical checklist to help you determine whether you need to appoint one.
What is an Authorised Representative?
As examined in detail in our previous article, an Authorised Representative is a legal or natural person located or established in the EU, and who has been appointed, in writing, by a non-EU provider of an AI system or a general-purpose AI model, to act on their behalf in fulfilling specific regulatory obligations and procedures.
Under the EU AI Act therefore, a non-EU company must appoint an Authorised Representative if they want to offer products or systems that fall within the scope of the EU AI Act on to the EU market, but don’t have a legal presence within the EU.
The Authorised Representative serves as a single point of contact for EU regulators and national authorities or bodies, and is responsible for ensuring documentation, compliance, and cooperation during investigations amongst other tasks.
Do You Need to Appoint an Authorised Representative? Use this Checklist
✅ Are you a provider of a high-risk AI system or a general-purpose AI (GPAI) model?
A provider of a high-risk AI system includes providers of:
- AI systems which are intended to be used as a safety component of a product, or an AI system which is the product, is listed in Annex 1 of the EU AI Act, and is required to undergo a third-party conformity assessment (example: medical devices);
- AI systems listed in Annex III of the EU AI Act, which include AI systems in the following areas:
- biometrics;
- critical infrastructure;
- education and vocational training;
- employment, workers’ management and access to self-employment (example: recruitment);
- access to and enjoyment of essential private and public services and benefits (example: credit scoring);
- law enforcement;
- migration, asylum and border control management;
- administration of justice and democratic processes.
- GPAI models, with exceptions. If the GPAI model presents systemic risks, an Authorised Representative is always required.
✅ Is your product / model being placed on the EU market and are you based outside the EU?
If you are:
(i) placing your high-risk AI system or GPAI model on the EU market; or
(ii) supplying a high-risk AI system or GPAI model for distribution or use on the EU market in the course of a commercial activity, whether in return for payment or free of charge; and
(iii) you are not legally established in an EU member state;
you must appoint an Authorised Representative to access the market, unless an exception applies.
✅ Are you placing a GPAI model on the market that is not open-source and / or presents systemic risk?
If you are a provider of a GPAI model that is not released under a free open-source licence, does not allow for access, usage, modification and distribution of the model, and whose parameters do not include the weights, information on the model architecture, and information on model usage, an Authorised Representative is required.
GPAI models that present systemic risk always require an Authorised Representative.
✅ Do you already have an importer or subsidiary in the EU?
An importer or subsidiary may qualify to act as your Authorised Representative if:
- Their independence is credible. This is particularly the case as the Authorised Representative is duty-bound to terminate its mandate if the provider fails to comply with its obligations under the EU AI Act. For more information on this point, access our article here;
- They can meet the regulatory obligations (example: maintain the technical documentation required and have the experience to correspond and cooperate with regulatory authorities);
- The mandate is clear and formalised.
If one of the above is not satisfied, we recommend appointing an independent Authorised Representative.
⚠️ How to Choose the Right Authorised Representative
Your Authorised Representative should be more than just a name on paper. We recommend looking out for:
- Independence from your company, in order to avoid conflicts of interest;
- Expertise in EU regulatory compliance;
- Responsiveness and ability to act as a suitable intermediary with regulators;
- Experience with working in EU-regulated industries.
At Blue Arrow, we offer the Authorised Representative service which is grounded in regulatory expertise and technical insight. With our sister company, Specculo, having a proven track record in providing Authorised Representative services for medical devices within the EU, we are uniquely positioned to assist you with our legal and hands-on technical knowledge of EU compliance frameworks.
???? Still Unsure? Let’s Make It Simple.
If you are outside the EU and your high-risk AI system or GPAI model is entering the European market, the safest option is to assess your Authorised Representative obligations early.
Contact us at Blue Arrow, and we will help you stay compliant, credible, and market-ready.
