The EU AI Act introduces comprehensive regulatory requirements for AI systems and models placed on or put into service within the EU market. For providers of general-purpose AI (“GPAI“) models and high-risk AI systems based outside the EU, the appointment of an Authorised Representative (“AR“) is not just a compliance checkbox. It is a strategic business decision that will significantly impact market access, operational efficiency, and regulatory risk management.
The AR is defined in Article 3(5) of the EU AI Act as “a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation.”
This requirement will therefore affect companies worldwide that deploy high-risk AI systems or GPAI models into the EU markets, from multinational technology corporations to specialised AI startups.
Statutory Basis:
The AR requirement is established in Article 22 (providers of high-risk AI systems) and Article 54 (providers of GPAI models). Article 54 will start to apply from 02 August 2025, whilst the obligations set out in Article 22 will apply from 02 August 2026. This article focuses on the obligations pertaining to ARs of GPAI models, given the forthcoming deadline.
AR Responsibilities – GPAI Models:
In terms of Article 54, providers of GPAI models established in non-EU countries shall, by written mandate, appoint an AR which is established in the EU. The provider shall enable its AR to perform the tasks specified in the mandate received from the provider.
The tasks include:
(a) document verification: the AR must verify that the technical documentation specified in Annex XI has been drawn up and all obligations in Article 53 and Article 55 (if the GPAI model poses systemic risk) have been fulfilled by the provider;
(b) documentation management: the AR must keep a copy of the technical documentation specified in Annex XI at the disposal of the AI Office and national competent authorities for a period of ten years after the GPAI model has been placed on the market. The AR must also keep the contact details of the provider that appointed the AR;
(c) regulatory disclosure: the AR is to provide the AI Office, upon reasoned request, with all the information and documentation (including the documentation in (b) above) which is necessary to demonstrate compliance with the obligations of GPAI model providers;
(d) regulatory cooperation: the AR must cooperate with the AI Office and competent authorities, upon a reasoned request, in any action they take in relation to the GPAI model, including when the model is integrated into AI systems placed on the market / put into service.
The mandate shall empower the AR to be addressed, in addition to or instead of the provider, by the AI Office or the competent authorities, on all issues related to ensuring compliance with the EU AI Act.
Notably, in terms of Article 54(5), the AR must terminate the mandate if it considers or has reason to consider that the provider is acting contrary to its obligations. In this case, the AR must immediately inform the AI Office about the termination of the mandate and the reasons for the termination.
Providers of GPAI models don’t need to appoint an authorised representative if their model is released under a free and open-source licence that allows others to access, use, modify, and share it, and if key details such as the model’s weights, architecture, and how it’s used are made public. However, this exemption doesn’t apply if the model poses a systemic risk.
Practical Implications:
The AR must understand not just which documents to maintain, but how to organise and present them for regulatory scrutiny. Likewise, document verification goes beyond a checkbox approach, as it presupposes that the AR verifying the documentation is competent to understand the intricacies of what the technical documentation contains.
This means that the AR’s responsibilities go beyond a mere formality or an administrative requirement. AR functions require deep technical knowledge and regulatory expertise, particularly as regulatory authorities will expect ARs to provide substantive responses to technical inquiries in relation to the task set out in (d) above.
Why Independence Matters:
As explored above, among the most critical obligations of the AR is the termination of the mandate if the provider fails to comply with its obligations under the EU AI Act. This is not a symbolic role as it requires real independence and judgment.
For this reason, the appointment of a subsidiary established within the EU, although legally possible, falls short of the spirit of the law. It risks undermining the enforcement mechanism envisaged by the EU AI Act, as well as creates a possible conflict of interest. An entity that is structurally or commercially dependent on the provider is unlikely to exercise the degree of autonomy necessary to fulfil the duties laid down in Article 54(5), where the termination of the mandate with the provider is required.
The independence of the AR is not explicitly mandated in the wording of the EU AI Act, but it is logically implied by the nature of the role. In this sense, the EU AI Act follows the precedent set in other EU product compliance regulations, where independence, competence, and good faith cooperation with authorities are the cornerstones of effective market surveillance.
For GPAI model providers therefore, this means looking beyond internal corporate structures when appointing an AR.
Blue Arrow offers independent authorised representative services grounded in regulatory expertise and technical insight. With our sister company, Specculo, having a proven track record in providing AR services for medical devices within the EU, we are uniquely positioned to assist you with the AR approach that actually makes sense for your business. We can work with you to explore whether your AR should be independent, your own EU subsidiary, or a hybrid model you haven’t yet considered.
Get in touch today to learn more.
