Authorized representative: EU AI Act definition
An authorized representative is a person or company located or established in the EU that has accepted a written mandate from a provider of an AI system or general-purpose AI model to carry out the provider's obligations and procedures under the Act on its behalf.
Last verified October 31, 2026, against the AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).
Where it comes from. Art. 3(5) of the EU AI Act, which spells it “authorised representative”: “a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation”.
Who needs one
- Non-EU providers of high-risk AI systems, before making the system available in the EU (Art. 22(1)), from December 2, 2027 (Annex III) or August 2, 2028 (Annex I) (Art. 113).
- Non-EU providers of general-purpose AI models, before placing the model on the EU market (Art. 54(1)), since August 2, 2025; models already on the market by then have until August 2, 2027 (Art. 111(3)). Models released under a free and open-source license with public weights are exempt unless they present systemic risks (54(6)).
These articles do not ask it of deployers, or of providers whose systems are not high-risk.
What it does
The mandate must let the representative verify the EU declaration of conformity and technical documentation, keep them for 10 years, give authorities the information they ask for, cooperate with them and, where applicable, handle registration (22(3)). Authorities can address it in addition to or instead of the provider. It must end the mandate if it has reason to think the provider is breaking the Act, and tell the authority (22(4)).
Example
A Texas company plans to launch, in 2028, software that ranks job candidates for employers in Spain, an Annex III point 4(a) use. Before making it available in the EU, it signs a written mandate with an EU-established firm to act as its authorized representative.
What it means for you
Check each system you provide: is it high-risk, or a general-purpose AI model, and are you established outside the EU? If yes, plan the mandate before launch. The GDPR has its own representative duty for some non-EU companies (GDPR Art. 27); the two are separate duties under separate laws.
Read next
- Does the EU AI Act apply to a US company?
- Provider or deployer: your EU AI Act role
- The EU AI Act for US companies
- Glossary
This page is general information, not legal advice.
Questions about your AI systems?
Talk to us about what you build or use, or see how an assessment works.
How it works