One of the most overlooked compliance duties for US providers of AI systems reaching the EU market is the requirement to appoint an authorised representative. Article 22 of Regulation (EU) 2024/1689 requires any provider of a high-risk AI system established in a third country to appoint, by written mandate, an authorised representative established in the Union before placing the system on the market. Article 54 imposes a parallel obligation for providers of general-purpose AI models.

For a NYC company that classifies as a provider of a high-risk AI system or a GPAI model, this is not an administrative formality. It is a structural prerequisite for legally entering the Union market. This note explains what the authorised representative actually does, who can serve, how NYC companies typically structure the arrangement, and what it costs.

Why the requirement exists

The authorised representative is not invented by the AI Act. It is a familiar pattern in EU product legislation — Machinery Directive, Medical Devices Regulation, Radio Equipment Directive, and others all require non-EU manufacturers to designate an EU-established contact point. The rationale is enforcement: when a product reaches EU users, EU authorities need an addressable counterparty inside Union jurisdiction who can produce documentation, respond to information requests, and cooperate with inspections. For a non-EU provider, the authorised representative is that counterparty.

The AI Act continues this pattern. Where a US provider supplies an AI system to the EU market, the Regulation's enforcement architecture presupposes a European-based point of contact. Article 22 makes that presupposition explicit.

Who must appoint an authorised representative

Two categories of US provider are directly captured:

Under Article 22: providers of high-risk AI systems established in third countries who place the system on the EU market or put it into service in the Union. For a NYC company with a high-risk AI system (see our Annex III categories note) reaching EU customers, Article 22 applies from 2 August 2026.

Under Article 54: providers of general-purpose AI models established in third countries, prior to placing a GPAI model on the Union market. For GPAI providers (very few NYC companies — this is typically frontier labs), Article 54 already applies in principle.

Deployers — not providers — are not directly captured by Articles 22 or 54. A NYC company that only uses an AI system under its authority is a deployer and does not appoint an authorised representative for that capacity. A NYC company that is simultaneously a deployer of one system and a provider of another must appoint an authorised representative for the provider role only.

Open-source GPAI models released under free and open-source licence, unless classified as GPAI with systemic risk under Article 51, are exempt under Article 54(6). This narrowly-scoped exemption does not extend to open-source high-risk AI systems under Article 22.

What the authorised representative actually does

Article 22(3) enumerates the representative's duties for high-risk AI providers. The representative must:

Verify that the conformity assessment procedure has been carried out by the provider and that the EU declaration of conformity and the technical documentation have been drawn up.

Keep at the disposal of the competent authorities, for a period of ten years after the AI system has been placed on the market or put into service, the contact details of the provider, a copy of the EU declaration of conformity, the technical documentation, and, where applicable, the notified body certificate.

Provide competent authorities, upon a reasoned request, with all information and documentation necessary to demonstrate conformity, including access to logs generated by the AI system.

Cooperate with competent authorities in any action taken to reduce and mitigate risks posed by the AI system.

Where applicable, comply with registration obligations under Article 49 or verify that the provider has complied with them.

Terminate the mandate if the representative considers or has reason to consider that the provider is acting contrary to its obligations under the Regulation, and in that case immediately inform the relevant market surveillance authority and any applicable notified body.

Article 54(3) sets a parallel list for GPAI model providers, with the AI Office as the counterparty instead of national market surveillance authorities.

The takeaway: this is a substantive role. The representative holds documentation, cooperates with inspections, and has a duty to terminate if the provider violates the Regulation. It is not a passive nameplate.

Who can serve as authorised representative

The Regulation is relatively permissive on qualifications. Article 22(1) requires the representative to be "established in the Union" — i.e., a natural or legal person with a registered address in an EU Member State. Article 22(2) requires that the provider enables the representative to perform the mandated tasks, which implies that the representative must have factual capacity to do so (documentation access, communication channels, availability).

Three structural options are common for NYC providers:

EU-established affiliate of the NYC provider. If the NYC company has a subsidiary, branch office, or affiliated entity established in the EU, that entity can serve as the authorised representative. The mandate is internal; the governance is corporate. This is typically the lowest-cost structure when an EU entity already exists.

Professional service provider in the Union. A specialized firm established in an EU Member State offers authorised representative services under contract. Several such providers have emerged specifically for EU AI Act compliance, often legal-adjacent firms or technical-compliance firms with EU presence. Typical costs range from €3,000 to €15,000 per year depending on service level and number of systems covered.

Qualified EU counsel in an existing advisory relationship. An EU law firm or regulatory consultancy that already represents the NYC company can, if appropriately structured, serve as authorised representative. The advantage is integration with existing counsel; the disadvantage is that many law firms decline to accept this role because of the potential conflict with their advocacy role.

Choosing the Member State

The Regulation does not prescribe which Member State the representative must be established in. In practice, the choice affects:

Which national market surveillance authority becomes the primary counterparty. The MSA of the Member State where the representative is established will typically be the first point of contact for information requests and inspections concerning the represented system. Member States with more advanced enforcement capacity (France, Spain, Netherlands, Ireland) have different inspection cultures.

Language of communication. Authorities may request documentation in the official language of their Member State. A representative in Ireland (English-speaking) avoids translation overhead. A representative in Germany or France may require document preparation in local language.

Cost of service. Professional representative services vary by Member State. Ireland, the Netherlands, and Luxembourg tend to be higher; Spain, Portugal, and some Eastern Member States tend to be lower.

Our general recommendation for NYC providers without existing EU presence: Ireland for English-language efficiency and proximity to major tech supply chains, Spain for cost-effectiveness with strong regulatory sophistication, Netherlands for technical-product depth.

What the mandate document must contain

Article 22(2) requires the mandate to be "by written mandate." Article 22(3) requires that the representative be empowered to perform the enumerated tasks and that the provider enable the representative to do so in practice. The typical mandate document contains:

Identification of provider and representative (legal entities, registered addresses, tax IDs).

Specific AI system(s) covered — identifying them by intended purpose, version, and relevant reference.

Scope of representation — specifically that the representative is empowered to act for the provider with respect to Regulation (EU) 2024/1689.

Enumerated tasks per Article 22(3) or Article 54(3), with explicit language granting authority.

Information flows — how the representative will obtain documentation, logs, and updates from the provider.

Duration of mandate, including the ten-year documentation retention obligation that extends past termination.

Termination clause reflecting the representative's unilateral right to terminate under Article 22(4) or 54(5), and the representative's duty to notify authorities in that case.

Fees and indemnification, as applicable.

Under Article 22(2), upon request by a competent authority, the representative must be able to provide a copy of the mandate in an EU language designated by the requesting authority. English is accepted by most authorities de facto, but the statutory position is that the authority can specify its own language.

Timing and practical sequence

Under Article 22(1), the mandate must be in place "prior to making the high-risk AI system available on the Union market." This is a condition precedent, not a condition subsequent. A NYC provider cannot place the system on the market and then appoint the representative retroactively.

The practical sequence for a NYC provider planning EU market entry for a high-risk AI system:

Complete classification — confirm the system is a high-risk AI system under Article 6/Annex III.

Complete conformity assessment under Article 43 (for most Annex III systems, this is internal control under Article 43(2)).

Prepare Annex IV technical documentation and draw up the EU declaration of conformity.

Identify and engage the authorised representative.

Execute the mandate document in writing.

Provide the representative with a complete copy of the technical documentation and declaration.

Register the system in the Article 49 database (if registration applies to the system) — the representative can handle this, or the provider can.

Place the system on the EU market.

This sequence typically takes six to eight weeks when the technical documentation is already in place. If documentation is not yet in place, the sequence is constrained by the documentation timeline, not by the representative appointment.

The penalty for failing to appoint

Article 99(4) covers non-compliance with Article 22 — it is a Tier 2 violation. Fines up to €15 million or 3% of worldwide annual turnover, whichever is higher. More operationally damaging: without a representative in place, the provider cannot lawfully place the system on the EU market. Enforcement action may include orders to withdraw the system from service and recall from the market, with associated reputational and commercial consequences.

For NYC providers reaching EU users, the authorised representative is not a box to tick. It is a precondition for lawful market presence.

Primary sources. Regulation (EU) 2024/1689: Article 3(5) (definition of authorised representative), Article 22 (authorised representatives of providers of high-risk AI systems), Article 43 (conformity assessment), Article 49 (database registration), Article 51 (GPAI with systemic risk), Article 54 (authorised representatives of providers of GPAI models), Article 99(4) (penalties for Article 22 non-compliance). Regulation (EU) 2023/988 (Product Safety Regulation) for parallel representative pattern.