Authorised representative for GPAI providers

Companies outside the EU that place a general-purpose AI model on the Union market must appoint an authorised representative in the Union under EU AI Act Article 54. The obligation is live now, and Engage Compliance acts as that representative directly from its EU establishment.

The short answer: if you are established outside the EU and you place a general-purpose AI model on the Union market, Article 54 requires you to appoint, by written mandate and before the model goes on the market, an authorised representative established in the Union. Engage Compliance provides that role from its EU establishment, holds the mandate and the Annex XI technical documentation for the AI Office, and is the contact point for the provider.

This is the part of the AI Act that bites first. The general-purpose AI rules in Chapter V have applied since 2 August 2025, so unlike the high-risk representative duty, which comes later, this one is already in force.

Key takeaways

• Article 54 requires a provider established in a third country to appoint an authorised representative in the Union, by written mandate, before placing a general-purpose AI model on the Union market.
• Engage Compliance acts as that authorised representative directly from its EU establishment. Article 3(5) requires only that the representative be located or established in the Union, with no single Member State specified, so no separate local entity is needed.
• The obligation is live. Chapter V applies from 2 August 2025.
• The exemption for free and open-source models is real but narrow, and it falls away entirely if the model presents systemic risks.
• Most SaaS companies are not caught. If your product runs on a third-party model, you are a deployer or a downstream provider, not the provider of the model.
• The appointment is €690 a year at the smallest band, published in full and buyable online.

Who needs a GPAI authorised representative

Article 54(1) is direct: prior to placing a general-purpose AI model on the Union market, providers established in third countries must, by written mandate, appoint an authorised representative established in the Union.

Two elements decide it. You have to be the provider of a general-purpose AI model, meaning the entity that develops and places the model itself on the market, and you have to be established outside the EU. If both hold and the model reaches the Union market, the appointment is required before it does.

The point most companies get wrong is the first element. Building a feature on top of OpenAI, Anthropic, Google, or any other provider’s model does not make you a GPAI provider. It makes you a deployer, or at most a downstream provider of an AI system built on someone else’s model. The Article 54 duty sits with whoever provides the underlying general-purpose model, not with the many companies that use one. If that is not you, this is not your obligation, and we will tell you so at the scoping stage rather than sell you a mandate you do not need.

Who is exempt

Article 54(6) exempts providers of general-purpose AI models released under a free and open-source license that allows access, use, modification, and distribution of the model, where the parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available.

There is one condition that swallows the exemption in the cases that matter most. It does not apply where the model presents systemic risks. A model at that tier loses the open-source carve-out and attracts the additional obligations that go with systemic risk, which the representative has to be able to show were addressed. So an open-weight release is only exempt while it stays below the systemic-risk line.

When it applies from

Chapter V of the AI Act, which contains Article 54, applies from 2 August 2025. The obligation to appoint the representative before a general-purpose AI model is placed on the Union market is in force today.

This is the reason to start with Article 54 rather than the high-risk representative duty under Article 22, which is set on later dates. If you place a GPAI model on the EU market now, the representative has to be in place now.

Where the representative must be established

In the Union, and nowhere more specific. Article 3(5) defines an authorised representative as a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider. Article 54(1) repeats the same requirement, established in the Union, without naming a Member State.

Because there is no Member State constraint, Engage Compliance performs this role directly from its EU establishment. You do not need a representative set up in a particular country, and you do not need a chain of local entities.

What the duties are

The representative’s obligations are set out in Article 54(3) and 54(5), and they are more than a mailbox:

• Hold the mandate for the AI Office. Keep a copy of the written mandate and provide it to the AI Office on request, in one of the official languages of the institutions of the Union.
• Hold the technical documentation for ten years. Keep a copy of the Annex XI technical documentation at the disposal of the AI Office and national competent authorities for 10 years after the model is placed on the market. That duty outlives the commercial relationship, so if the engagement ends in year two, the documents are still held for the remaining eight.
• Hold the provider’s contact details and be the point of contact for the provider on the model.
• Terminate and report if the provider is off side. Under Article 54(5), the representative must terminate the mandate if it considers, or has reason to consider, that the provider is acting contrary to its obligations under the Regulation, and in that case it must immediately inform the AI Office of the termination and the reasons for it.

Read that last duty twice before you sign a mandate with anyone. It puts the representative under a legal obligation that can run against its own paying client, and it needs to be set out plainly in the engagement terms rather than discovered later.

What the penalty is

We would rather be honest about this than overstate it, because the position is genuinely awkward. There is no article that expressly fines a provider for failing to appoint the Article 54 representative. The fine keyed to authorised representatives in Article 99(4)(b), up to €15 million or 3 percent of worldwide annual turnover, is tied to the obligations of representatives under Article 22, the high-risk role, not Article 54.

What does apply is Article 101. Chapter V is enforced by the Commission directly against the provider of the general-purpose AI model, with fines of up to 3 percent of worldwide annual turnover or €15 million, from 2 August 2026.

So do not read this as an obligation without teeth. An operator under the AI Act is defined to include the authorised representative, and a national regulator could construct a penalty for an Article 54 breach on that basis, while the Commission can treat a failure to appoint as part of a provider’s wider non-compliance. The safe reading is that the duty is live, it is enforceable against the provider, and the exact penalty route for the appointment itself is still developing.

What Engage Compliance delivers

• Scoping first. We confirm whether you are actually a GPAI provider under Article 54 or a deployer or downstream provider, before anything else. If you are not caught, we say so.
• The written mandate, in a form that meets Article 54(1) and can be produced to the AI Office in an official EU language.
• Custody of the Annex XI technical documentation, held at the disposal of the AI Office and national authorities for the full 10-year period.
• The named contact point for the provider, established in the Union.
• Handling of AI Office and national authority contact, with the substance passed to you within one business day.
• Clear engagement terms on the Article 54(5) termination duty, so the one obligation that can run against you is understood and agreed at the start, not sprung later.

Appointments of this kind are typically completed in a few working days once scoping is done.

What it costs

The appointment is €690 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold, charged once, up front, with no setup fee. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.

Company size	AI Act Representative for general-purpose AI
1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold	€690
11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold	€990
51 to 250 people, or €10m to €50m revenue	€2,290
251 or more people, or over €50m revenue	From €4,490

The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.

Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.

Every appointment you hold is a separate mandate, and only the highest-priced one in the basket is charged in full. Every other appointment is charged at a share of its own price, and for this one that share is half its own price. So adding this to an appointment you already hold costs €345 at band 0, €495 at band 1, €1,145 at band 2, €2,245 at band 3, rather than a second full price.

Two extras are optional, and each is charged once per order rather than once per appointment. Higher-risk processing, which covers special category data and criminal offense data, is €250 at band 0, €500 at band 1, €750 at band 2, €1,000 at band 3. Same-business-day response is a service level on authority and data subject correspondence rather than substantive advice, and is €1,200 a year.

Every band is published and buyable, so you can see your price and appoint online without talking to anyone first. The full table for every mandate is on representative services.

The appointment issues in seconds. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment. Nobody at Engage has to approve anything.

Sources and references

• EU AI Act, Article 54, European Commission AI Act Service Desk
• Regulation (EU) 2024/1689 (EU AI Act), EUR-Lex