AI Act Article 22: Authorised representatives of providers of high-risk AI systems

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

If you are established outside the EU and you want to make a high-risk AI system available on the Union market, Article 22 makes you appoint an authorised representative in the Union by written mandate before you do it, not after. The mandate is not a formality: it has to empower five specific tasks, and one of them runs for ten years after the system reaches the market.

Who it binds

• Providers of high-risk AI systems established in third countries, before making the system available on the Union market (Article 22(1)). The trigger is the act of making available, so the appointment is a precondition of launch rather than a response to enforcement.
• It does not bind providers established in the Union. The obligation is written for third-country providers only.
• It says nothing about your size, your revenue or how many users you have. Unlike the general-purpose AI model rules, Article 22 carries no threshold at all: one high-risk system on the Union market is enough.
• It binds the provider, not the deployer. A company using someone else's high-risk system in the EU has obligations under Article 26, which is a different article and a different role.

What it makes somebody do

• You, the provider. Appoint the authorised representative by written mandate, before making the system available (Article 22(1)).
• You, the provider. Enable the representative to actually perform what the mandate specifies (Article 22(2)). This is a duty on you, and it is where a thin appointment fails.
• The representative. Verify that the EU declaration of conformity under Article 47 and the technical documentation under Article 11 have been drawn up, and that a conformity assessment has been carried out (Article 22(3)(a)).
• The representative. Keep your contact details, the declaration of conformity, the technical documentation and any notified body certificate at the disposal of authorities for ten years after the system is placed on the market or put into service (Article 22(3)(b)).
• The representative. On a reasoned request, give a competent authority everything needed to demonstrate conformity, including access to the logs generated under Article 12(1) where those logs are under your control (Article 22(3)(c)).
• The representative. Cooperate with competent authorities on any action about the system, in particular to reduce and mitigate its risks (Article 22(3)(d)).
• The representative. Comply with the Article 49(1) registration obligations, or where you register yourself, make sure the Annex VIII Section A point 3 information is correct (Article 22(3)(e)).
• The representative. Terminate the mandate, and immediately tell the market surveillance authority and any notified body why, if it considers or has reason to consider that you are acting contrary to the Regulation (Article 22(4)).

What it does not say

• It does not make the representative responsible for your compliance. The tasks in Article 22(3) are verification, custody, disclosure and cooperation. Building a conforming system stays yours.
• It does not let you write whatever mandate you like. Article 22(3) says the mandate shall empower the representative to carry out those five tasks, so a mandate that omits one is defective rather than merely narrow.
• The ten-year custody in Article 22(3)(b) is not ten years from appointment. It runs from the date the system was placed on the market or put into service, which usually precedes your appointment and which only you can tell the representative.
• It is not a mailbox. Article 22(3) closes by empowering the representative to be addressed, in addition to or instead of you, by competent authorities on all issues related to compliance.
• Article 22(4) is not boilerplate. The representative is required to walk away and report it, which means the appointment carries a genuine judgment the representative has to be resourced to make.

How it sits beside the other mandates

• Article 22 and Article 54 are two different appointments. Article 22 is for high-risk systems, Article 54 for general-purpose AI models, and a company shipping a model inside its own high-risk system can be caught by both.
• A company in scope of Article 22 is very often in scope of GDPR Article 27 as well, because a third-country provider placing an AI system on the Union market is usually also processing personal data of people in the EU. They are separate appointments with separate documents.
• The ten-year retention outlives most commercial agreements. Whoever holds those documents has to still be there in year nine, which is a question worth asking of any provider before signing.