European UnionAI Act, Article 22 (authorised representative of a provider established in a third country: appointment, mandate, tasks and termination)
Regulation (EU) 2024/1689, Article 22(1), (2), (3) except points (b) and (c), and (4)
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are a provider of a high-risk AI system established in a third country, appoint, by written mandate, an authorised representative established in the Union before you make the system available on the Union market (Article 22(1)).
- Enable your authorised representative to perform the tasks specified in the mandate you gave it (Article 22(2)).
- Make the mandate empower the authorised representative to carry out the tasks listed in Article 22(3), and to be addressed, in addition to or instead of you, by the competent authorities on all issues related to ensuring compliance with the Regulation.
- If you are the authorised representative of such a provider, perform the tasks specified in the mandate you received, and provide a copy of the mandate to the market surveillance authorities upon request, in one of the official languages of the institutions of the Union, as indicated by the competent authority (Article 22(3)).
- Verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider (Article 22(3), point (a)).
- Cooperate with competent authorities, upon a reasoned request, in any action they take in relation to the high-risk AI system, in particular to reduce and mitigate the risks it poses (Article 22(3), point (d)).
- Where applicable, comply with the registration obligations referred to in Article 49(1) or, if the provider carries out the registration itself, ensure that the information referred to in point 3 of Section A of Annex VIII is correct (Article 22(3), point (e)).
- Terminate the mandate if you consider or have reason to consider that the provider is acting contrary to its obligations under the Regulation, and immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body of the termination and the reasons for it (Article 22(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4), point (b): non-compliance with the obligations of authorised representatives under Article 22 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Paragraph 4 does not list the provider's own duties in Article 22(1) and (2). Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- What amounts to having "reason to consider" that the provider is acting contrary to its obligations, so that an authorised representative must terminate the mandate under Article 22(4)?
What it makes you log
Who may demand the log
Regulator
Logging duty
The authorised representative provides a copy of the mandate to the market surveillance authorities upon request, which cannot be done without a kept copy. The article does not say how long the mandate is kept; the documents the representative keeps for 10 years, and the log access it provides, are points (b) and (c) of paragraph 3.
- Kind
- Implicit
- As of
- Provision
- Article 22(3), first paragraph
- Trigger
- high_risk_systems
What this law does
Prior to making their high-risk AI systems available on the Union market, providers established in third countries must, by written mandate, appoint an authorised representative established in the Union. The provider must enable its authorised representative to perform the tasks specified in the mandate received from the provider.
The authorised representative must perform the tasks specified in the mandate and provide a copy of the mandate to the market surveillance authorities upon request, in one of the official languages of the institutions of the Union, as indicated by the competent authority. For the purposes of the Regulation, the mandate empowers the authorised representative to carry out the tasks listed in Article 22(3).
Under Article 22(3), point (a), the mandate empowers the authorised representative to verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider.
Under Article 22(3), point (d), the mandate empowers the authorised representative to cooperate with competent authorities, upon a reasoned request, in any action the latter take in relation to the high-risk AI system, in particular to reduce and mitigate the risks posed by the high-risk AI system.
Under Article 22(3), point (e), the mandate empowers the authorised representative, where applicable, to comply with the registration obligations referred to in Article 49(1), or, if the registration is carried out by the provider itself, to ensure that the information referred to in point 3 of Section A of Annex VIII is correct.
The mandate empowers the authorised representative to be addressed, in addition to or instead of the provider, by the competent authorities, on all issues related to ensuring compliance with the Regulation. The authorised representative must terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations pursuant to the Regulation.
On such a termination, the authorised representative must immediately inform the relevant market surveillance authority, as well as, where applicable, the relevant notified body, about the termination of the mandate and the reasons therefor. Article 22 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.
Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from for a system classified as high-risk under Article 6(2) and Annex III, and from for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.
Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.
Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.
By , the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.