The hidden cost of not appointing an AI Act Authorised Representative

The European Union’s Artificial Intelligence Act (AI Act) (Regulation (EU) 2024/1689) is the first full legal framework for artificial intelligence. It adopts a risk-based approach, meaning that the obligations for an AI system depend on the level of risk it poses.

Its goal is to ensure AI systems used in the EU are safe and constitutes a compliance basis for maintaining access to a market of 450 million consumers.

Before exploring who is subject to this requirement, it is important to understand which AI providers must take action. For providers of High-Risk AI Systems (HRAIS) or General-Purpose AI (GPAI) based outside the EU, the regulation mandates appointing a local Authorised Representative (AR) to act as your primary liaison with European authorities. Failing to appoint one has significant consequences.

The obligation to appoint a representative falls specifically on providers who are not established in the European Union. 

Under the AI Act, a provider is the entity that develops an AI system or has one developed and markets it under its name or trademark.

You must appoint an AR before placing your AI system on the market if your company is a provider established outside the EU and your system falls into one of these categories:

• High-risk AI system (HRAIS): These are systems used in critical areas like medical devices, biometric identification, and critical infrastructure, where a failure poses a significant risk to health, safety, or fundamental rights.
• General-purpose AI (GPAI) model: This obligation applies to all GPAI models, with one significant exception. Providers of free and open-source GPAI models are exempt, unless their model is deemed to present systemic risks.

This requirement is mandated under article 22 and article 54 of the AI Act.

While the initial legal duty rests with the non-EU provider, others in the supply chain may also need to appoint an AR if they take on the provider’s legal responsibilities.

⇨ A distributor, importer, deployer, or other third party established in a third country shall be considered the provider and must fulfil all corresponding obligations (including appointing an AR) if they:

1. Put their own name or trademark on an HRAIS.
2. Make a substantial modification to an HRAIS while the modified system remains an HRAIS.
3. Modify the intended purpose of any AI system so that the system becomes high-risk.

This reclassification, where another party becomes the provider, is stipulated in Article 25(1) of the AI Act.

An AI Act Authorised Representative is a natural or legal person located or established within the European Union who is explicitly appointed by a non-EU provider of an AI system or a general-purpose AI model.

This representative acts as your official point of contact for EU authorities. They help you meet compliance requirements and keep your access to the EU market, even if your business is outside of Europe.

Your authorised representative is far more than a postal address. Under Articles 22 and 54 of the AI Act, their mandated tasks are critical to your compliance. They must:

• Verify that your technical documentation and EU declaration of conformity are correctly prepared. For HRAIS also that the required conformity assessment procedure has been carried out.
• Keep a copy of all documentation, along with your contact details, available for national authorities for a period of ten years after the system is placed on the market.
• Provide authorities with all necessary information and documentation to prove your AI system’s compliance.
• Cooperate with authorities on any action they take regarding your AI system.

Failing to appoint an authorised representative when required is a direct infringement of the AI Act. The penalties, outlined in Article 99, are severe and are designed to be dissuasive.

Non-compliance with the obligation to appoint an authorised representative (under Articles 22 and 54) falls under the second-highest tier of administrative fines.:

• Administrative fines of up to €15 million.
• Or, if the offender is a company, up to 3% of its total worldwide annual turnover from the previous financial year, whichever is higher.

This places the penalty for not having a representative in the same category as other critical failures, such as a provider not complying with its data governance obligations.

Beyond fines, national authorities have the power to implement other effective and proportionate measures. These can include:

• Warnings for non-compliance.
• Market exclusion or restriction: Your non-compliant AI systems cannot be legally placed on the EU market.
• AI system withdrawal (prohibition): mandatory orders to cease making the AI system available on the EU market or to withdraw it entirely.
• Reputational damage: As an indirect consequence being non-compliant erodes trust with customers and partners.

When deciding on the fine amount, market surveillance authorities must consider all relevant circumstances. Key factors include:

• The nature, gravity, and duration of the infringement and its consequences.
• The size and annual turnover of the company committing the infringement.
• Whether the infringement was intentional or negligent.
• Any financial benefits gained from the non-compliance.
• The degree of cooperation with the national competent authorities.

The absence of an authorised representative can lead to further infringements. 

And the penalty for failing to appoint an AR is cumulative with the penalty for failing to comply with reporting or documentation obligations (subject to fines of up to €7.5 million or 1% of total worldwide annual turnover), if the lack of an RA means that the provider is unable to respond to a request from the authority with correct, complete and accurate information.   

Choosing the right AIA AR is as important as understanding your obligations and the risks of non-compliance. In order to make an informed choice, you should look for:

• Technical and regulatory competence: The AI Act Authorised Representative must understand the AI Act’s specific requirements and have the ability to verify complex technical documentation and conformity assessment procedures.
• Operational capacity for long-term compliance: They must have the infrastructure to securely store and manage your technical documentation, declaration of conformity, and other records for the mandatory 10-year period.
• Proven liaison capability: The role requires formal and effective communication with EU authorities, such as market surveillance authorities and the AI Office. Including experience supporting product recalls.

Given the complexity of the AI Act, a provider’s due diligence should confirm that a AR possesses this specific expertise, rather than offering only generalised compliance services.

The obligation to appoint an AI Act Authorised Representative is a live legal requirement for non-EU providers of General-Purpose AI models, and for High-Risk AI Systems since 2 August 2025. 

However, the overarching penalty framework (Article 99) is already in effect, meaning authorities have the power to enforce compliance from 2 August 2025. 

This would include fines of up to €15 million or 3% of global turnover and the immediate removal of your AI system from the EU market.

Appointing a qualified authorised representative is now a required step if you want to do business in the EU market.

If your GPAI or AI system is already available on the EU market without a representative, or if you are planning a new launch, take care of this compliance step as soon as possible.

Contact our team of specialists today to secure your EU market access.