EU AI Act Compliance: Authorised Representatives & Conformance Essentials

Introducing the EU AI Act – Effective August 2026

The EU’s landmark Artificial Intelligence Act came into force in August 2026, providers of certain AI systems—whether based inside or outside the EU—must meet a range of risk-based requirements. A key obligation for non-EU suppliers is to appoint an Authorised Representative within the European Union.

Role of the Authorised Representative

An Authorised Representative is empowered by a formal written mandate to:

• Archive documentation: Keep a full set of the AI system’s technical files for no less than ten years.
• Liaise with regulators: Serve as the point of contact for the EU AI Office and national market-surveillance bodies, delivering any requested information or records.
• Support compliance checks: Assist in conformity assessments, respond to investigations, and facilitate corrective actions when needed.
• End the mandate if required: Withdraw representation and inform authorities should the AI provider fall out of compliance.

High-Risk AI Systems vs. General-Purpose AI Models

• High-Risk AI (Annex III)
  These are systems whose failure or bias could jeopardise safety, fundamental rights or fairness—such as facial recognition, critical infrastructure management or recruitment tools. They must pass either internal or third-party conformity assessments, hold comprehensive technical documentation, and implement ongoing post-market monitoring.
• General-Purpose AI (Article 54)
  Broad-scope models (for example, large language or vision models) that can exert systemic influence even without branding. Non-EU creators of such models are also required to designate an EU Representative, publish a concise overview of their training data and risk controls, and disclose model capabilities and known limitations.

Core Compliance Requirements

1. Technical Documentation
   Maintain detailed records on system architecture, data sources, validation results, performance indicators and mitigation strategies.
2. Transparency & User Guidance
   Provide clear instructions for safe use, including the contact details of the provider—or, for non-EU entities, their Authorised Representative—alongside descriptions of system functions, constraints and risk-management advice.
3. Conformity Assessment
   Depending on the AI system’s classification, undergo either internal quality-management procedures or external audits by a notified body.
4. Post-Market Monitoring
   Continuously track system behaviour to identify drift, emergent biases or other hazards, and perform regular reviews with corrective measures as appropriate.
5. Standards and Codes of Practice
   Adopt relevant harmonised technical standards and sector-specific codes to benefit from a presumption of conformity under the Act.

Implementation Timeline

• 1 August 2024: The EU AI Act enters into force.
• 2 February 2025: Prohibited AI practices and certain AI literacy requirements begin to apply.
• 2 August 2025: Governance rules and obligations for general-purpose AI (GPAI) models begin to apply.
• 2 August 2026: The AI Act becomes generally applicable, including a number of transparency requirements and enforcement provisions.
• 2 December 2027: Requirements for high-risk AI systems covered by Annex III begin to apply. These include certain AI systems used in areas such as biometrics, critical infrastructure, education, employment, migration and access to essential services.
• 2 August 2028: Requirements for high-risk AI systems that are safety components of, or are themselves, products covered by the EU product legislation listed in Annex I begin to apply. This includes AI incorporated into certain regulated products.
• 31 December 2030: Certain AI systems that are components of the large-scale IT systems covered by Annex X and were placed on the market or put into service before 2 August 2027 must be brought into compliance.

By designating an EU Authorised Representative and adhering to these compliance pillars, AI providers can fulfil the EU AI Act’s transparency, safety and accountability goals—ensuring their systems meet the regulatory bar when entering the European market.