EU AI Act Art.22: Authorised representatives of providers of high-risk AI systems
Article 22 of the EU AI Act binds the authorised representative. It requires A provider established in a third country must, before making its high-risk AI system available on the Union market, appoint. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.22 |
| Binds | Authorised representative |
| Group | High-Risk Operator Obligations |
| Evidence items | 5 |
| Linked NIST AI RMF controls | 0 |
| Linked ISO/IEC 42001 controls | 1 |
| Last updated |
Who does Art.22 bind?
The article binds the authorised representative. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.22 require?
A provider established in a third country must, before making its high-risk AI system available on the Union market, appoint by written mandate an authorised representative established in the Union, and must enable that representative to perform the tasks in the mandate. The mandate must empower the representative to verify that the Art.47 EU declaration of conformity and the Art.11 technical documentation have been drawn up and that an appropriate conformity assessment has been carried out; to keep the provider's contact details, a copy of the declaration, the technical documentation and any notified body certificate at the disposal of competent authorities for ten years after the system was placed on the market or put into service; to provide information, documentation and log access on reasoned request; to cooperate with competent authorities on any action relating to the system; and to comply with or verify the Art.49(1) registration. The representative must terminate the mandate, and immediately inform the relevant market surveillance authority and any relevant notified body, if it considers the provider is acting contrary to its obligations.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.22 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.22?
| Category | Evidence to keep |
|---|---|
| Authorised representative | The written mandate, showing it confers each of the Art.22(3) tasks |
| Authorised representative | Evidence the appointment predates the system being made available on the Union market |
| Authorised representative | The document set held by the representative: provider contact details, EU declaration of conformity, technical documentation and any notified body certificate |
| Authorised representative | Evidence the provider enables the representative, for example by giving it access to the technical file and to the logs it may have to produce |
| Authorised representative | A documented mandate termination route and the notification path to the market surveillance authority |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.22?
No NIST AI RMF control is recorded as a match for this obligation in the held rule set. It is left unlinked and marked, never guessed.
Which ISO/IEC 42001 controls line up with Art.22?
1 control in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.10.2 | Allocating responsibilities Written mandate allocates defined tasks to a third party representative. | medium |
What does the conformance kit add for Art.22?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.