The Role of the Authorised Representative under the EU AI Act

Definition of an Authorised Representative

An authorised representative is defined under Article 3(5) of the AI Act as a natural or legal person located or established in the EU who has received and accepted a written mandate from a provider of a high-risk AI system or a general-purpose AI model to perform and carry out on the provider's behalf the obligations and procedures established by the AI Act.

Rationale for Authorised Representatives

Recital 82 of the Act sets out the rationale for appointing an authorised representative, which is to enable enforcement of the Act and create a level playing field for operators, and, taking into account the different forms of making available of digital products, ensure that, under all circumstances, a person established in the EU can provide authorities with all the necessary information on the compliance of an AI system. The recital further states that an authorised representative plays a pivotal role in ensuring the compliance of the high-risk AI systems placed on the market or put into service in the EU by the relevant provider who is not established in the EU and in serving as their contact person established in the EU.

Obligation to appoint an Authorised Representative

Prior to making a high-risk AI system or general-purpose AI model available on the EU market, providers of high-risk AI systems (under Article 22) and general-purpose AI models (under Article 54) established outside of the EU must, by written mandate, appoint an authorised representative, who may be an individual or a corporate, which is established in the EU. The provider must enable its authorised representative to perform the tasks specified in such mandate.

The identity, address and contact details of a high-risk AI system provider's authorised representative must be included in the instructions for use (Article 13), the EU declaration of conformity (Article 47) and for registration (Article 49).

Obligations of the Authorised Representative

Considering the role at a high level, an authorised representative acts as a key point of contact within the EU, is responsible for verifying and keeping all mandatory documentation that demonstrates the compliance of the high-risk AI system or general-purpose AI model with the AI Act, receive reports of serious incidents relating to AI systems and models, and must cooperate with the EU authorities. There are also additional actions that the authorised representations may need to take on behalf of the provider, such as registering themselves and the AI system in the EU database under Article 49.

While these may appear to be documentation and “mailbox” requirements, the authorised representative has strict responsibilities to step into the position of the provider to ensure its compliance with the AI Act. The authorised representative must also terminate its mandate with a provider if it considers or has reason to consider the provider to be acting contrary to its obligations pursuant to the AI Act. In such a case, it must immediately inform the relevant market surveillance authority, as well as, where applicable, the relevant notified body, about the termination of the mandate and the reasons.

Specific obligations for High-Risk AI Systems

Under Article 22(3), the authorised representative must perform the tasks specified in the mandate received from the provider of a high-risk AI system and provide a copy of the mandate to the market surveillant authority upon request. The mandate must empower the authorised representative to carry out the following tasks:

• verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider;
• for a period of ten years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the competent authorities and national authorities or bodies (referred to in Article 74(10)), the contact details of the provider that appointed the authorised representative, a copy of the EU declaration of conformity referred to in Article 47, the technical documentation and, if applicable, the certificate issued by the notified body;
• provide a competent authority, upon a reasoned request, with all the information and documentation necessary to demonstrate the conformity of a high-risk AI system with the requirements of high-risk AI systems set out in Section 2 of the Act, including access to the logs (as referred to in Article 12(1)) automatically generated by the high-risk AI system, to the extent such logs are under the control of the provider;
• cooperate with competent authorities, upon a reasoned request, in any action the latter take in relation to the high-risk AI system, in particular to reduce and mitigate the risks posed by the high-risk AI system;
• where applicable, comply with the registration obligations referred to in Article 49(1), or, if the registration is carried out by the provider itself, ensure that the information provided is correct; and
• be addressed, in addition to or instead of the provider, by the competent authorities, on all issues related to ensuring compliance with the Act.

Specific obligations for General-Purpose AI Models

Similarly, under Article 54(3), the authorised representative must perform the tasks specified in the mandate received from the provider of a general-purpose AI model and provide a copy of the mandate to the market surveillant authority upon request. Note that these obligations do not apply to general-purpose AI models released under a free and open-source licence unless the general-purpose AI model presents systemic risk.

The mandate must empower the authorised representative to carry out the following tasks:

• verify that the technical documentation specified in Annex XI has been drawn up and all obligations referred to in Article 53 on general-purpose AI models and, where applicable, Article 55 on general-purpose AI models with systemic risk, have been fulfilled by the provider;
• keep a copy of the technical documentation specified in Annex XI at the disposal of the AI Office and national competent authorities, for a period of ten years after the general-purpose AI model has been placed on the market, and the contact details of the provider that appointed the authorised representative;
• provide the AI Office, upon a reasoned request, with all the information and documentation necessary to demonstrate compliance with the obligations for general-purpose AI models set out in Chapter V;
• cooperate with the AI Office and competent authorities, upon a reasoned request, in any action they take in relation to the general-purpose AI model, including when the model is integrated into AI systems placed on the market or put into service in the EU; and
• be addressed, in addition to or instead of the provider, by the AI Office or the competent authorities, on all issues related to ensuring compliance with the Act.

How to appoint an Authorised Representative

An appointment letter setting out the mandate would be sufficient under the requirements of the Act. However, we would advise that the parties put in place a separate services agreement to clarify responsibilities, liabilities, compensation, termination rights and other commercial terms in more detail, particularly if appointing an external individual or firm.

Commercial considerations when appointing an Authorised Representative

Outside of the normal contractual terms to be considered in any engagement of this nature, key issues and topics to address include:

• Choosing the right representative: Providers may want to appoint a subsidiary or corporate affiliate in the EU as its authorised representative, to ensure close collaboration. Alternatively, providers may be able to appoint professional services firms offering such a service (and we anticipate that these professional services will develop and mature over the coming months).
• Minimum competencies: The role of an authorised representative is complex and will require a deep understanding of the AI Act, as well as the technical and legal aspects of the AI systems and models they are instructed to represent. Any minimum requirements for expertise, on-going training and service commitments must be properly documented.
• From a provider perspective: Providers really need to think about appropriate confidentiality obligations on the authorised representative, and also appropriate terms in relation to protecting intellectual property, access to documents, notification obligations (to the provider, and as required by the Act), and also whether there should be certain non-compete or restrictive covenants.
• From the perspective of the authorised representative: They need to ensure that the mandate includes appropriate obligations on the provider to enable the authorised representative to comply with their obligations, such as access to information and documentation that it needs to perform its obligations and may need to disclose to the relevant authorities.
• Risk allocation: Given the potential for investigations, complaints, claims and fines under the AI Act, the parties need to carefully think about how risk and liability should be allocated, together with proportionate liability caps and appropriate indemnities.

Our conclusion

Authorised representatives will play a pivotal role in bridging the gap between high-risk AI system and general-purpose AI model providers outside the EU and the EU regulatory environment, ensuring that the relevant AI system or model is introduced into the EU market in a compliant and responsible manner. The complexity of this role is significant, and it is clear that the authorised representative must be well-versed in the AI Act, other EU law, and the specific technicalities of the AI systems and models they represent.

It is therefore of critical importance, to the provider, the authorised representative, and those that the AI Act is designed to protect, that the role and obligations between the provider and the authorised representative are properly considered and documented in detail.

Appointing an authorised representative should not be viewed as an innocuous exercise to fulfil a bureaucratic requirement.

Our recent publications

If you enjoyed these articles, you may also be interested in our recent publications:
 

• The Neural Network – August 2024
• AI, machine learning and big data laws and regulations 2024
• AI update – CMA's approach to AI