Third-Party Governance
Authorised Representative Governance
What this control does
Appoint, mandate, monitor and support authorised representatives where required.
How to implement
Identify whether an authorized representative is required for the relevant provider and appoint an EU-established representative through the applicable written mandate. Distinguish high-risk AI system duties under Article 22 from GPAI model duties under Article 54. Provide the information and access needed to perform the mandated tasks, verify required records and monitor material concerns. Document how a mandate is terminated and how required notifications and continuity are handled. Do not treat a representative as taking over every responsibility of the provider.
Suggested timing and triggers
Before appointment and applicable market access; on changes to mandate or provider; ongoing mandated tasks; periodic reviews set by the organization.
Evidence examples
Appointment decision and written mandate Due-diligence and task-allocation records Required retained documentation and verification results Review correspondence and escalations Termination notices and handover records where applicable
How to check this control
Select an appointment and test whether the representative can perform a specific mandated task and retrieve the required records. Check that the mandate reflects the correct legal route and that a material compliance concern would be escalated.
Related EU AI Act obligations
Article 22(1)-(2)
Appoint an EU Authorised Representative for High-Risk AI When the Provider Is Established Outside the Union
Article 22(3)-(4)
Perform Required High-Risk AI Authorised Representative Duties
Article 22(3)(a)
Verify Provider Conformity Documentation and Assessment
Sub-obligation of Article 22(3)-(4): Perform Required High-Risk AI Authorised Representative Duties
Article 22(3)(b)
Retain Required Provider and Conformity Documentation for Ten Years
Sub-obligation of Article 22(3)-(4): Perform Required High-Risk AI Authorised Representative Duties
Article 22(3)(c)-(d)
Provide Compliance Information, Logs and Cooperation to Competent Authorities
Sub-obligation of Article 22(3)-(4): Perform Required High-Risk AI Authorised Representative Duties
Article 22(3)(e)
Fulfil Applicable High-Risk AI Registration Duties as Authorised Representative
Sub-obligation of Article 22(3)-(4): Perform Required High-Risk AI Authorised Representative Duties
Article 22(4)
Terminate the Mandate and Notify Authorities if the Provider Is Non-Compliant
Sub-obligation of Article 22(3)-(4): Perform Required High-Risk AI Authorised Representative Duties
Article 54(1)-(2), 54(6)
Appoint an EU Authorised Representative for GPAI Models When the Provider Is Established Outside the Union
Article 54(3)-(5)
Perform Required GPAI Authorised Representative Duties
Article 54(3)(a)
Verify GPAI Technical Documentation and Provider Compliance
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
Article 54(3)(b)
Retain GPAI Technical Documentation and Provider Contact Details for Ten Years
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
Article 54(3)(c)
Provide GPAI Compliance Information and Documentation to the AI Office on Request
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
Article 54(3)(d), 54(4)
Cooperate With the AI Office and Competent Authorities on GPAI Matters
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
Article 54(5)
Terminate the GPAI Mandate and Notify the AI Office When the Provider Is Non-Compliant
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
_BestMeetsRequirements_Mid-Market_MeetsRequirements.svg)
_BestSupport_Enterprise_QualityOfSupport.svg)
_BestSupport_Mid-Market_QualityOfSupport.svg)
_BestSupport_QualityOfSupport.svg)
_BestUsability_Mid-Market_Total.svg)
_EasiestAdmin_EaseOfAdmin.svg)
_EasiestAdmin_Enterprise_EaseOfAdmin.svg)
_EasiestAdmin_Mid-Market_EaseOfAdmin.svg)
_EasiestSetup_EaseOfSetup.svg)
_EasiestSetup_Mid-Market_EaseOfSetup.svg)
_EasiestToDoBusinessWith_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Enterprise_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Mid-Market_EaseOfDoingBusinessWith.svg)
_EasiestToUse_Enterprise_EaseOfUse.svg)
_EasiestToUse_Mid-Market_EaseOfUse.svg)
_FastestImplementation_Mid-Market_GoLiveTime.svg)
_HighPerformer_Enterprise_HighPerformer.svg)
_HighPerformer_HighPerformer.svg)
_HighPerformer_Mid-Market_HighPerformer.svg)
_HighestUserAdoption_Mid-Market_Adoption.svg)
_MostImplementable_Mid-Market_Total.svg)
_UsersMostLikelyToRecommend_Mid-Market_Nps.svg)