Article 22(3)-(4)
UpcomingConditional timingPerform Required High-Risk AI Authorised Representative Duties
Applies to Authorised Representative; High-Risk AI.
- Actors
- Authorised Representative
- AI class
- High-Risk AI
- Themes
- Third Parties & Supply ChainMonitoring, Reporting & Improvement
Tracker Guidance
If your organization acts as the authorised representative of a high-risk AI provider, perform the tasks in the written mandate, provide the mandate to market-surveillance authorities on request, carry out the verification, retention, information, cooperation and registration duties assigned by Article 22, and terminate the mandate with the required notifications if the provider is acting contrary to the Regulation.
Official text
3. The authorised representative shall perform the tasks specified in the mandate received from the provider. It shall provide a copy of the mandate to the market surveillance authorities upon request, in one of the official languages of the institutions of the Union, as indicated by the competent authority. For the purposes of this Regulation, the mandate shall empower the authorised representative to carry out the following tasks: (a) verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider; (b) keep at the disposal of the competent authorities and national authorities or bodies referred to in Article 74(10), for a period of 10 years after the high-risk AI system has been placed on the market or put into service, the contact details of the provider that appointed the authorised representative, a copy of the EU declaration of conformity referred to in Article 47, the technical documentation and, if applicable, the certificate issued by the notified body; (c) provide a competent authority, upon a reasoned request, with all the information and documentation, including that referred to in point (b) of this subparagraph, necessary to demonstrate the conformity of a high-risk AI system with the requirements set out in Section 2, including access to the logs, as referred to in Article 12(1), automatically generated by the high-risk AI system, to the extent such logs are under the control of the provider; [Excerpt - see official source for complete provision]
Excerpt stored at a complete legal-unit boundary. See the official source for the full provision.
Timing depends on the system
- 2 Dec 2027 — Article 6(2) / Annex III high-risk AI
- 2 Aug 2028 — Article 6(1) / Annex I Section A high-risk AI
- 2 Dec 2027 — Pre-existing Annex III high-risk AI type/model first placed on the market or put into service before 2027-12-02
- 2 Aug 2028 — Pre-existing Article 6(1) / Annex I high-risk AI type/model first placed on the market or put into service before 2028-08-02
- 2 Aug 2030 — Pre-existing high-risk AI intended to be used by public authorities
Sub-obligations
These are independently assessable parts of the parent requirement.
Article 22(3)(a)
UpcomingVerify Provider Conformity Documentation and Assessment
Tracker Guidance
Verify that the provider has drawn up the EU declaration of conformity and technical documentation and has completed the appropriate conformity assessment.
Official text
Article 22(3)(a)Official source (a) verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider;
Article 22(3)(b)
UpcomingRetain Required Provider and Conformity Documentation for Ten Years
Tracker Guidance
Keep the provider's contact details, a copy of the EU declaration of conformity, the technical documentation and any applicable notified-body certificate available to the specified authorities for 10 years after the high-risk AI system is placed on the market or put into service.
Official text
Article 22(3)(b)Official source (b) keep at the disposal of the competent authorities and national authorities or bodies referred to in Article 74(10), for a period of 10 years after the high-risk AI system has been placed on the market or put into service, the contact details of the provider that appointed the authorised representative, a copy of the EU declaration of conformity referred to in Article 47, the technical documentation and, if applicable, the certificate issued by the notified body;
Article 22(3)(c)-(d)
UpcomingProvide Compliance Information, Logs and Cooperation to Competent Authorities
Tracker Guidance
On a reasoned request, provide competent authorities with the information and documentation needed to demonstrate conformity, including access to automatically generated logs under the provider's control where applicable, and cooperate with authority actions intended to reduce or mitigate risk.
Official text
Article 22(3)(c)-(d)Official source (c) provide a competent authority, upon a reasoned request, with all the information and documentation, including that referred to in point (b) of this subparagraph, necessary to demonstrate the conformity of a high-risk AI system with the requirements set out in Section 2, including access to the logs, as referred to in Article 12(1), automatically generated by the high-risk AI system, to the extent such logs are under the control of the provider; (d) cooperate with competent authorities, upon a reasoned request, in any action the latter take in relation to the high-risk AI system, in particular to reduce and mitigate the risks posed by the high-risk AI system;
Article 22(3)(e)
UpcomingFulfil Applicable High-Risk AI Registration Duties as Authorised Representative
Tracker Guidance
Where Article 49(1) applies, complete the required registration duties or, if the provider performs the registration itself, verify the specified provider information required by Annex VIII.
Official text
Article 22(3)(e)Official source (e) where applicable, comply with the registration obligations referred to in Article 49(1), or, if the registration is carried out by the provider itself, ensure that the information referred to in point 3 of Section A of Annex VIII is correct. The mandate shall empower the authorised representative to be addressed, in addition to or instead of the provider, by the competent authorities, on all issues related to ensuring compliance with this Regulation.
Article 22(4)
UpcomingTerminate the Mandate and Notify Authorities if the Provider Is Non-Compliant
Tracker Guidance
Terminate the mandate if the authorised representative considers, or has reason to consider, that the provider is acting contrary to its AI Act obligations. Immediately inform the relevant market-surveillance authority and, where applicable, the notified body of the termination and reasons.
Official text
Article 22(4)Official source 4. The authorised representative shall terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations pursuant to this Regulation. In such a case, it shall immediately inform the relevant market surveillance authority, as well as, where applicable, the relevant notified body, about the termination of the mandate and the reasons therefor.