EU AI Act Authorised Representative — Articles 54 & 22

Article 54: providers of general-purpose AI models

Prior to placing a general-purpose AI model on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union (Article 54(1) AI Act). A general-purpose AI model is a model that displays significant generality and is capable of competently performing a wide range of distinct tasks, and that can be integrated into a variety of downstream systems or applications (Article 3(63) AI Act). Article 54(6) carves out certain free and open-source models — see below.

Does the open-source exemption (Article 54(6)) apply to my model?

Only if the whole of it fits. Article 54(6) AI Act exempts providers of general-purpose AI models released under a free and open-source licence that allows access, usage, modification and distribution of the model, and whose parameters — including the weights, the information on the model architecture and the information on model usage — are made publicly available, unless the model presents a systemic risk. Three checks, in this order:

• Licence: does it really allow access, usage, modification and distribution? A licence that carves out redistribution does not. Article 54(6) does not use the word “commercial”; that a carve-out for commercial use also takes the model out of the exemption follows from Recitals 102 and 103 AI Act (free sharing; no component “provided against a price or otherwise monetised”) — an interpretation, not the wording of the provision.
• Publication: are weights, architecture information and usage information publicly available — not merely described in a paper or handed out on request?
• Systemic risk: does the model fall under Article 51? If it does, the exemption falls away whatever the licence says.

A “no” to any of the three puts you back inside Article 54(1). Which of the three is the close call in your case is a legal assessment — the law firm Theo Funk advises on it under a separate mandate.

When the duties apply

• 2 Aug 2025

  Article 54 already applies — the general-purpose AI chapter has applied since 2 August 2025. For GPAI models placed on the market before that date, providers have until 2 August 2027 to comply (Article 111(3) AI Act).

• 2 Dec 2027

  Article 22 will apply to high-risk AI systems listed in Annex III — Regulation (EU) 2026/1744 (OJ 24 July 2026, in force 27 July 2026) postponed Chapter III, Sections 1 to 3, of the AI Act.

• 2 Aug 2028

  Article 22 will apply to high-risk AI systems under Article 6(1) — products covered by Annex I.

Article 22 is not yet in application: Regulation (EU) 2026/1744 postponed Chapter III, Sections 1 to 3, of the AI Act. From 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems), providers established in third countries will have to appoint, by written mandate, an authorised representative established in the Union before making their high-risk AI systems available on the Union market (Article 22(1) AI Act).

Whether a system is high-risk follows from the classification rules of Article 6: AI systems that are safety components of — or are themselves — products covered by the Union harmonisation legislation listed in Annex I (Article 6(1)), and the stand-alone use cases listed in Annex III (Article 6(2)), from biometrics to employment, credit and law enforcement.

The mandate under Article 22(3) will cover five tasks:

• (a) Verify that the EU declaration of conformity (Article 47) and the technical documentation (Article 11) have been drawn up and that the provider has carried out an appropriate conformity assessment procedure
• (b) Keep both, with the provider’s contact details and, where applicable, the notified body’s certificate, at the disposal of the competent authorities and the national authorities or bodies referred to in Article 74(10) for ten years after the system is placed on the market or put into service
• (c) Provide a competent authority, upon reasoned request, with the information and documentation needed to demonstrate conformity, including access to the automatically generated logs (Article 12(1)) to the extent they are under the provider’s control
• (d) Cooperate with the competent authorities, upon a reasoned request, in any action they take in relation to the system
• (e) Where applicable, comply with the registration obligations of Article 49(1) — or, if the provider registers itself, ensure that the information referred to in Annex VIII, Section A, point 3 is correct

The role will carry its own exposure. Under Article 99(4)(b) AI Act, non-compliance with the obligations of authorised representatives under Article 22 will be subject to administrative fines of up to €15,000,000 or, for an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher — for SMEs and start-ups it is the lower of the two figures that applies (Article 99(6)), and the same holds for small mid-cap enterprises under Article 99(6a) as inserted by Regulation (EU) 2026/1744. The representative is an addressee of the Regulation, not a mailbox: that is precisely why the mandate has to come with the documents, the access and the response times that make the task catalogue performable.

From 2 December 2027 or 2 August 2028 respectively, Article 22(4) adds an exit path that mirrors Article 54(5): the representative must terminate the mandate if it considers or has reason to consider that the provider is acting contrary to its obligations, and immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body about the termination and the reasons.