Most AI Act coverage is about conformity assessment. The obligation that actually stops a non-EU company at the border is simpler: before you place the system on the Union market, you need someone established in the Union who answers for it.
A company in San Francisco, Tel Aviv, London or Singapore builds an AI product, signs its first European customers and starts reading about the AI Act. Almost everything it finds is about risk classification, technical documentation and conformity assessment — work that is real, expensive and, for most companies, not the first thing that becomes due.
The first thing that becomes due is structural. The AI Act, like the rest of EU product law, is built on a simple premise: for anything placed on the Union market, there must be a person established in the Union who can be addressed by the authorities. If your company has no EU establishment, that person does not exist yet — and creating it is a corporate decision, not a compliance one.
Article 22 of the AI Act is short and unambiguous. Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative established in the Union. Not after the first sale. Not on request from a regulator. Before.
The mandate is not a formality either. Under Article 22 the representative is empowered and required to:
That single provision is what separates a real authorised representative from a mailbox service. A provider appointing a representative is appointing a party with an independent statutory obligation to walk away publicly if the provider does not hold up its end. Choose accordingly — and expect any serious representative to conduct real diligence before accepting the mandate.
Article 54 imposes the parallel requirement on providers of general-purpose AI models established outside the Union: appoint, by written mandate, an authorised representative established in the Union before placing the model on the EU market. Obligations for GPAI model providers have applied since 2 August 2025.
This is the part most companies have missed, because the public conversation has been dominated by the high-risk timetable. If you provide a general-purpose model into the EU from a third country, the representation requirement is not a 2027 problem. It is a current one.
In November 2025 the European Commission proposed a simplification package deferring the high-risk compliance dates. The European Parliament endorsed it in June 2026 and the Council gave final approval on 29 June 2026. The result is more time on one track and no change on the others.
| Obligation | Applies from | Status |
|---|---|---|
| Prohibited practices, AI literacy | 2 February 2025 | In force |
| GPAI model provider obligations, incl. EU representative | 2 August 2025 | In force |
| Governance, national authorities, penalties framework | 2 August 2025 onward | In force |
| High-risk — standalone systems (Annex III) | 2 December 2027 | Deferred |
| High-risk — AI in regulated products (Annex I) | 2 August 2028 | Deferred |
The deferral bought engineering time. It did not remove the requirement, and it did not touch the GPAI track. For a company whose EU market entry is a live commercial question, the useful reading is the opposite of relief: there is now a window in which the structural work can be done calmly, before the technical work becomes urgent. That window closes on its own.
The two instruments answer different questions. An authorised representative gives the authorities a party to address; it does not give the company a European balance sheet, a European bank account, a VAT number or the ability to contract as an EU counterparty. An EU subsidiary gives all of that — and, depending on how the product is placed on the market, may change which role the group occupies under the Act.
Which role a company occupies — provider, deployer, importer, distributor — is a question of fact, not of preference, and it drives everything downstream. Getting the role assignment wrong is the most common structural error, and it is the one that is most expensive to unwind after contracts are signed.
Member States were required to designate their national competent authorities — market surveillance and notifying — by 2 August 2025. Most did not. Reporting through early 2026 put the number of Member States that had designated both at around nine out of twenty-seven. For a company choosing where in the EU to establish, that is not a trivia point. It determines whether there is an authority to register with, ask, and be answered by.
Spain has also moved on the national implementing law. A Proyecto de Ley Organica on the good use and governance of AI — designating supervisory authorities and establishing a national penalty regime with fines reported up to €35 million or 7% of worldwide turnover for prohibited practices — was approved by the Council of Ministers on 26 May 2026 and is in parliamentary process. It is not yet in force, and anyone telling you otherwise is selling something. What matters commercially is the direction: Spain is building the enforcement architecture ahead of most of the Union, not behind it.
Ten years of technical documentation held at the disposal of authorities, a duty to cooperate on risk mitigation and a statutory obligation to terminate and report cannot be discharged by a mailbox and an email alias.
Written mandate, documented intake diligence, secure retention of the technical file, a named contact able to engage with market surveillance, and professional indemnity behind the role.
The same distinction runs the other way. A provider should expect a representative to ask hard questions before signing — about classification, documentation and conformity — because the representative is accepting a public obligation, not a subscription.
An EU entity takes weeks to incorporate and months to bank properly. A representation mandate requires a counterparty willing to accept statutory exposure. Neither is something to start in the quarter the deadline lands — and for GPAI providers, the deadline already has.