EU AI Act for non-EU companies

A provider established outside the EU that places a high-risk AI system on the EU market, or makes it available there, carries the full set of provider duties. These cover the design and data requirements, quality management, conformity assessment, the technical file and post-market monitoring. Before the system is made available, Article 22(1) requires a written mandate appointing an authorised representative established in the EU. The provider still owns the controls, and the representative must be able to verify the declaration, technical documentation and conformity assessment when asked.

• Written mandate: signed before the first EU availability, and specific enough to show the representative's powers.
• Mandate scope: verification of the declaration, documentation and conformity assessment, log access on request, cooperation with authorities and registration.
• Record retention: contact details, the declaration, documentation and any certificate kept for 10 years, available to the representative.
• Technical documentation: the Annex IV file, completed before market placement and updated as the system changes.
• Start dates: Annex III systems from 2 December 2027, and Annex I product systems from 2 August 2028, after the 2026 amendment.

Confirm which annex covers your system and whether a notified body is involved before you sign the mandate, because the representative can only verify a file that exists.

A non-EU provider that places a general-purpose AI model on the EU market falls under Chapter V rather than the high-risk rules. Article 54(1) requires an EU-established authorised representative, appointed by written mandate, before the model is placed on the EU market. The obligations for general-purpose models have applied since 2 August 2025, and the AI Office supervises them under Article 88. Models with systemic risk carry additional duties.

• Written mandate: appointed before the model is placed on the EU market, with the representative as the EU contact for the AI Office and national authorities.
• Model documentation: technical documentation kept current and available to the AI Office on request.
• Downstream information: the information that providers building on your model need to meet their own duties, shared under written terms.
• Systemic-risk tier: additional evaluation, risk assessment and incident duties if the model crosses the threshold in the Act.
• Code of practice: a route to show compliance that you can adopt or substitute with equivalent evidence.

Confirm with the AI Office or your counsel which fine tier applies to your model, because the Article 99 amounts differ by type of breach.

An importer is an EU-established person that places on the market an AI system bearing the name or trademark of a person established in a non-EU country. That role is defined in Article 3(6). Under Article 23(1), the importer must verify several items before a high-risk system is placed on the market. The importer does not design the system, but it cannot place it on the market without checking these items, so it needs a documented verification step before the first sale.

• Conformity assessment: confirm that the provider completed the assessment route that applies to the system.
• Technical documentation: confirm the Annex IV file exists and can be produced on request.
• CE marking and declaration: confirm the CE marking is affixed, and that the declaration and instructions accompany the system.
• Authorised representative: confirm the provider has appointed an EU authorised representative under Article 22.
• Verification record: keep dated evidence of each check, with the supplier contact who provided it.

Treat the checklist as a gate: if any item is missing, hold placement and ask the provider in writing for the missing item before the system reaches an EU customer.

A non-EU firm that deploys an AI system, and whose output is used in the EU, falls within the reach of the Act under Article 2(1). The deployer's duties depend on the risk tier of the system, not on where the deployer is established. The authorised representative requirement in Article 22 applies to providers, so a deployer does not need to appoint one for that reason. Deployers still need to meet the AI literacy duty, which applies from 2 February 2025, and the transparency duties where they apply.

• AI literacy: documented training for staff who operate or oversee AI systems, in place now.
• High-risk deployer duties: use in line with the provider's instructions, human oversight and monitoring, from 2 December 2027 for Annex III systems.
• Transparency duties: disclosure for chatbots, synthetic content and similar outputs under Article 50, subject to the transition period introduced in 2026.
• Instructions and logs: provider instructions for use and any logs the system generates, kept for the period the Act requires.
• Output tracking: a record of where AI output is used in the EU, so you can tell whether the Act reaches you.

Confirm which EU users and outputs fall in scope before you assume the Act does not reach your deployment, because the trigger is where the output is used.

Your company remains the legal owner of every compliance decision. As a non-EU provider, you are responsible for classifying each AI system, deciding its intended purpose, carrying out the conformity assessment route that applies, drawing up the EU declaration of conformity and affixing the CE marking where required. Those duties do not move to a consultant, a partner or a representative, even when they do much of the preparation work.

• Classification and scope: Decide which systems and general-purpose AI models reach the EU market or have output used in the EU under Article 2(1).
• Technical documentation: Own the Annex IV documentation, risk management records and the quality management system.
• Declaration and marking: Sign the declaration of conformity and take responsibility for the CE marking and instructions.
• Post-market duties: Run monitoring, incident handling and corrective actions after launch.
• Budget and approval: Approve the scope, the timeline and the people accountable for each control.

Before you engage anyone, confirm internally which named executive signs off on each high-risk system and where the evidence will be stored for the retention periods the Act sets.

An implementation partner such as DeployOpen helps prepare the systems, documentation and evidence that your company then reviews and owns. Work is usually scoped in writing before it starts. Where security testing is in scope, the partner can run it and report findings, but the decision on what to fix, accept or document stays with your company.

• Systems and logging: Configure the self-hosted platforms, access controls and logging that produce the records an assessor will ask for.
• Documentation support: Draft technical documentation, risk records and test reports for your review and sign-off.
• Security testing: Run application, infrastructure and AI system testing where the scope includes it.
• Handover: Deliver the evidence in a form your internal team and your representative can maintain.
• Limits: The partner does not issue audit reports, attestations, certificates or declarations of conformity.

When you ask for a quote, confirm which documents the partner will draft, which ones only your team may sign, and who keeps the evidence after the engagement ends.

Article 22(1) requires a non-EU provider to appoint an EU-established authorised representative by written mandate before making a high-risk system available on the EU market. Article 54(1) imposes the same requirement for a general-purpose AI model. The representative acts as the EU point of contact for authorities and holds specific legal duties under the mandate, but it does not take over your technical compliance work.

• Verification: The mandate must empower the representative to verify the declaration, technical documentation and conformity assessment.
• Record keeping: Keep contact details, the declaration, documentation and any certificate for 10 years, as set out in Article 22(3).
• Information and access: Provide information and log access to authorities on request.
• Cooperation and registration: Cooperate with market surveillance authorities and handle registration.
• Mandate terms: Confirm in writing what the representative will do, what it will not do, and how fees and liability are handled.

Ask the representative to show its internal process for receiving authority requests, and confirm that the mandate is signed before the system is placed on the market.

An independent auditor or notified body is the only party that issues a conformity assessment result or certificate where the Act requires third-party involvement. Most Annex III high-risk systems use internal control under Annex VI, so the company itself carries out the assessment and no external certificate is issued. Notified bodies are involved for some biometric systems and Annex I product systems under Article 43. Independence means the assessor cannot design, build or sign the controls it reviews.

• Independence: The assessor must be separate from the teams that prepared the evidence.
• Scope of role: It tests the system and documentation against the requirements and issues its own findings or certificate.
• Outsourcing limit: Outsourcing preparation work is permitted, but a report cannot be produced by the party that wrote the controls.
• Routes: Confirm with your counsel whether internal control or a notified body route applies to each system.
• Standards: Check whether a harmonised standard, such as the one cited for quality management, is relevant to the system.

Before you engage an assessor, confirm its accreditation or designation status for the route you need and document how the independence boundary is kept.