AI Act and GDPR representatives for companies outside the EU

The supplier's legal and product teams should first record which entity develops, commissions, brands and supplies each product. A provider can commission development and supply the result under its own name. Buying an upstream model and integrating it into a branded application can make the business the system provider without making it the provider of that underlying model. Record both layers. (AI Act, Art 3(3), (63), (68).)

Keep evidence of intended purpose, technical functions, EU distribution, release dates and subsequent changes. These facts determine the relevant classification and transition. The broader classification process is covered in EU market access for AI systems and models.

The privacy team needs a separate map of training, inference, customer accounts, support and telemetry. For each activity, identify who determines purposes and means, who processes on instructions, where establishments operate and where affected people are located. An AI Act provider may act as a GDPR controller for one activity and a processor for another. Contract labels must match those functions. (GDPR, Arts 3, 4(7)–(8), 28(10).)

An EU subsidiary's incorporation alone does not establish that it supplies the product or conducts the relevant processing. A representative's appointment also does not itself create the supplier's EU establishment for GDPR Article 3(1). (AI Act, Art 3(3), (5); GDPR, Art 3; EDPB Guidelines 3/2018, sections 1(a)–(b), 4.)

The provider should use this decision path for every system and model.

1. Establish the EU connection and test exclusions. EU market supply is a direct connection; use of a system's output in the EU can also bring foreign activity within scope. The specific appointment provisions still require their own conditions. Research, military and other exclusions apply only within their statutory boundaries. (AI Act, Art 2.)
2. For a system, determine whether Article 22 applies. It concerns third-country providers of high-risk systems before making them available on the EU market. A chatbot or another system subject only to transparency duties does not acquire an Article 22 appointment requirement through Article 50. Open-source publication does not exempt a high-risk system from Article 22. (AI Act, Arts 2(12), 6, 22, 50.)
3. For a general-purpose AI model, apply Article 54 independently. The third-country provider must appoint an EU-established representative by written mandate before EU market placement, unless the Article 54(6) exception applies. A downstream integrator's appointment does not fulfil the upstream model provider's duty. (AI Act, Arts 3(3), 54.)
4. Apply the correct commencement and transition rules, then record the appointment deadline and responsible entity. (AI Act, Arts 111, 113.)

For Article 22, Annex III covers specified uses, including recruitment and candidate evaluation. Article 6(3) can exclude certain limited tasks from high-risk classification, but the exception has conditions and does not cover Annex III systems that profile natural persons. A documented assessment is required where the provider relies on that exception. (AI Act, Art 6(2)–(4); Annex III, point 4(a).)

The product route requires both the Article 6(1) product or safety-component condition and the specified third-party conformity-assessment condition. Article 2(2) limits direct application for Annex I Section B systems, so Article 22 cannot simply be imposed on every regulated-product system. Machinery now falls within Section B. For Section A systems, check any applicable limitations adopted under Article 2(13). (AI Act, Arts 2(2), (13), 6(1)–(1c); Annex I; Regulation (EU) 2026/1744, Art 1(41).)

The July 2026 amendment moved Chapter III, Sections 1–3, including Article 22 but excluding Article 6(5), to 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) systems. Consequently, Article 22 is not a present appointment duty on 29 October 2026 merely because a system is high-risk. Other applicable AI Act duties and sectoral representation requirements need separate assessment. A product meeting both classification routes needs its overlap resolved before relying on the later date. (AI Act, Art 113(c); Regulation (EU) 2026/1744, Art 1(40).)

Real-world testing has a separate representation condition that already applies. For covered pre-market testing outside an AI regulatory sandbox, a provider or prospective provider must be established in the EU or appoint an EU legal representative. This applies under Article 60 and through the national testing frameworks permitted by Article 60a. That testing role is distinct from the Article 22 authorised representative; the later Article 22 dates do not remove it. (AI Act, Arts 60(1)–(4), 60a(1)–(5), 113.)

Existing high-risk systems require an Article 111 review. Subject to its exceptions, systems placed on the market or put into service before the relevant Chapter III date enter the regime only if their designs undergo significant changes from that date. High-risk systems intended for public-authority use must comply by 2 August 2030; specified Annex X large-scale IT components have a separate transition. Record release and change evidence before claiming legacy treatment. (AI Act, Art 111(1)–(2), as amended.)

Article 54 follows a different calendar. Chapter V has applied since 2 August 2025. A provider of a model placed on the market before that date has until 2 August 2027 to comply. A newly marketed model cannot borrow that transition simply because its developer already sells an older model. (AI Act, Arts 111(3), 113(b).)

The model exemption requires a free and open-source licence permitting access, use, modification and distribution. Model parameters, including weights, architecture information and usage information must also be publicly available. Systemic-risk models cannot use the exemption. Retain the actual licence and publication evidence; an “open” marketing description is insufficient. Other model obligations, including copyright policy and training-content transparency, can remain. (AI Act, Arts 53(1)(c)–(d), 53(2), 54(6).)

The resulting record should state the legal basis for appointment, exemption or later applicability, and link it to the relevant product version.

The controller or processor should run this separate decision path, even when the AI Act requires no representative.

1. Identify personal-data processing. Examine the model and its surrounding operations. An anonymous-model assessment does not dispose of identifiable prompts, account records or support tickets. An AI model trained on personal data is not automatically anonymous; the assessment must consider whether personal data can be obtained from it using reasonably likely means. (GDPR, Art 4(1), recital 26; EDPB Opinion 28/2024, paras 29–45.)
2. Test establishment. Article 3(1) covers processing in the context of an EU establishment's activities, wherever processing occurs. Establishment depends on actual activities and stable arrangements, not incorporation alone. Article 27 is tied to Article 3(2), so application of Article 3(1) does not itself require a representative. (GDPR, Arts 3(1), 27(1); EDPB Guidelines 3/2018, section 1.)
3. For a controller or processor without an EU establishment, test Article 3(2). The processing must relate to offering goods or services to people in the EU, whether paid or free, or monitoring their behaviour within the EU. The test concerns their location and the relevant activity, rather than citizenship. An accessible website or an EU corporate customer alone does not establish every element. Assess a processor's activities separately from its customer's. (GDPR, Art 3(2); EDPB Guidelines 3/2018, section 2.)
4. If Article 3(2) applies, test Article 27(2). Without an applicable exemption, designate the representative in writing when undertaking the covered processing. GDPR provides no AI Act-style transition for that appointment. (GDPR, Arts 27, 99(2).)

The occasional-processing exemption requires all three conditions:

• Processing is occasional.
• It does not include large-scale processing of Article 9 special-category data or Article 10 criminal-conviction and offence data.
• Considering its nature, context, scope and purposes, it is unlikely to result in a risk to individuals' rights and freedoms.

Failure of any condition defeats this exemption. The risk condition is not confined to high risk. The EDPB treats processing as occasional only where it is irregular and outside the ordinary course of business. Routine inference, ongoing user profiling or recurring customer-data processing therefore cannot rely on occasionality merely because the business is small. Public authorities and bodies have a separate exemption, whose status requires examination under the relevant national law. (GDPR, Art 27(2); EDPB Guidelines 3/2018, section 4(b), pp 25–26.)

The GDPR representative must be established in a Member State where the relevant affected people are located. The AI Act permits establishment in the Union without this additional location connection. A combined appointment must satisfy the stricter GDPR location requirement. Selecting that location does not give the supplier a GDPR main establishment or access to the one-stop-shop mechanism. (GDPR, Arts 27(3), 56; EDPB Guidelines 3/2018, sections 1, 4(c).)

Record the territorial assessment and any exemption evidence. The wider data-protection assessment for AI should separately address lawful processing, rights, security and international transfers. A representative's mandate supplies none of those permissions. (GDPR, Arts 5–6, 12–22, 32, 44–49.)

For a high-risk system, the Article 22 mandate must empower the representative to verify that the EU declaration and technical documentation exist and that the provider completed the appropriate conformity assessment. The representative must retain the prescribed provider details, declaration, technical documentation and applicable notified-body certificate for ten years after market placement or putting into service. It must answer reasoned requests, including for relevant logs under the provider's control, cooperate with authorities and perform the specified registration task or verify the representative information where the provider registers. On request, it must provide the market-surveillance authority with a copy of the mandate in an official EU language specified by the authority. The mandate must allow competent authorities to address the representative in addition to or instead of the provider on compliance matters. (AI Act, Art 22(2)–(3).)

For a general-purpose model, Article 54 requires verification of the Annex XI documentation and the provider's Article 53 obligations, together with Article 55 where applicable. The representative keeps the Annex XI documentation and provider contact details available for ten years after market placement. Its mandate must support information requests and cooperation with the AI Office and competent authorities, including where the model is integrated into EU systems. Article 54 does not impose the system's CE-marking package. On request, the representative must give the AI Office a copy of the mandate in an official EU language. The mandate must allow the AI Office or competent authorities to address the representative in addition to or instead of the provider on compliance matters. (AI Act, Art 54(2)–(4).)

Both AI Act appointments need an accepted written mandate and operational support from the provider. Under Article 22, the representative must terminate if it considers, or has reason to consider, that the provider acts contrary to its obligations. It must immediately notify the relevant market-surveillance authority and, where applicable, the notified body of the termination and its reasons. Article 54 requires termination on the equivalent ground and immediate notification to the AI Office of the termination and its reasons. A contractual cure period must not prevent these duties. (AI Act, Arts 3(5), 22(4), 54(5).)

The GDPR mandate must allow supervisory authorities and data subjects to address the representative on processing-compliance matters, in addition to or instead of the supplier. Applicable Article 30 records must remain available and current; the representative must cooperate under Article 31. The supplier should appoint a records owner and provide updates, while the representative must be able to produce the records. Controllers must disclose the representative's identity and contact details where Articles 13 and 14 require them. (GDPR, Arts 13(1)(a), 14(1)(a), 27(4), 30–31; EDPB Guidelines 3/2018, section 4(d).)

Articles 27 and 30 contain no universal ten-year retention period or equivalent AI Act termination-and-notification rule. Agree retention, handover, replacement and pending-request arrangements that preserve compliance throughout the change. Assess any Article 30(5) records exemption separately from the Article 27 appointment exemption.

These duties require usable documents and responsive personnel. Specify secure access, version control, translations, escalation contacts and arrangements after contract termination. Protect confidential information without preventing lawful disclosure to authorities. Where access involves personal data, establish the applicable security and transfer arrangements. (AI Act, Arts 22, 54, 78; GDPR, Arts 5(1)(f), 32, 44–49.)

The same EU service provider can potentially accept both mandates. Neither appointment provision generally requires different organisations. Confirm the legal entity, eligible establishment, staff competence, language coverage, record access and capacity to respond. The contract should distinguish Article 22, Article 54 and GDPR Article 27 functions wherever applicable. Separate schedules can do this within one agreement; two separate contracts are not a statutory requirement. (AI Act, Arts 3(5), 22, 54; GDPR, Arts 4(17), 27.)

Conflicts need their own review. The EDPB considers the GDPR representative function incompatible with the external DPO role. It also considers a controller's representative role incompatible with acting as processor for that same controller. DPO autonomy and notified-body independence have separate statutory protections. A combined services proposal must therefore identify the actual functions and entities before acceptance. (GDPR, Art 38(3), (6); AI Act, Art 31(4)–(5); EDPB Guidelines 3/2018, section 4(a), pp 24–25.)

An importer or distributor remains responsible for its own supply-chain duties when those provisions apply. A DPO advises and monitors under Articles 37–39; it is not an automatic Article 27 representative. A mailbox, EU hosting contract or sales contact does not supply a statutory mandate or the required powers. (AI Act, Arts 3(5)–(7), 22–24, 54; GDPR, Arts 27, 37–39.)

The supplier remains responsible for its own compliance. GDPR Article 27(5) preserves actions against the controller or processor. The EDPB rejects substitutive liability while recognising enforcement through the representative and its direct obligations. AI representatives likewise have their own statutory duties; Article 99(4)(b) specifically addresses Article 22 breaches. Negotiate insurance, indemnities and liability limits as contractual protections, with enforceability checked under the chosen law. They do not amend the statutory allocation. (AI Act, Arts 16, 22, 53–55, 99; GDPR, Arts 27(5), 30–31, 58; EDPB Guidelines 3/2018, section 4(d), pp 27–28.)

Outcomes for different supply arrangements

A third-country provider offers its own recruitment platform directly to EU jobseekers and regularly processes their applications. Its candidate-ranking function falls within Annex III, point 4(a). Article 27 requires a GDPR representative because the service targets people in the EU and the processing is recurring. For a new release on or after 2 December 2027 within the full high-risk regime, Article 22 also requires an EU authorised representative before market availability. For an October 2026 release, record the later Article 22 date and assess the legacy-system rule before deciding its eventual application. (AI Act, Arts 6, 22, 111(2), 113(c); GDPR, Arts 3(2)(a), 27.)

A third-country provider places a new proprietary general-purpose model on the EU market. It uses non-personal training data, verifies that the model contains no personal data, and supplies it for offline corporate integration without receiving personal prompts or monitoring individuals. Article 54 requires an AI Act representative before placement. That model supply alone does not trigger Article 27; account, support and other processing still require separate Article 3 assessments. If the provider instead runs a recurring model service aimed at EU individuals and processes their personal prompts, both appointments are required unless a specific exemption applies. (AI Act, Art 54; GDPR, Arts 3, 27.)

A provider releasing a qualifying open-source model without systemic risk can rely on Article 54(6). If its related consumer service nevertheless involves recurring Article 3(2) processing, a GDPR representative remains necessary. If neither an AI Act appointment trigger nor an Article 27 trigger is met, neither appointment is required. Keep the facts supporting that result and reopen it when the licence, product, data use or market changes. (AI Act, Arts 22, 54(6); GDPR, Arts 3, 27.)

Documents needed before the appointment takes effect

The supplier's legal lead should assemble:

1. An entity, product and processing-scope record, with separate AI Act and GDPR decisions, release dates and exemption evidence.
2. Each required written mandate, identifying the appointing entity, representative, covered systems or models, processing scope and commencement date.
3. The applicable conformity or model documentation and a record-access schedule; for GDPR, the required processing records and representative contact disclosures.
4. A cooperation procedure covering authority requests, data-subject communications, document updates and escalation to responsible staff.
5. A service agreement addressing resources, confidentiality, conflicts, fees, liability, mandatory termination, replacement and continuing access.

The mandates and statutory records implement the legal duties described above. Operational procedures and commercial terms should make their performance possible. Before the relevant supply or processing starts, the accountable manager should confirm that required appointments are effective, records are accessible and the remaining product and data-processing conditions are satisfied. If a mandatory appointment is missing, complete it before undertaking the activity that requires it.

Licentium can review the supplying entities, product classification, data flows and proposed mandates, and identify the appointments, records and contract changes needed for EU supply. Assess representation requirements.