EU AI Act Authorized Representative for GPAI Providers (Article 54)

The EU AI Act creates obligations for different actors depending on how AI is developed and placed on the market. If you are a provider of a general‑purpose AI model (GPAI) and your organization is established outside the EU, the Act requires appointing an authorised representative established in the Union before the model is placed on the EU market.^[1]

This directory is designed for teams that:

• Develop or provide a GPAI model (foundation model / general-purpose model) and intend to make it available to EU users or EU-based downstream providers;^[1]
• Need a reliable EU-based point of contact to handle AI Act communications and representation tasks (defined contractually);
• Want a clear, comparable quote for scope (rep-only vs. rep + compliance support), availability, and SLA.

Timing note: The AI Act entered into force on 1 Aug 2024 and applies in stages, including GPAI-related obligations from 2 Aug 2025 and broader application from 2 Aug 2026.^[2] If you are onboarding now, providers will typically ask about your expected EU launch date, model distribution method (API/weights), and planned downstream uses.

Important: Whether your model is "GPAI" under the Act and whether you fall under specific exemptions depends on facts and your distribution model. Use this guide to structure your RFQ, then validate applicability with counsel if needed.

An AI Act authorised representative is a legal/operational role defined by the Act and your contract. In practice, providers usually offer a base "rep-only" package plus optional compliance add-ons.

Typical core deliverables (rep-only):

• Appointment + written mandate defining representation scope, communications, and authority boundaries;
• EU establishment + contact point (registered entity/address) for designated communications;
• Availability and response SLA for regulator communications and urgent notices (e.g., 24–72 hours);
• Document handling procedures and secure channels for receiving, logging, and escalating requests;
• Escalation playbooks (who is contacted, when, and how, including after-hours rules).

Optional add-ons (often requested in RFQs):

• GPAI compliance readiness support (gap check against provider obligations and documentation expectations);
• Policy templates for internal governance (roles, decision logs, version control, release gates);
• Incident & complaint triage processes, including coordination for serious incidents and corrective actions;
• EU-facing operational support (language coverage, time zone coverage, stakeholder management).

What is usually excluded (unless explicitly added): acting as your legal counsel, making technical claims on your behalf, or assuming product liability. Your RFQ should clearly separate "representation" from "consulting/legal" so quotes remain comparable.

Most authorised representative providers price on a retainer basis, sometimes with tiered bands. The goal is to cover availability, secure communications, and predictable service levels.

• Scope: "Rep-only" tends to be lower cost than "rep + compliance advisory," which can include readiness assessments, policy work, and documentation support.
• Response SLA: Shorter SLAs (e.g., 24h) and after-hours escalation typically increase fees.
• Expected interaction volume: If you anticipate frequent EU stakeholder engagement (multiple business units, multiple release trains), providers may price higher.
• Complexity of your distribution model: API-only vs. weights distribution, number of downstream integrators, and the number of internal owners/providers can affect onboarding effort.
• Languages/time zones: Multi-language support and broader coverage windows can increase cost.
• Risk posture: Some providers price based on perceived operational risk and the need for stronger monitoring and escalation processes.

How to interpret quotes: Ask providers to itemize (a) appointment + setup, (b) ongoing monthly/annual retainer, (c) included response hours/incidents, and (d) overage rules. This makes comparing providers much easier.

Tip: If you want predictable pricing, include "launch date," "distribution model," and "desired SLA" in the RFQ so providers quote accurately on the first pass.

Choose providers like you would choose a compliance-critical outsourcing partner: verify the legal foundation, then test operational reliability.

• EU establishment: Confirm the representative is established in the Union and can contract as the authorised representative for your organization.^[1]
• Scope clarity: Ensure the contract explicitly states what the representative will do (and won't do), including communications handling and escalation boundaries.
• Security & confidentiality: Ask about secure channels, access control, retention, and incident handling for sensitive model information.
• Response SLAs: Validate response commitments for regulator communication and urgent notices (business hours vs. 24/7).
• Operational fit: Time zones, language support, and ability to work with your legal/compliance and engineering teams.
• References & domain experience: Look for experience in AI governance, platform compliance, and regulated communications.
• Exit plan: Ask how transition to a new representative works (handover of logs, contacts, and notices).

Red flags: vague SLAs, no clear security posture, "we'll be your lawyer," or promises that sound like guaranteed regulatory outcomes.

1. Scoping call (1–3 days): confirm whether you are a GPAI provider, your EU launch timing, and your distribution model.
2. Due diligence (3–10 days): provider checks your entity info, points of contact, and risk posture; you review their EU establishment and security.
3. Contract + mandate (3–14 days): finalize appointment letter/mandate and escalation procedures.
4. Go-live: representative contact details are ready; secure channels are set; response SLAs start.

Staged applicability: The AI Act applies in stages; providers will ask about your timing to align onboarding with obligations that apply to your situation.^[2]