Your EU Authorised Representative under the EU AI Act.

If your AI system is listed under Annex III of the EU AI Act (biometrics, credit scoring, HR, critical infrastructure, migration, justice, education, law enforcement) and you are established outside the EU, Article 22 applies. If you provide a general-purpose AI model — large language models, foundation models, text-to-image or text-to-video models — and you are established outside the EU, Article 54 applies. The two regimes can also apply concurrently.

Legally yes, but only if the subsidiary's independence is credible, it has the operational capacity to fulfil regulatory obligations, and the mandate is formally documented. The Authorised Representative must terminate the mandate where the provider breaches its obligations under the Act — a duty that structurally dependent entities frequently cannot exercise. For most providers, an independent representative is the safer and more credible choice.

The Act requires the Authorised Representative to terminate where the provider acts contrary to its obligations and to inform the relevant authority. We address this in the mandate itself: clear escalation procedure, written notice, transition period, and assistance in identifying a successor representative. The duty exists by law; our role is to make the worst case orderly, not adversarial.

2 August 2025: Article 54 GPAI obligations entered into force for new models. 2 August 2026: the EU AI Office obtains full enforcement powers, including the ability to request information, mandate mitigations, and impose fines. 2 August 2027: GPAI models placed on the market before August 2025 must be in compliance; high-risk AI systems under Annex III must comply.

No. The Authorised Representative is the regulatory contact point under Articles 22 and 54. It is a critical statutory role — but it is not a substitute for your internal AI governance, your conformity assessment, your risk management system, or your post-market monitoring plan. SecureFound can map the full picture for you through our partnership with Lexara Advisory.

Across the entire European Union — all 27 Member States. Article 22 of Regulation (EU) 2024/1689 requires the appointment of "an authorised representative which is established in the Union", not one per Member State. A single Authorised Representative, established in any EU Member State, covers the whole Union market. This mirrors the long-established Article 27 GDPR regime in force since 2018. SecureFound is established in Spain — placing AESIA (the Spanish Agency for the Supervision of Artificial Intelligence) as our coordinating "home" authority — but we represent providers before any national market surveillance authority across the Union, and before the EU AI Office in Brussels.

They contact SecureFound. As your sole Authorised Representative in the Union, we are the addressable contact point for every national market surveillance authority across the 27 Member States — and there are approximately 2,000 of them under the AI Act. We receive their communications, coordinate the response with you, produce the required documentation, and engage with the authority directly or through AESIA depending on the procedure involved. You appoint one representative; you cover one Union.