Why “we have no EU entity” is not a defence
The EU AI Act does not ask where your company is incorporated. It asks where your AI is placed on the market and where its output is used. A company in San Francisco, London or Singapore with no European office, no European subsidiary and no European employees can be squarely within scope, and can be required to appoint a legal representative inside the Union before it may lawfully sell.
This is familiar territory for anyone who lived through the GDPR, but the AI Act’s version is stricter in one respect and looser in another, and the two regimes are not interchangeable. A GDPR Article 27 representative is not an AI Act authorised representative.
The two ways the Act reaches a business outside the EU
Placing on the Union market
Article 2(1)(a) applies the Regulation to providers placing AI systems on the market or putting them into service in the Union, and to providers placing general-purpose AI models on the Union market, irrespective of whether those providers are established or located within the Union or in a third country. That is the primary hook and it is deliberately blunt. If European customers can buy it, you are a provider under the Act.
When the output is used in the Union
Article 2(1)(c) is the limb that catches people who are certain they are outside scope. It applies the Regulation to providers and deployers of AI systems established in a third country where the output produced by the AI system is used in the Union.
Three points of precision, because this is the most misread provision in the Act. First, it is an independent hook — Article 2(1)(a) already covers anyone placing on the EU market, so limb (c) exists precisely for the case where there is no EU placing on the market at all. Second, it requires both the provider and the deployer to be in a third country; where the deployer is in the Union, a different limb applies. Third, the trigger is the output being used in the Union — not where the data subject sits, not where the processing happens, and not mere incidental availability.
The textbook case: a company outside the EU runs a CV-screening model on its own infrastructure, and the resulting rankings are used to make hiring decisions about roles based in Europe. Nothing was sold into the EU. The Act still applies.
What falls outside
Article 2 carves out several things. Systems placed on the market, put into service or used exclusively for military, defence or national security purposes are excluded, and so is output used in the Union exclusively for those purposes. AI systems and models developed and put into service for the sole purpose of scientific research and development are excluded, as is research, testing and development activity prior to placing on the market — though testing in real-world conditions is expressly not covered by that exclusion. Deployer obligations do not apply to natural persons using AI in a purely personal, non-professional activity.
There is also a free and open-source carve-out in Article 2(12), but it collapses the moment a system is placed on the market as high-risk, or falls under Article 5 or Article 50.
The authorised representative
For high-risk AI systems: Article 22
Article 22(1) requires that, prior to making their high-risk AI systems available on the Union market, providers established in third countries appoint by written mandate an authorised representative established in the Union. Three elements are hard requirements: the appointment must come before market availability, the mandate must be written, and the representative must be established in the Union.
Article 22(3) sets out what the mandate must empower the representative to do: verify that the EU declaration of conformity and the technical documentation have been drawn up and that an appropriate conformity assessment has been carried out; keep the provider’s contact details, the declaration of conformity, the technical documentation and any notified body certificate at the disposal of authorities for ten years after the system is placed on the market or put into service; provide authorities on reasoned request with the information needed to demonstrate conformity, including access to the automatically generated logs to the extent they are under the provider’s control; cooperate with authorities in any action they take, particularly to reduce and mitigate risks; and comply with the registration obligations where applicable.
The mandate also allows authorities to address the representative in addition to, or instead of, the provider.
For general-purpose AI models: Article 54
A parallel and, for many businesses, more urgent regime applies to models. Article 54 requires providers of general-purpose AI models established in third countries to appoint an EU authorised representative by written mandate before placing the model on the Union market. The representative verifies that the technical documentation has been drawn up and that the Article 53 obligations, and where applicable Article 55, have been met; keeps that documentation available for ten years; provides information to the AI Office on reasoned request; and cooperates with the AI Office and competent authorities, including where the model has been integrated into systems placed on the market in the Union.
Article 54(6) exempts providers of models released under a free and open-source licence that allows access, use, modification and distribution, and whose parameters — including weights, architecture information and model usage information — are publicly available. That exemption does not apply to models presenting systemic risk. An open-weights frontier model still needs an EU representative.
The termination duty that changes the commercial deal
Both regimes contain a provision that businesses consistently underestimate. The authorised representative shall terminate the mandate if it considers, or has reason to consider, that the provider is acting contrary to its obligations — and must immediately inform the market surveillance authority, or in the case of models the AI Office, about the termination and the reasons for it.
That is a duty, not a discretion, and it is coupled with a mandatory report to the regulator. Your representative is not simply your agent. It is a regulated person with its own exposure and a legal obligation to resign and report you. This is why serious representative services negotiate hard on information rights, audit access and indemnities, and why appointing a thinly resourced shell is a poor idea in both directions.
Your EU counterparties carry duties too
Article 23 requires importers, before placing a high-risk system on the market, to verify that the conformity assessment has been carried out, that the technical documentation exists, that the system bears the CE marking and is accompanied by the declaration of conformity and instructions for use, and — critically — that the provider has appointed an authorised representative.
That last check is the enforcement hinge. A missing representative is something your European importer is legally required to detect. If it proceeds anyway, it commits its own infringement. Article 24 imposes narrower verification duties on distributors. And under Article 25, an importer or distributor that puts its own name on the system, changes its intended purpose or substantially modifies it becomes the provider outright.
What applies now and what is deferred
The timing asymmetry here is the single most important thing for a non-EU business to grasp, because the Digital Omnibus on AI, Regulation (EU) 2026/1744, did not treat models and systems alike.
Article 54, for general-purpose AI models, has been in force since 2 August 2025. It was not deferred. Models placed on the Union market before that date have until 2 August 2027 to comply, but anything launched since needed its representative from day one.
Article 22, for high-risk systems, sits in Chapter III and was deferred — to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for high-risk AI embedded in regulated products under Annex I.
Article 50 transparency applied from 2 August 2026 and binds non-EU providers on the same scope hooks. Systems already on the market before that date have a transitional period for machine-readable marking of synthetic content.
Two further changes are worth checking if you make regulated products. The Omnibus rewrote Article 2(2) so that, for high-risk AI relating to products under Annex I Section B — aviation, rail, motor vehicles, marine equipment — only a narrow set of provisions applies. And a new Article 2(13) allows the Commission, by delegated act due by 2 August 2027, to limit specific requirements in Articles 9 to 15 and 17 to 25 for Annex I Section A products where sectoral law already provides equivalent protection. Article 22 sits inside that range. Nothing has been adopted yet, so treat the duty as fully live.
Practical example
A US software company sells a workforce analytics platform to European employers and also publishes a general-purpose model that other developers build on. It has no EU entity and assumes its December 2027 date covers everything.
It does not. The model obligation under Article 54 has applied since August 2025, so the company is already late unless it qualifies for the open-source exemption — and if the model crosses the systemic risk threshold, that exemption is unavailable regardless of licence. Its customer-facing interface generates AI text, so Article 50 has applied since August 2026. Only the high-risk system duties, including the Article 22 representative, wait until December 2027.
Meanwhile its German reseller is an importer and cannot lawfully place the high-risk product on the market once Article 22 bites without verifying the representative exists. The commercial relationship breaks before the regulator ever appears.
Common mistakes companies make
The first is assuming no EU entity means no EU obligations. Article 2 is drafted precisely to defeat that assumption.
The second is treating the output test as an effects test. It is narrower than people fear in one way — it requires both provider and deployer to be in a third country — and broader in another, because it does not care whether you sold anything into Europe.
The third is assuming everything was deferred to 2027. The model representative duty has been live since August 2025 and transparency since August 2026.
The fourth is reusing a GDPR Article 27 representative and assuming it covers the AI Act. Different duties, different documentation, different retention, different liability. You may well need both, and they need not be the same entity.
The fifth is appointing a representative without giving it the means to function. Article 22(2) requires you to enable it to perform its tasks, and a representative that cannot get documentation from you is a representative under a legal duty to resign and report.
Recommended actions
Start by classifying what you actually ship. Model or system, and if a system, high-risk or not. The answer determines whether your clock started in 2025 or starts in 2027, and businesses get this wrong in both directions.
If you place a general-purpose AI model on the Union market, resolve the Article 54 position now rather than treating it as future work. Test the open-source exemption against all four licence conditions rather than the word “open”, and check the systemic risk threshold separately.
Run the output test honestly across your customer base, including customers who never appear in your European revenue line. Then confirm your Article 50 position, which is live today.
When you appoint a representative, paper it properly: a written mandate covering every statutory task, an entity genuinely established in the Union with the capacity to hold a ten-year file, and contractual machinery for getting documentation to it. Build that file now — technical documentation, declaration of conformity, conformity assessment records, logs — because the representative must produce it on reasoned request, and assembling it retrospectively is far more expensive.
Frequently asked questions
Can our EU distributor act as our authorised representative?
There is no prohibition on the same entity holding both roles, provided it is established in the Union and the mandate is written and covers the statutory tasks. But think carefully about the incentives. The representative has a legal duty to terminate and report you to the regulator if it has reason to consider you non-compliant, which is an uncomfortable obligation to place on your commercial partner. Many providers separate the two deliberately.
We only serve model access through an API from outside the EU. Are we in scope?
Very likely yes. Making a general-purpose AI model available to users in the Union is generally treated as placing it on the Union market, which engages Article 2(1)(a) and the Article 54 representative duty regardless of where your servers sit. Note that the output-based limb in Article 2(1)(c) covers AI systems rather than models, so it does not help you here.
What are the penalties for not appointing a representative?
Failure to comply with the obligations on authorised representatives, importers or distributors carries fines of up to EUR 15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For general-purpose AI models the Commission has its own enforcement powers with a comparable ceiling. In practice, the sharper consequence for a company with no EU assets is market withdrawal and the fact that European importers cannot lawfully deal with you.
Conclusion
The EU AI Act reaches businesses that have never set foot in Europe, through placing on the market and through the narrower but often overlooked test of output used in the Union. Where it reaches you, it generally requires a written mandate appointing a representative established in the Union — already in force for general-purpose AI models since August 2025, and arriving for high-risk systems in December 2027. That representative holds a ten-year file, answers to regulators alongside you, and is legally obliged to resign and report if it believes you are non-compliant. Lawgent helps non-EU businesses assess whether the AI Act applies to them, appoint and paper authorised representatives properly, and enter the European market without inheriting avoidable regulatory exposure.
