Skip to content

    EU AI Act · Articles 22 & 49

    Your roadmap to Article 22 & Article 49 readiness

    High-risk AI obligations apply from 2 December 2027 — 412 days from today. Work through the five steps below in order to appoint your EU Authorised Representative and complete your EU database registration.

    Where the AI Act stands today

    Feb 2025

    Prohibited AI practices in force

    Aug 2025

    GPAI model obligations apply

    Aug 2026 · today

    GPAI enforcement & fines begin

    Dec 2027

    Article 22 representative required (high-risk systems)

    The five steps

    Step 1 · Now · Articles 6 & 9, Annex III

    Classify your AI systems

    Establish, in writing, whether any system you place on the EU market is high-risk — this determines whether Articles 22 and 49 apply to you at all.

    • Inventory every AI system and AI-enabled feature you sell into, or operate in, the EU.
    • Assess each against the prohibited practices list and the Annex III high-risk use cases.
    • Record the classification decision and rationale for each system — regulators will ask for it.
    • Confirm your role for each system: provider, deployer, importer, or distributor.

    Step 2 · Now – Q2 2027 · Article 22(1)

    Appoint your EU Authorised Representative

    Non-EU providers of high-risk AI systems must have an EU-established Authorised Representative in place before the system is placed on the EU market.

    • Select an EU-established representative with AI Act competence and a registered EU address.
    • Agree scope: documentation custody, authority liaison, registration upkeep, and record retention.
    • Publish the representative's details in your instructions for use and technical documentation.
    • Ensure the representative can terminate the mandate if you act contrary to your obligations — and that you have a continuity plan if they do.

    Step 3 · Immediately after appointment · Article 22(3)

    Issue the written mandate

    The representative's tasks must be fixed in a written mandate — without it, the appointment does not satisfy Article 22.

    • Draft a mandate listing each task the representative performs on your behalf.
    • Include verification of the EU declaration of conformity and technical documentation.
    • Commit to keeping documentation available to authorities for 10 years after the system is placed on the market.
    • Cover cooperation with national competent authorities on requests, corrective actions, and incident reporting.

    Step 4 · Before market placement · Article 49, Annex VIII

    Register in the EU database

    High-risk systems and the representative's details must be registered in the EU database before the system is placed on the market or put into service.

    • Assemble your Annex VIII dataset: provider details, representative details, system description and intended purpose.
    • Record conformity status, the conformity assessment route used, and the Member States where the system is or will be available.
    • Attach the EU declaration of conformity and instructions for use as required.
    • Complete the registration entry and store the confirmation with your technical documentation.

    Step 5 · Ongoing · Articles 49 & 72

    Keep the registration and documentation current

    Registration is not one-off. Material changes to the system, its purpose, or your representative must be reflected without delay.

    • Define a trigger list: model retraining that changes intended purpose, new Member States, representative change, conformity re-assessment.
    • Assign an owner and a review cadence (quarterly is a workable default).
    • Log post-market monitoring outputs and serious incidents alongside the registration record.
    • Re-verify annually that the mandate, declaration of conformity, and technical documentation still match the deployed system.

    Milestone · 2 December 2027 · Article 113

    High-risk obligations apply

    From this date, high-risk AI obligations — including the Article 22 representative and Article 49 registration — are enforceable. GPAI enforcement and fines are already live as of August 2026.

    • Representative appointed, mandated, and named in your documentation.
    • Every high-risk system registered in the EU database with current Annex VIII data.
    • Risk management, logging, and post-market monitoring operating and evidenced.
    • An internal owner accountable for continued conformity.

    Not sure where you stand?

    Take the 2-minute AI Act Health Check for a scored assessment against Articles 22 and 49, or talk to us about acting as your EU Authorised Representative.

    Disclaimer: This roadmap is provided for informational purposes only and does not constitute legal advice. VeriSure Compliance recommends consulting a qualified legal professional for advice specific to your circumstances.