EU AI Act Authorized Representative Program

EU AI Act Authorized Representative Program Overview

The program includes the following services from VeraSafe:

Formal Appointment

We will coordinate the formal appointment of a VeraSafe EU entity as your EU AI Act authorized representative, fulfilling the legal requirement to have a formal EU-based contact point for competent authorities, including the EU AI Office and national authorities.

For high-risk AI providers, this designation is required under Article 22 before placing your system on the EU market.
For GPAI providers, this designation is required under Article 54 before placing your model on the EU market.

Technical Documentation and Conformity

We assist in verifying that your technical documentation aligns with EU AI Act requirements and confirm that any applicable conformity procedures have been completed.

For high-risk AI systems, we confirm that the EU declaration of conformity (Article 47) and the technical documentation (Article 11) have been drawn up by the provider, and that an appropriate conformity assessment procedure has been carried out.
For general-purpose AI models, we confirm that required documentation has been created in accordance with Annex XI of the EU AI Act, and that all obligations referred to in Article 53 and, where applicable, Article 55 have been fulfilled.

Regulatory Support and Submissions

As your authorized representative, we act as your formal point of contact or liaison with the EU AI Office and other competent authorities. We manage all communications, respond to official inquiries, and provide required documentation on your behalf.

For high-risk AI providers, we support obligations regarding ongoing conformity monitoring by competent authorities to mitigate risks, and submission of documentation and logs upon request.
For GPAI providers, we cooperate with the AI Office and competent authorities, facilitate transparency and documentation obligations, and support regulatory engagement as the market evolves. Where applicable, we can also assist with preparing and processing your registration in the EU AI data base, helping you fulfill administrative requirements efficiently.

Record Maintenance

We securely retain all required technical documentation and provider contact details for 10 years after your AI system or model is placed on the EU market, as mandated by Article 22(3)(b) for high-risk AI systems and Article 54(3)(b) for GPAI models. This supports long-term regulatory compliance, transparency, and audit readiness.

EU Database Support

Where applicable, VeraSafe assists with preparing and submitting or checking the information necessary to complete your organization’s registration in the EU AI Database.

Website Trust Seal

Provide your organization with a website trust seal which your visitors can click to confirm your participation in VeraSafe’s authorized representative program.

Trustseal eu ai act authorized representative 100

Enhanced Compliance Support

For organizations seeking deeper regulatory assistance with the EU AI Act, VeraSafe offers a premium program that goes beyond the minimum compliance requirements. In addition to serving as your formal EU AI Act authorized representative, VeraSafe can provide structured documentation review, prepare a written gap assessment to support remediation efforts, and dedicated advisory support to help ensure your organization is fully prepared to meet all applicable regulatory obligations.

Distinguishing Between GPAI and High-Risk AI Systems

The EU AI Act differentiates between two main types of AI systems, each with distinct compliance requirements:

High-Risk AI Systems

High-risk AI systems are those that pose significant risks to health, safety, or fundamental rights and are used in sensitive domains such as healthcare, law enforcement, education, employment, critical infrastructure, and biometric identification. These systems are listed in Annex III of the EU AI Act and are subject to strict regulatory controls due to their potential societal impact.

The obligations for high-risk AI systems will become enforceable starting August 2, 2026. Providers must comply with a comprehensive set of requirements, including conducting a conformity assessment, preparing and maintaining technical documentation (Article 11), and drawing up an EU declaration of conformity (Article 47). They must also implement risk management systems, ensure human oversight, and meet transparency, accuracy, and robustness standards. Additionally, providers not established in the EU must appoint an authorized representative under Article 22 to serve as the regulatory contact point and retain documentation.

General-Purpose AI (GPAI) Models

General-purpose AI models are foundational systems designed to perform a wide variety of tasks across different applications. These include models such as large language models (LLMs) or image generators that can be adapted for many uses. GPAI providers are subject to a range of enforceable obligations under Articles 53 to 55 of the EU AI Act, effective August 2, 2025. These include transparency requirements such as documenting the model’s capabilities, limitations, and training data sources; appointing an EU-based authorized representative if the provider is not established in the Union; and retaining technical documentation for 10 years. Providers of GPAI models that pose systemic risk must also meet enhanced obligations, including conducting model evaluations, implementing risk mitigation measures, reporting serious incidents, and ensuring traceability and cybersecurity safeguards.

Frequently Asked Questions (FAQs)

Determining whether your AI model poses systemic risk requires a careful evaluation based on the criteria in Article 51 and the designation factors in Annex XIII.

A GPAI model is classified as having systemic risk if it:
• Has high-impact capabilities, evaluated using appropriate technical tools and methodologies, including indicators and benchmarks; or
• Is designated by the European Commission (on its own initiative or following a qualified alert) as having capabilities or an impact equivalent to high-impact capabilities, taking into account the criteria in Annex XIII.

This involves assessing factors such as the model’s size and complexity, input/output modalities, autonomy and scalability, its potential societal impact, and the scope of its deployment.

VeraSafe’s team of legal and AI professionals can guide you through this evaluation, helping you interpret the criteria and assess whether your model meets the thresholds for systemic risk. Our AI advisory services can support you in documenting this analysis, preparing for any regulatory obligations that may follow, and managing risks. Learn more about our AI advisory services.

Under the EU AI Act, providers of both high-risk AI systems and GPAI models must retain technical documentation and contact details for 10 years after the system or model is placed on the EU market.

VeraSafe securely maintains these records on your behalf, ensuring compliance with Article 22(3)(b) for high-risk AI and Article 54(3)(b) for GPAI models.

To determine whether your AI system qualifies as high-risk under the EU AI Act, you must consider whether it falls into one of the following categories.
• AI used in regulated products
• AI systems are considered high-risk if they are a safety component of, or are themselves, products regulated under certain EU product safety laws that require third-party conformity assessment. Examples include products covered by EU directive or regulations covering machinery, medical devices, radio equipment, vehicles, aviation, and other regulated equipment.
• AI used in sensitive areas

AI systems are also high-risk if they are intended for use in certain sensitive areas listed in Annex III of the AI Act, including:
• Biometric identification and categorization
• Critical infrastructure
• Education and vocational training
• Employment and worker management
• Access to essential services
• Law enforcement
• Migration, asylum, and border control
• Administration of justice and democratic processes

The classification depends on the intended purpose of the system and its potential impact on health, safety, or fundamental rights. VeraSafe can help assess your system’s risk classification, guide you through the applicable obligations, and help prepare the necessary documentation to support your compliance. Learn more about our AI advisory services.

Under the EU AI Act, certain AI systems listed in Annex III are presumed to be high-risk due to their use in sensitive domains. An AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons. However, Article 6(3) provides specific exemptions for systems that do not pose a significant risk to health, safety, or fundamental rights. These exemptions apply when the AI system:

• Performs a narrow procedural task, such as transforming unstructured data into structured formats, classifying documents, or detecting duplicates: tasks that are limited in scope and do not materially influence decision-making.
• Improves the result of a previously completed human activity, such as refining the tone or formatting of a document, without altering its substantive content.
• Detects decision-making patterns or deviations from prior decisions, without replacing or influencing the original human judgment, without proper human review.
• Supports a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III.

If a provider believes their system qualifies for one of these exemptions, Article 6(4)requires them to document their assessment before placing the system on the market or putting it into service, clearly explain why the system does not materially influence decision-making or pose significant risks, register the system in the EU AI database in accordance with Article 49(2), and provide the documentation to national competent authorities upon request. VeraSafe can assist in preparing this documentation and ensuring it meets regulatory expectations.

Matthew Joseph

CIPP/E, CIPP/US, CIPM, FIP

Managing Director

Contact Me

Jim Cormier

CIPP/E, CIPM, FIP

Senior Vice President and Head of Professional Services