EU AI Act Art.54 GPAI Authorised Representative: Non-EU Provider Obligations — Developer Guide (2026)

EU AI Act Article 54 is the jurisdictional gateway rule for non-EU GPAI model providers with systemic risk. If you are a GPAI model provider established outside the European Union — a US lab, a UK startup, a Canadian research foundation — and your model meets the Art.51 systemic risk threshold of 10^25 FLOPs, Art.54 requires you to appoint a written-mandate Authorised Representative established in the EU before you place that model on the EU market.

Art.54 became applicable on 2 August 2025 as part of Chapter V of the EU AI Act (Regulation (EU) 2024/1689). The structure mirrors EU product safety law and the GDPR Art.27 representative mechanism: the EU Representative acts as the point of contact for the European AI Office, accepts legal communications on behalf of the non-EU provider, and is jointly responsible for cooperation obligations under Art.53.

For EU infrastructure providers and PaaS operators — including sota.io — Art.54 is relevant in two ways: first, as evidence of the compliance burden non-EU GPAI APIs impose on downstream integrators; second, as a direct illustration of why EU-established providers operating under a single EU legal regime have a structural compliance advantage over US-based GPAI providers that must layer Art.54 representative infrastructure onto every EU deployment.

Art.54 in the Chapter V GPAI Obligation Cascade

Art.54 sits as the fourth article of Chapter V, applying exclusively to the non-EU subset of systemic risk providers:

Art.54 is additive to Art.53, not an alternative. A non-EU systemic risk GPAI provider must comply with Art.52 + Art.53 + Art.54. The Authorised Representative does not substitute for the provider's own compliance obligations; it adds a mandatory EU point of contact through which the AI Office can exercise oversight.

Art.54(1): Who Must Appoint an Authorised Representative

Art.54(1) states: "Providers of GPAI models with systemic risk that are not established in the Union shall, prior to placing the GPAI model with systemic risk on the Union market, designate by written mandate an authorised representative established in the Union."

Three Cumulative Conditions

All three conditions must be met simultaneously for Art.54(1) to apply:

What "Established in the Union" Means

The EU establishment test under AI Act Chapter V follows the same interpretation as GDPR Art.3: a non-trivial, stable presence through which the model is offered or used in the EU. A subsidiary that merely holds IP without operational control is not an establishment for this purpose. However, if a US parent's EU subsidiary is the formal API provider for EU customers, that subsidiary is the EU-established provider — Art.54 does not apply because the provider itself is established in the EU.

Practical scenario: OpenAI LLC (US) offers the GPT-4 API globally. OpenAI Ireland Ltd exists as an EU entity but the API contract may run through the US entity. Whether Art.54 applies depends on which entity is the legal provider under EU contracts — a compliance question for each specific vendor relationship.

Art.54(2): Written Mandate Requirements

Art.54(2) specifies that the written mandate must empower the Authorised Representative to perform two sets of tasks:

Task Set 1: Registration and Documentation

The mandate must authorise the Representative to register the GPAI model in the EU AI Database under Art.71. Registration covers:

• Provider identity and contact details
• Model name, version, and classification (systemic risk tier)
• Training compute estimate and systemic risk determination basis
• Contact for downstream providers under Art.55
• Reference to Art.53 adversarial testing program and incident reporting contact

Task Set 2: Cooperation with the AI Office

The mandate must authorise the Representative to cooperate with the European AI Office on behalf of the non-EU provider regarding:

• Art.53(1)(a): Adversarial testing program — providing test results on request
• Art.53(1)(b): Serious incident reports — receiving and transmitting notifications to the Commission
• Art.53(1)(c): Cybersecurity documentation — providing cooperation on security assessments
• Art.53(1)(d): Energy efficiency data — reporting to the AI Office

Mandatory Content Elements of the Written Mandate

Who Can Serve as Authorised Representative?

Art.54 does not specify qualifications for the Authorised Representative beyond EU establishment. In practice:

• Law firms and compliance consultancies with EU AI Act expertise — most common choice for initial compliance; higher cost but legal privilege protection for communications
• Industry associations (e.g., AI industry bodies in Brussels) — emerging market, lower cost, potential conflict of interest
• EU subsidiaries of the provider — if the subsidiary is genuinely separate, this is a viable option; if it is a shell, the AI Office may look through the structure
• Technology service providers offering "EU AI Act Representative" as a service — growing market analogous to GDPR Art.27 representative services

Art.54(3): Notification to the Commission

Art.54(3) requires that the provider notify the European Commission of the name and contact details of the Authorised Representative. This notification is separate from the Art.71 EU AI Database registration.

Notification Timeline

Art.54(3) links notification to the market placement obligation: prior to placing the model on the EU market. The practical sequence is:

1. Appoint Representative (written mandate executed)
2. Notify the Commission (name + contact details)
3. Register in EU AI Database via Representative (Art.71)
4. Place model on EU market (make API available to EU providers/deployers)

Steps 1–3 must precede Step 4. Retroactive compliance — offering the API first, appointing the Representative later — is a violation of Art.54(1).

Commission Notification Format

No implementing act specifying the notification format has been published as of April 2026. The AI Office has published guidance indicating that notification should be submitted through the EU AI Database portal, which includes a dedicated field for Authorised Representative details. Until a formal implementing act is issued, providers should document the notification with timestamped correspondence (email to ai-act@eu-register.europa.eu or the official AI Office notification channel).

Art.54 × Art.53: Cooperation Obligation Flow

The Authorised Representative is not a passive address for EU mail — Art.54(2) specifically requires the mandate to cover cooperation with the AI Office on Art.53 obligations. This creates a four-way obligation chain:

Non-EU GPAI Provider (US)
        │
        │ Written mandate (Art.54(2))
        ▼
EU Authorised Representative
        │
        │ Cooperation interface for:
        ├─► Art.53(1)(a): Adversarial test results → AI Office
        ├─► Art.53(1)(b): Serious incident reports → Commission
        ├─► Art.53(1)(c): Cybersecurity documentation → AI Office
        └─► Art.53(1)(d): Energy efficiency data → AI Office

Critical implication: The Representative can be required by the AI Office to produce adversarial test results, incident reports, and cybersecurity documentation. If the non-EU provider has stored these records on US-hosted infrastructure, the Representative may need to transmit records that are simultaneously subject to CLOUD Act compellability from the US side.

Art.54 × Art.25: Provider/Deployer Distinction

Art.25 (Chapter III) establishes the provider/deployer/importer chain for high-risk AI systems. Art.54 uses a different term — "authorised representative" — but the functional role is analogous to the Art.25(1) importer: a party that takes on compliance responsibility on behalf of a non-EU provider.

The key difference: an Art.25 importer takes on provider obligations if the provider cannot be reached. An Art.54 Representative does not substitute for the provider's obligations — the non-EU provider remains the primary duty-holder. The Representative is a procedural compliance conduit, not a liability transfer.

GDPR Art.27 Representative Analogy

Art.54 is structurally modelled on GDPR Art.27 (EU Representative for non-EU data controllers). Both mechanisms:

Practical takeaway for compliance teams: If your organisation already provides GDPR Art.27 representative services, the legal infrastructure — written mandate templates, notification procedures, supervisory authority interface — maps directly to Art.54. The AI Act extends the model to GPAI compliance.

CLOUD Act × Art.54: Jurisdiction Risk for Mandate Records

The written mandate required by Art.54(2) and the cooperation records generated under Art.53 create at least six record categories subject to CLOUD Act compellability if stored on US-hosted infrastructure:

The dual-compellability problem: A non-EU GPAI provider that stores Art.54 mandate records and Art.53 cooperation correspondence on US-hosted cloud (AWS S3, GCP, Azure) creates a scenario where the EU AI Office can demand the records via the Art.54 Representative, while the US DOJ can compel the same records directly from the US cloud provider under CLOUD Act §2713. The records flow two directions — EU regulatory disclosure and US law enforcement disclosure — potentially simultaneously, without the provider being able to object on the basis of EU confidentiality obligations.

Mitigation: An EU-native PaaS for storing mandate records and cooperation correspondence creates a single-regime document management environment. EU GDPR data protection law applies; CLOUD Act compellability requires additional MLAT procedure and does not extend to EU-established cloud providers for EU-stored data.

Practical Decision Tree: Does My Model Require an Art.54 Representative?

Q1: Is your GPAI model provider established in the EU?
    │
    ├─► YES → Art.54 does NOT apply. Go to Art.52+Art.53 if systemic risk tier.
    │
    └─► NO (US/UK/CA/etc.) → Continue to Q2.

Q2: Does your model meet the Art.51 systemic risk threshold?
    │
    ├─► NO (cumulative training compute < 10^25 FLOPs, no Commission designation)
    │    → Art.54 does NOT apply. Art.52 baseline applies if you are a GPAI provider.
    │
    └─► YES or UNCERTAIN → Continue to Q3.

Q3: Do you place the model on the EU market (direct API, licensing, distribution)?
    │
    ├─► NO (internal use only, no EU-accessible API) → Art.54 does NOT apply.
    │
    └─► YES → Art.54 APPLIES. You must:
              1. Appoint EU Authorised Representative (written mandate)
              2. Notify Commission (Art.54(3))
              3. Register in EU AI Database (Art.71 via Representative)
              4. Only then: place model on EU market

SPECIAL CASES:

Llama fine-tune (open-weight): If you fine-tune Llama-3.1-405B or similar:
- Fine-tuner may become a new GPAI provider under Art.51 if cumulative compute of
  fine-tuning PLUS base model training is attributed to fine-tuner.
- Current AI Office guidance: fine-tuners below 10^25 FLOPs cumulative do NOT
  inherit the base model's systemic risk classification.
- Art.54 most likely does NOT apply to Llama fine-tuners unless they independently
  cross the 10^25 FLOPs threshold.

API wrapper (no retraining): If you build an API product on top of a systemic risk
GPAI API (GPT-4, Claude Opus, Gemini Ultra):
- You are a downstream deployer/provider under Art.55, NOT the GPAI model provider.
- Art.54 applies to the GPAI model provider (OpenAI, Anthropic, Google), NOT to you.
- Your Art.55 obligation: receive and pass downstream the Art.52 model card + any
  Art.53 incident notifications relevant to your product.

Python Implementation

from __future__ import annotations
from dataclasses import dataclass, field
from datetime import date, datetime
from enum import Enum
from typing import Optional


class CooperationRequestType(Enum):
    ADVERSARIAL_TEST_RESULTS = "adversarial_test_results"      # Art.53(1)(a)
    SERIOUS_INCIDENT_REPORT = "serious_incident_report"        # Art.53(1)(b)
    CYBERSECURITY_DOCUMENTATION = "cybersecurity_documentation" # Art.53(1)(c)
    ENERGY_EFFICIENCY_DATA = "energy_efficiency_data"          # Art.53(1)(d)
    DATABASE_REGISTRATION = "database_registration"            # Art.71 via Art.54(2)
    GENERAL_INQUIRY = "general_inquiry"


class CooperationStatus(Enum):
    RECEIVED = "received"
    IN_PROGRESS = "in_progress"
    RESPONDED = "responded"
    ESCALATED_TO_PROVIDER = "escalated_to_provider"
    CLOSED = "closed"


@dataclass
class MandateScope:
    """Tracks the authorisation scope within the Art.54(2) written mandate."""
    includes_art71_registration: bool
    includes_art53_1a_testing: bool
    includes_art53_1b_incidents: bool
    includes_art53_1c_cybersecurity: bool
    includes_art53_1d_energy: bool
    governing_law: str  # e.g., "Belgium" or "Ireland"
    mandate_language: str  # e.g., "EN" (must match EU AI Database requirements)

    def validate_art54_completeness(self) -> list[str]:
        gaps = []
        if not self.includes_art71_registration:
            gaps.append("Art.54(2): Mandate does not cover Art.71 registration obligation")
        if not (self.includes_art53_1a_testing and self.includes_art53_1b_incidents
                and self.includes_art53_1c_cybersecurity):
            gaps.append("Art.54(2): Mandate does not cover full Art.53 cooperation scope")
        return gaps


@dataclass
class CooperationRequest:
    """Single AI Office cooperation request handled via the Art.54 Representative."""
    request_id: str
    received_date: date
    request_type: CooperationRequestType
    requesting_authority: str  # "European AI Office" | "Member State NCA: {country}"
    description: str
    status: CooperationStatus = CooperationStatus.RECEIVED
    response_date: Optional[date] = None
    response_summary: Optional[str] = None
    escalated_to_provider: bool = False
    provider_response_date: Optional[date] = None

    def days_open(self) -> int:
        end = self.response_date or date.today()
        return (end - self.received_date).days


@dataclass
class GPAIAuthorisedRepresentativeRecord:
    """
    Art.54 Authorised Representative mandate and compliance record.
    Use for non-EU GPAI model providers with systemic risk.
    """
    # Provider details
    provider_name: str
    provider_country: str  # ISO 3166-1 alpha-2, e.g., "US", "GB", "CA"
    provider_contact_officer: str

    # Representative details
    representative_name: str
    representative_eu_country: str  # Must be EU Member State
    representative_contact: str

    # Model details
    model_name: str
    model_version: str
    systemic_risk_basis: str  # e.g., "Art.51(1)(b): 1.8×10^26 FLOPs cumulative training"

    # Mandate details
    mandate_execution_date: date
    mandate_scope: MandateScope
    commission_notification_date: Optional[date] = None  # Art.54(3)
    art71_registration_date: Optional[date] = None
    art71_registration_id: Optional[str] = None  # EU AI Database reference

    # Cooperation history
    cooperation_requests: list[CooperationRequest] = field(default_factory=list)

    def market_placement_cleared(self) -> bool:
        """
        Returns True only if all Art.54 prerequisites are met before EU market placement.
        Art.54(1): mandate executed; Art.54(3): Commission notified; Art.71: registered.
        """
        return (
            self.mandate_execution_date is not None
            and self.commission_notification_date is not None
            and self.art71_registration_date is not None
        )

    def validate_art54_compliance(self) -> list[str]:
        gaps = []
        mandate_gaps = self.mandate_scope.validate_art54_completeness()
        gaps.extend(mandate_gaps)
        if not self.commission_notification_date:
            gaps.append("Art.54(3): Commission has not been notified of Representative")
        if not self.art71_registration_id:
            gaps.append("Art.54(2) → Art.71: GPAI model not registered in EU AI Database")
        if not self.market_placement_cleared():
            gaps.append("Art.54(1): Prerequisites not met — do not place model on EU market yet")
        return gaps

    def add_cooperation_request(self, request: CooperationRequest) -> None:
        self.cooperation_requests.append(request)

    def open_requests(self) -> list[CooperationRequest]:
        return [r for r in self.cooperation_requests
                if r.status not in (CooperationStatus.RESPONDED, CooperationStatus.CLOSED)]

    def representative_summary(self) -> dict:
        return {
            "provider": f"{self.provider_name} ({self.provider_country})",
            "representative": f"{self.representative_name} ({self.representative_eu_country})",
            "model": f"{self.model_name} v{self.model_version}",
            "mandate_executed": self.mandate_execution_date.isoformat(),
            "commission_notified": (
                self.commission_notification_date.isoformat()
                if self.commission_notification_date else "PENDING"
            ),
            "art71_registration": self.art71_registration_id or "PENDING",
            "market_placement_cleared": self.market_placement_cleared(),
            "open_cooperation_requests": len(self.open_requests()),
            "compliance_gaps": self.validate_art54_compliance(),
        }


@dataclass
class ManagingCooperationTracker:
    """
    Tracks all cooperation requests across multiple GPAI models handled by
    the same Art.54 Authorised Representative (typical for compliance firms
    handling multiple non-EU GPAI provider clients).
    """
    representative_firm: str
    records: list[GPAIAuthorisedRepresentativeRecord] = field(default_factory=list)

    def add_record(self, record: GPAIAuthorisedRepresentativeRecord) -> None:
        self.records.append(record)

    def models_not_cleared_for_market(self) -> list[str]:
        return [
            f"{r.provider_name}/{r.model_name}"
            for r in self.records
            if not r.market_placement_cleared()
        ]

    def all_open_requests(self) -> list[tuple[str, CooperationRequest]]:
        result = []
        for record in self.records:
            for req in record.open_requests():
                result.append((f"{record.provider_name}/{record.model_name}", req))
        return result

    def overdue_requests(self, threshold_days: int = 30) -> list[tuple[str, CooperationRequest]]:
        """Flag requests open longer than threshold_days without a response."""
        return [
            (model, req)
            for model, req in self.all_open_requests()
            if req.days_open() > threshold_days
        ]

    def compliance_dashboard(self) -> dict:
        total = len(self.records)
        cleared = sum(1 for r in self.records if r.market_placement_cleared())
        open_req = self.all_open_requests()
        overdue = self.overdue_requests()
        return {
            "representative": self.representative_firm,
            "total_models_managed": total,
            "market_placement_cleared": cleared,
            "pending_market_clearance": total - cleared,
            "open_cooperation_requests": len(open_req),
            "overdue_requests_30d": len(overdue),
            "models_at_risk": [m for m, _ in overdue],
        }

Art.54 Compliance Checklist (40 Items)

Scope Determination (Art.54(1))

• Art.54-1 Provider establishment: confirmed provider is not established in any EU Member State
• Art.54-2 Systemic risk status: Art.51 classification confirmed (≥ 10^25 FLOPs or Commission designation)
• Art.54-3 EU market placement: confirmed model is or will be made available to EU providers/deployers
• Art.54-4 All three conditions met simultaneously: non-EU + systemic risk + EU market = Art.54 applies
• Art.54-5 EU subsidiary analysis: no EU subsidiary is the legal provider under EU contracts (if yes → Art.54 may not apply)

Authorised Representative Selection (Art.54(2))

• Art.54-6 Representative identified: EU-established entity named
• Art.54-7 Representative EU Member State confirmed (not EEA-only — must be EU Member State)
• Art.54-8 Representative has capacity for Art.71 registration (access to EU AI Database portal)
• Art.54-9 Representative has AI Act expertise or legal counsel for Art.53 cooperation
• Art.54-10 Conflict of interest assessed: Representative does not have commercial relationship with AI Office that could create conflict

Written Mandate Content (Art.54(2))

• Art.54-11 Mandate in writing: signed physical or qualified e-signature document
• Art.54-12 Provider identity: full legal name, address, EU VAT/registration number (if applicable)
• Art.54-13 Representative identity: full legal name, EU address, EU registration number
• Art.54-14 Model identification: name, version, training compute estimate, Art.51 basis
• Art.54-15 Art.71 registration authorisation: explicit grant to register on provider's behalf
• Art.54-16 Art.53(1)(a) cooperation: explicit authorisation to transmit adversarial test results to AI Office
• Art.54-17 Art.53(1)(b) cooperation: explicit authorisation to transmit serious incident reports to Commission
• Art.54-18 Art.53(1)(c) cooperation: explicit authorisation for cybersecurity documentation cooperation
• Art.54-19 Art.53(1)(d) cooperation: explicit authorisation for energy efficiency data reporting
• Art.54-20 Duration: mandate valid for the full period the model is on the EU market
• Art.54-21 Governing law: EU Member State law specified
• Art.54-22 Internal liability allocation: indemnification from provider to Representative documented
• Art.54-23 Revocation procedure: successor designation obligation before termination
• Art.54-24 Mandate language: English and/or Member State language of primary market

Commission Notification (Art.54(3))

• Art.54-25 Notification prepared before market placement
• Art.54-26 Notification content: Representative name + full contact details
• Art.54-27 Notification submitted through AI Office channel (EU AI Database portal or official channel)
• Art.54-28 Notification timestamp documented (proof prior to market placement)
• Art.54-29 Notification updates: procedure in place if Representative changes

Art.71 Registration (via Art.54(2))

• Art.54-30 EU AI Database account created by/for Representative
• Art.54-31 Model registered: all mandatory Art.71 fields completed
• Art.54-32 Art.51 systemic risk classification documented in registration
• Art.54-33 Art.53 contact point registered (for Art.73 serious incident notifications)
• Art.54-34 Registration updated on material model change (new version, new training run)

Ongoing Cooperation (Art.54(2) → Art.53)

• Art.54-35 Cooperation channel established between non-EU provider and Representative (SLA for response)
• Art.54-36 Art.53(1)(b) incident notification protocol: Representative receives Commission alerts within 24h
• Art.54-37 Art.53(1)(a) test results: Representative has access to adversarial testing documentation
• Art.54-38 Art.53(1)(c) cybersecurity docs: Representative can access security posture documentation
• Art.54-39 Record retention: all mandate documents and cooperation correspondence retained ≥ 10 years post-market
• Art.54-40 Annual review: mandate and cooperation protocols reviewed annually against AI Office guidance updates

Art.54 × Chapter V: Full Obligation Map for Non-EU Systemic Risk Providers

See Also

• EU AI Act Art.53 GPAI Models with Systemic Risk: Adversarial Testing, Incident Reporting & Cybersecurity — Developer Guide (2026)
• EU AI Act Art.52 GPAI Model General Obligations: Technical Documentation, Training Data & Copyright — Developer Guide (2026)
• EU AI Act Art.51 GPAI Model Classification: Systemic Risk Threshold and Provider Notification — Developer Guide (2026)
• EU AI Act Art.50 Transparency Obligations for AI-Generated Content: Developer Guide (2026)
• EU AI Act 2026 Conformity Assessment: Developer Guide to Art.43 Paths, GPAI August 2025 Deadline & Notified Bodies