There is one more place the Act names a party. Article 22 requires providers established in third countries to appoint, by written mandate, an authorised representative established in the Union before a high-risk system is made available here.
Article 22(3) makes that representative produce the mandate to market surveillance authorities on request, and verify that the EU declaration of conformity and the Article 11 technical documentation have been drawn up.
Narrow, provider-side, and silent on who owns a documented gap. But it is the one named party an authority can reach without first asking the company who to talk to.
Fair point, but the authorised representative is someone an authority can address, and it's a role you can buy from a firm in Dublin, which is what tells you it isn't ownership. It also only exists for providers established outside the EU, so for a company established in the EU, it is not applicable. I covered authorised representative in my previous article https://ailawdecoded.com/p/your-role-under-the-eu-ai-act-guide. In this one, I wanted to cover the question of who inside the company owns AI governance.
Article 26(2) is the closest the Act comes to naming an internal owner. It requires deployers to assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. Authority is the load-bearing word: someone who can escalate but cannot suspend the system does not satisfy it. The Act stops there and never says which function that person sits in, so the org chart stays a company decision rather than a legal one.
Article 22(4) settles it in the text. The authorised representative must terminate the mandate if it has reason to consider the provider is acting contrary to its obligations, and must then immediately inform the market surveillance authority and, where applicable, the notified body. So the role carries a duty to walk away and report, not a duty to fix anything. That is an exit, not ownership, which is where your article lands. The internal owner still has to exist somewhere.
There is one more place the Act names a party. Article 22 requires providers established in third countries to appoint, by written mandate, an authorised representative established in the Union before a high-risk system is made available here.
Article 22(3) makes that representative produce the mandate to market surveillance authorities on request, and verify that the EU declaration of conformity and the Article 11 technical documentation have been drawn up.
Narrow, provider-side, and silent on who owns a documented gap. But it is the one named party an authority can reach without first asking the company who to talk to.
Fair point, but the authorised representative is someone an authority can address, and it's a role you can buy from a firm in Dublin, which is what tells you it isn't ownership. It also only exists for providers established outside the EU, so for a company established in the EU, it is not applicable. I covered authorised representative in my previous article https://ailawdecoded.com/p/your-role-under-the-eu-ai-act-guide. In this one, I wanted to cover the question of who inside the company owns AI governance.
Article 26(2) is the closest the Act comes to naming an internal owner. It requires deployers to assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. Authority is the load-bearing word: someone who can escalate but cannot suspend the system does not satisfy it. The Act stops there and never says which function that person sits in, so the org chart stays a company decision rather than a legal one.
Article 22(4) settles it in the text. The authorised representative must terminate the mandate if it has reason to consider the provider is acting contrary to its obligations, and must then immediately inform the market surveillance authority and, where applicable, the notified body. So the role carries a duty to walk away and report, not a duty to fix anything. That is an exit, not ownership, which is where your article lands. The internal owner still has to exist somewhere.