One Structural Situation, Three Mandates: The EU Representative a Non-EU Digital Business Needs

§ IThree regimes, one recurring situation

The three obligations examined here share a common architecture. In each case, the Union legislature confronted the same problem: a provider located in a third country can reach data subjects, users, or purchasers inside the Union while remaining, in formal terms, beyond the reach of the authorities charged with enforcement. The legislative answer, repeated across three instruments, is to require a designated point of presence within the Union — a representative who can be addressed, who holds documents, and who can be pursued where the provider itself cannot easily be.

Beneath that common architecture the differences are substantial. The DSA representative under Article 13 may be held liable in its own right for the provider's infringements. The GDPR representative under Article 27 is the addressee not only of supervisory authorities but of data subjects themselves, and may be subject to enforcement proceedings. The authorised representative under Articles 22 and 54 of the AI Act carries a narrower, documentation-centred mandate but bears a distinctive duty to terminate the mandate and alert the authorities where the provider is acting unlawfully. A single well-resourced EU entity can, in principle, hold more than one of these roles, but each role rests on a separate written mandate with its own statutory task list. This article treats each in turn, then compares them.

§ IIArticle 13 DSA: the legal representative for intermediary services

Article 13 DSA is located in Chapter III of the Regulation, within the due-diligence obligations applicable to all providers of intermediary services. Its position is deliberate: the obligation is not a special regime for very large platforms but a baseline requirement, independent of the tiered duties that apply to hosting services, online platforms, and very large online platforms and search engines. The provision reads, in its operative core, as follows:

Three features of the provision matter here. First, the obligation is triggered solely by the combination of two facts: the absence of an EU establishment and the offering of services to recipients in the Union. No minimum user number, revenue threshold, or prior platform categorisation is required. The DSA applies to providers with a "substantial connection" to the Union, defined in Article 3(e) DSA by reference to an establishment, a significant number of recipients, or the targeting of at least one Member State.1 Second, the mandate of the legal representative is comprehensive: it extends to all issues necessary for the receipt of, compliance with, and enforcement of decisions under the DSA — a formulation that, as the commentary by Hofmann and Raue notes, goes clearly beyond the narrower representative obligation under the former German NetzDG.2 Third — and here the DSA representative's exposure is broadest — the representative may be held liable in its own right for the provider's non-compliance.

The concept of "establishment" that determines whether Article 13 is triggered turns on substance, not registration. The Court of Justice has interpreted establishment in internal-market law to require a real and stable presence — a fixed place of business with the human and material resources to pursue an economic activity, with the appearance of permanency to the outside world.3 A letterbox address or a registered agent without operational capacity does not qualify. As a result, a broad range of non-EU technology companies active in the European market — marketplaces, social networks, hosting and content-sharing services, and many others — fall within Article 13, provided their service qualifies as a mere conduit, caching or hosting service, whether or not they have considered their position under EU law. The Terharen Praxishandbuch treats service categorisation as the analytical starting point precisely because it determines both whether Article 13 applies and which tier of obligations follows.4

The representative's own liability under Art. 13(3) DSA

Article 13(3) DSA is unusual among EU regulatory instruments: it expressly allows the legal representative to be held liable for the provider's non-compliance, "without prejudice to" the provider's own liability. The representative's exposure is additional to, not a substitute for, that of the provider; both may face enforcement simultaneously. Because the representative may be a legal person as much as an individual, this is an entity liability the designated representative bears in its own right — a party that agrees to act is therefore not performing a mere notification function but accepting a position of legal exposure that prudent parties address through carefully drafted contractual indemnification and liability limitation.5

Why the location of the representative governs jurisdiction

Article 56 DSA concentrates supervisory competence at the Digital Services Coordinator of the provider's main establishment. For providers established outside the Union, Article 56(6) DSA adapts the rule: the competent DSC is that of the Member State in which the legal representative resides or is established. The effect is a concentration of jurisdiction — one primary regulator, one set of procedural rules, one point of contact — functionally close to having a single main establishment, subject to the Commission's own supervisory competence for very large online platforms and search engines.6

If a non-EU provider fails to designate a legal representative, Article 56(7) DSA applies, and the effect is the precise opposite: all Digital Services Coordinators in the Union become competent for oversight and enforcement. The DSA provides cooperation mechanisms and requires respect for the ne bis in idem principle, but that protection addresses double punishment — it does not prevent parallel investigations, divergent timelines, and inconsistent demands for information across Member States.7

Article 13(4) DSA requires notification of the representative's name, postal address, email address, and telephone number to the DSC where the representative resides, and requires that this information be made public, accessible, accurate, and current — typically on the provider's website, for example in its imprint or legal notice. Article 13(5) DSA adds an express clarifier of wide importance: the designation "shall not constitute an establishment in the Union." Compliance with the DSA's representative duty does not, of itself, create a permanent establishment for tax purposes or a main establishment for GDPR purposes.8

§ IIIArticle 27 GDPR: the representative for non-EU controllers and processors

The data-protection regime imposes a structurally similar, but independently triggered, obligation. It is engaged by Article 3(2) GDPR, which extends the Regulation to controllers and processors not established in the Union where the processing relates either to the offering of goods or services to data subjects in the Union — irrespective of whether payment is required — or to the monitoring of their behaviour as far as that behaviour takes place within the Union.9 Where Article 3(2) is engaged, Article 27(1) GDPR requires the controller or processor to designate, in writing, a representative in the Union.

Two features distinguish the GDPR representative from its DSA counterpart. First, the representative must be established in a Member State where the data subjects whose data is processed are located, tying the choice of seat to the provider's actual market rather than leaving it to free selection.10 Second, and more consequentially, the mandate runs not only to supervisory authorities but expressly to data subjects. A data subject in the Union may address the representative directly on all issues related to the processing — a private-facing dimension that the DSA text leaves doctrinally contested but that Article 27(4) GDPR states in terms.

The exemptions: occasional, low-risk processing and public bodies

Unlike Article 13 DSA, the GDPR obligation is subject to express exemptions. Under Article 27(2) GDPR, no representative need be designated where the processing is occasional, does not include, on a large scale, special categories of data under Article 9 or personal data relating to criminal convictions and offences under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons — the three conditions being cumulative. A separate exemption applies to public authorities and bodies.11 The exemption is narrow, and it turns on the nature of the processing rather than on the degree of market contact: a commercial provider whose processing of Union data is more than occasional, or which processes special-category or criminal-conviction data on a large scale, will not qualify, so the safer working assumption for such a provider is that Article 27 applies.

The representative's identity and contact details are not a private matter between the parties. They must appear in the records of processing activities under Article 30 GDPR and, for controllers, in the identity-and-contact information given to data subjects under the transparency duties of Articles 13 and 14 GDPR. As with the DSA, the designation is a publicly visible legal status, not an internal arrangement. And, as with the DSA, designation of a representative does not of itself establish a main establishment in the Union; it does not trigger the one-stop-shop mechanism, which turns on the presence of a genuine establishment exercising decision-making over the processing.

§ IVArticles 22 and 54 AI Act: the authorised representative for AI providers

Regulation (EU) 2024/1689, the Artificial Intelligence Act, adds a third representative duty, split across two provisions that address two different classes of provider. Both rest on the same drafting pattern seen in the DSA and GDPR — a written mandate, a designated EU presence — but the catalogue of tasks is documentation-centred and the terminology shifts to the "authorised representative" familiar from Union product-safety law.

Article 22 governs providers of high-risk AI systems. Before such a system is made available on the Union market, a third-country provider must, by written mandate, appoint an authorised representative established in the Union. The tasks under Article 22(3) are defined with product-safety precision: the representative verifies that the EU declaration of conformity and the technical documentation have been drawn up and that the appropriate conformity-assessment procedure has been carried out; keeps the contact details, the declaration of conformity, the technical documentation and, where applicable, the certificate at the disposal of the competent authorities for ten years after the system has been placed on the market or put into service; provides those authorities, on a reasoned request, with the information and documentation necessary to demonstrate conformity; cooperates with competent authorities; and complies with the registration obligations under Article 49.12

The termination duty: an obligation to disengage

One task distinguishes the AI Act representative from the other two regimes. Article 22(4) obliges the authorised representative to terminate the mandate if it considers, or has reason to consider, that the provider is acting contrary to its obligations under the Regulation, and to inform the relevant market-surveillance authority and, where applicable, the notified body. This is an active duty to disengage and to alert the authorities where the representative identifies non-compliance — a mechanism with no direct equivalent in Article 13 DSA or Article 27 GDPR. Nor is the mandate consequence-free for the representative itself: Article 99(4)(b) AI Act attaches administrative fines to the authorised representative's failure to comply with its own obligations under Article 22.

Article 54 establishes the parallel obligation for providers of general-purpose AI (GPAI) models. Before placing such a model on the Union market, a third-country provider must, by written mandate, appoint an authorised representative in the Union. Here the tasks centre on verifying that the Annex XI technical documentation has been drawn up and that the provider has complied with its obligations under Article 53 (and, for models with systemic risk, Article 55), on retaining that documentation and the provider's contact details for ten years, on cooperation with the AI Office and competent authorities, on acting as a contact point, and — again — on the duty to terminate the mandate where the provider is acting contrary to its obligations, alerting the AI Office under Article 54(5). Article 54(6) carves out an important exception: the appointment obligation does not apply to providers of GPAI models released under a free and open-source licence that allows access, use, modification and distribution, with the model's parameters, including weights, architecture and usage information, made publicly available — unless the model presents a systemic risk. The open-source route therefore relieves the appointment duty only up to the systemic-risk threshold; above it, the obligation returns.13

§ VThe three regimes compared: parallel gateways, distinct mandates

Set against one another, the three obligations share a structure but differ on four points that matter in practice: the trigger, the addressees of the mandate, the liability profile, and the recurring point that designation is not establishment.

The trigger differs in each case. The DSA duty turns on offering intermediary services in the Union without an EU establishment. The GDPR duty turns on Article 3(2) processing — offering goods or services to, or monitoring the behaviour of, data subjects in the Union — subject to the occasional-and-low-risk exemption. The AI Act duty turns on making a high-risk AI system available on, or placing a GPAI model on, the Union market from a third country, with the open-source carve-out for non-systemic GPAI models. The form, by contrast, is uniform: all three require a written mandate.

The addressees of the mandate diverge in a way that shapes day-to-day exposure. The DSA representative is addressed by competent authorities, the Commission and the Board; the GDPR representative is addressed by supervisory authorities and by data subjects; the AI Act representative is addressed by market-surveillance authorities and, for GPAI models, the AI Office. The liability profile is where the regimes separate most clearly. The DSA representative's own liability under Article 13(3) is the most pronounced. The GDPR representative can be subject to enforcement proceedings, with the precise reach of fines still contested. The AI Act authorised representative's exposure is narrower and documentation-centred, but is neither nominal nor fine-free — Article 99(4)(b) attaches administrative fines to breaches of its own Article 22 duties — and it is coupled with the distinctive duty to terminate the mandate and notify the authorities.

One point recurs across all three: designation is not establishment. Article 13(5) DSA states this in terms; for the GDPR and the AI Act the same conclusion follows by analysis rather than from an identical express clause — the GDPR representative is distinct from a main establishment and does not, by mere appointment, trigger the one-stop-shop, and appointing an authorised representative under the AI Act does not convert a third-country provider into an EU-established one. This shared feature carries a practical corollary. Because each duty is legally distinct, a single suitably-resourced EU entity may, in principle, hold more than one of these roles at once — but each role rests on its own written mandate and its own statutory task catalogue. The mandates must be kept separate and must not be conflated; a single contract purporting to cover "EU representation" across all three regimes without distinguishing their tasks would misstate the legal position.

§ VIPractical implementation: structuring the mandates across all three regimes

A compliant designation under any of the three regimes requires attention to detail that is routinely underestimated when the obligation is approached as an administrative formality. The designation agreement should address, at minimum: the scope of the mandate under the applicable instrument; the resources provided to the representative to ensure effective and timely cooperation; the flow of authority and, under the GDPR, data-subject communications to the provider's compliance function; the contractual allocation of liability, which matters most acutely under Article 13(3) DSA; and the governance of the publicly notified information, including prompt re-notification where the representative changes.

Where a provider is caught by more than one regime — a common position for, say, a third-country platform that also processes personal data at scale and deploys a high-risk AI system — the mandates should be structured together but drafted distinctly. A single EU entity may serve as the point of presence for each, but the DSA mandate, the GDPR mandate, and the AI Act mandate each need their own scope clause, their own task catalogue, and their own liability treatment. Consolidating them into one undifferentiated instrument invites exactly the conflation the regimes are drafted to avoid.

§ VIIThe enforcement landscape across the three regimes

The representative duties are enforced in practice under the DSA and the GDPR, and are becoming operative under the AI Act. Under the DSA, Digital Services Coordinators are operational across all 27 Member States; the German Bundesnetzagentur has received a substantial volume of complaints in its DSC role, and the European Commission's formal proceedings against major non-EU platforms have shown that enforcement reaches beyond Article 13 to the full range of DSA obligations. The failure to designate a legal representative is itself an infringement, subject to penalties under Article 52 DSA, independent of any substantive breach.

Under the GDPR, supervisory authorities have been active since 2018, and the representative has featured in enforcement practice as an addressable presence within the Union. The precise extent to which fines may be directed at the representative remains contested, but the recital's direction of travel — a representative subject to enforcement proceedings — is clear, and the transparency and records obligations mean the appointment is visible to authorities and data subjects alike.

Under the AI Act, the obligations are phased in over the Regulation's staged timeline: the general-purpose AI model provisions (including Article 54) apply from 2 August 2025, while the high-risk regime and Article 22 apply from 2 August 2026, with the Annex III high-risk categories following on 2 August 2027. For providers in scope, the authorised-representative duty is a precondition to lawful market access — a high-risk system may not be made available, and a GPAI model may not be placed on the market, without the appointment where it is required. For a non-EU business active across digital services, personal data, and AI, the safer approach is to assess all three regimes together rather than to treat compliance with one as evidence of compliance with the others.