EU Representative Duties Compared: GDPR, DSA, AI Act, NIS2 and the Data Act

§ I Who must designate an EU representative — and under which of the five regimes?

Five Union instruments each impose their own designation duty: Article 27 GDPR, Article 13 DSA, Articles 22 and 54 of the AI Act (Article 54 today, Article 22 from 2027/2028), Article 26(3) NIS2 and Article 37(11) of the Data Act. Each has its own trigger, and a single non-EU organization can be caught by several of them at once.

The five duties are triggered by five different fact patterns, and the analysis for any given provider must run through all of them separately. Whether any of them reaches your business model in the first place is worked through separately in when you must appoint an EU representative — and when not.

Article 27 GDPR attaches to controllers and processors not established in the Union whose processing falls under Article 3(2) GDPR — that is, processing which relates to offering goods or services to data subjects in the Union, irrespective of payment, or to monitoring their behaviour as far as it takes place within the Union.1 The duty is subject to an express exemption: no representative is required where the processing is occasional, does not include, on a large scale, special categories of data under Article 9 or criminal-conviction data under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons — three cumulative conditions — or where the controller or processor is a public authority or body.2

Article 13 DSA attaches to providers of intermediary services — mere conduit, caching and hosting services within the meaning of Article 3(g) DSA — which do not have an establishment in the Union but offer services in the Union. "Offering services in the Union" presupposes a substantial connection to the Union, defined in Article 3(e) DSA by reference to an establishment, a significant number of recipients in one or more Member States, or the targeting of activities towards at least one Member State. There is no de-minimis exemption comparable to Article 27(2) GDPR: no user threshold, no revenue floor, no occasional-use carve-out.3

Articles 22 and 54 AI Act split the duty across two provider classes and use the term authorised (US: authorized) representative. Under Article 22(1), a provider established in a third country will have to appoint, by written mandate, an authorised representative established in the Union before making a high-risk AI system available on the Union market — a duty that does not yet apply (§ V). Under Article 54(1), the same duty applies to third-country providers of general-purpose AI models before placing such a model on the Union market, and it has applied since 2 August 2025. Article 54(6) carves out providers of GPAI models released under a free and open-source licence — with parameters, weights, architecture and usage information publicly available — unless the model presents systemic risk.4

Article 26(3) NIS2 attaches to a closed list of entity types drawn from Article 26(1)(b) of the Directive: DNS service providers, TLD name registries, entities providing domain-name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, and providers of online marketplaces, online search engines or social networking services platforms. Where such an entity is not established in the Union but offers services within the Union, it must designate a representative in the Union, established in one of the Member States where the services are offered.5 Two structural differences follow from the instrument type: NIS2 is a directive, so the duty reaches the entity through national transposition; and the trigger is category-based — an entity outside the Article 26(1)(b) list is not caught, however large its Union footprint. Category membership is necessary but not sufficient: the entity must belong to one of the Article 26(1)(b) categories and fall within the scope of the Directive under Article 2 — as a rule only from the medium-sized-enterprise threshold of Recommendation 2003/361/EC upwards. Several groups are caught regardless of size: providers of public electronic communications networks and services, trust service providers, TLD name registries and DNS service providers (Article 2(2)(a) NIS2); entities providing domain-name registration services, that is registrars (Article 2(4) NIS2); and the further cases of Article 2(2)(b) to (f) and Article 2(3) NIS2. A small non-EU cloud, CDN, managed-service or marketplace provider that stays below the threshold and outside those cases is not caught.5

Article 37(11) of the Data Act is the youngest and the least noticed of the five, not least because it sits in an article headed "Competent authorities and data coordinators". Its wording is broad: "Any entity falling within the scope of this Regulation that makes connected products available or offers services in the Union, and which is not established in the Union, shall designate a legal representative in one of the Member States." The representative duty itself knows no category list, no size threshold and no exemption; the trigger is simply falling within the scope of the Regulation while making connected products available or offering services in the Union. Size-based carve-outs exist elsewhere in the Regulation — Article 7(1) broadly exempts micro and small enterprises from the data-sharing obligations of Chapter II — but none of them qualifies Article 37(11).16

§ II What is each representative actually mandated to do?

The mandates differ. The GDPR representative is addressable by authorities and data subjects (Article 27(4)); the DSA representative must receive and act on enforcement decisions (Article 13(2)); the AI Act representative verifies and retains conformity documentation (Article 54(3); Article 22(3) from 2027/2028); the NIS2 representative anchors jurisdiction; the Data Act representative must demonstrate the entity's compliance on request (Article 37(12)).

The GDPR representative is mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and by data subjects on all issues related to the processing (Article 27(4) GDPR). The private-facing dimension is unique among the five regimes: a data subject in the Union may approach the representative directly. The representative also maintains the record of processing activities where applicable (Article 30(1) GDPR), and its identity must appear in the transparency information given to data subjects under Articles 13(1)(a) and 14(1)(a) GDPR. Article 27 itself contains no list of mandate contents; the requirement of an explicit written mandate follows from Recital 80 GDPR.6

The DSA legal representative carries the broadest mandate: it must be empowered to be addressed by the Member States' competent authorities, the Commission and the European Board for Digital Services on all issues necessary for the receipt of, compliance with and enforcement of decisions issued in relation to the Regulation (Article 13(2) DSA). The provider must give the representative the necessary powers and sufficient resources to guarantee efficient and timely cooperation — a statutory resourcing requirement the other regimes do not spell out in the same terms.7

The AI Act authorised representative bears a documentation-centered catalog defined with product-safety precision, and it is the only one of the five spelled out as a closed list. For high-risk systems the catalog of Article 22(3) will apply from December 2027 and August 2028 respectively (§ V); it reads: verify that the EU declaration of conformity and the technical documentation have been drawn up and that the conformity-assessment procedure has been carried out; keep the documentation at the disposal of the competent authorities for ten years; provide information on reasoned request; cooperate with the authorities; and comply with the registration obligations under Article 49. For GPAI models (Article 54(3)), the catalog centers on the Annex XI technical documentation and the provider's obligations under Article 53 and, for systemic-risk models, Article 55, with the AI Office as the central counterpart. Both variants add a duty found nowhere else in the comparison: the representative must terminate the mandate and inform the competent authority — for GPAI models, the AI Office — if it considers or has reason to consider that the provider is acting contrary to its obligations (Articles 22(4), 54(5)).8

The NIS2 representative has the thinnest statutory profile of the five. Article 26(3) defines the role through its jurisdictional consequence — the entity is deemed to fall under the jurisdiction of the Member State where the representative is established — rather than through a task list. The operative content of the role therefore emerges from national transposition law and from the surrounding obligations of the Directive: the registration data to be submitted under Article 27, cooperation with the competent authorities and CSIRTs, and the entity's incident-notification duties under Article 23, for which the representative functions as the addressable Union presence.9

The Data Act legal representative is mandated to be addressed in addition to or instead of the entity by the competent authorities with regard to all issues related to that entity. Article 37(12) then adds an obligation with no direct counterpart among the five regimes compared here: the representative must cooperate with and "comprehensively demonstrate" to the competent authorities, upon request, the actions taken and the provisions put in place by the entity to ensure compliance. That is an active evidentiary duty, not a forwarding address — and it presupposes that the representative actually has access to the entity's compliance documentation.16

§ III Who can be held liable if the provider fails — the provider, the representative, or both?

Of the five regimes, only Article 13(3) DSA lets the representative itself be held liable for the provider's non-compliance. The GDPR knows no substitutive liability; fines may be addressed to it. The AI Act will fine its authorised representative for its own Article 22 breaches from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), Regulation (EU) 2026/1744.

The DSA particularity: own liability of the representative, Art. 13(3)

Article 13(3) DSA is the exceptional provision of the comparison: it expressly permits the legal representative to be held liable, in its own right, for the provider's non-compliance with the Regulation — additional to, not instead of, the provider's own liability. None of the other four regimes contains a comparable clause.10 The DSA adds a jurisdictional lever: under Article 56(6) DSA, the Member State where the legal representative resides or is established supplies the competent Digital Services Coordinator — for very large online platforms and search engines alongside the Commission; where no representative has been designated, Article 56(7) makes all Member States' coordinators competent, and the Commission as well for those providers, and the failure to designate is itself an infringement subject to penalties under the national rules adopted pursuant to Article 52 DSA.

The GDPR position is narrower, and it is more precisely documented than it is usually reported. According to the European Data Protection Board, the GDPR "does not establish a substitutive liability of the representative in place of the controller or processor it represents in the Union". At the same time, the concept was introduced precisely to enable enforcement: supervisory authorities may initiate enforcement proceedings through the representative, and that includes the possibility of addressing corrective measures or administrative fines imposed on the non-EU controller or processor to the representative, under Articles 58(2) and 83 GDPR. The representative's own direct liability, by contrast, is limited to its own obligations under Article 30 and Article 58(1)(a) GDPR. Recital 80 adds that the designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.11

The AI Act representative does not answer for the provider's substantive violations, but its own task catalog is fine-armored — with a date attached. Article 99(4)(b) AI Act attaches administrative fines to the authorised representative's non-compliance with its obligations under Article 22. The duties of the Article 54 representative for general-purpose AI models are not listed in Article 99(4), and Article 101 is directed at the providers of those models rather than at their representatives. Because Article 22 itself applies only from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), no Union fine provision yet targets the representative's own task catalog. That is not the same as immunity. Article 99(5) AI Act reaches anyone who, in reply to a request, supplies incorrect, incomplete or misleading information to a notified body or to a national competent authority — and, through the third subparagraph of the new Article 75c(4), to the AI Office — with fines of up to EUR 7.5 m or 1 % of worldwide turnover, whichever is higher. Article 99(1), as replaced by Regulation (EU) 2026/1744, requires the Member States to lay down penalties for any infringement of the Regulation by an operator — and an authorised representative is an operator, expressly so under Article 3(8) in conjunction with Article 3(5) AI Act, including the representative of a general-purpose AI model — subject, however, to Article 88(1) AI Act, under which the Commission alone supervises and enforces Chapter V, where the Article 54 duty sits. Article 75c(4), second subparagraph, point (a) adds fines for the "infringement of any applicable provision of this Regulation, including those not listed in Article 99(4)" — but only within the AI Office's own remit under Article 75(1), which covers certain AI systems rather than general-purpose AI models as such. Combined with the termination-and-alert duty, the AI Act turns its representative into an actively supervised compliance node rather than a passive contact point.

Under NIS2, the representative itself bears no express liability provision. The Directive's enforcement instruments — supervisory measures and administrative fines under Articles 32 to 34, applied through national law — are directed at the essential or important entity, and the fine ranges of Article 34 are tied to breaches of Articles 21 and 23, not to Article 26(3). Article 26(4) confirms that the designation of a representative is without prejudice to legal actions against the entity itself, and the final sentence of Article 26(3) supplies the sanction for omission: absent a designated representative, any Member State in which the entity provides services may take legal action against it for infringements of the Directive — a decentralised exposure functionally similar to the DSA's Article 56(7) scenario.12

The Data Act follows the NIS2 pattern and sharpens it. Article 37(13) provides that the entity is considered to be under the competence of the Member State in which its legal representative is located, that the designation is without prejudice to legal action against the entity — and that, "until such time as an entity designates a legal representative in accordance with this Article, it shall be under the competence of all Member States". The cost of doing nothing is therefore not primarily a fine; it is the loss of a single, predictable supervisory counterpart.16

§ IV Where must the designation be notified, registered or published?

Only the DSA requires a stand-alone notification to an authority: under Article 13(4) the provider notifies the representative's contact details to the Digital Services Coordinator and publishes them. Under NIS2 they travel with the registration under Article 27 NIS2, under the GDPR with the privacy notice and the Article 30 records; the Data Act has no register.

• GDPR: no register and no notification to a supervisory authority. The designation must be made in writing, and it surfaces through documentation: the representative's identity and contact details belong in the Article 13/14 transparency information addressed to data subjects and in the Article 30 records of processing.
• DSA: Article 13(4) requires the provider to notify the name, postal address, email address and telephone number of the legal representative to the Digital Services Coordinator of the Member State where the representative resides or is established, and to make that information publicly available, easily accessible, accurate and up to date — in practice on the provider's website. In Germany the addressee is the Digital Services Coordinator established within the Bundesnetzagentur in Bonn (§§ 12, 14 DDG).
• AI Act: for high-risk systems within Annex III — with the exception of point 2 of that Annex, which is registered nationally under Article 49(5) — the registration obligation of Article 49 leads into the EU database established under Article 71, and Article 49(1) names the authorised representative, where applicable, alongside the provider as registrant; from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), compliance with those duties will also form part of the representative's verified catalog under Article 22(3). For GPAI models there is no database registration; the representative acts as the documented contact point toward the AI Office.
• NIS2: Article 27 requires the entity types listed there — matching the Article 26(1)(b) categories — to submit their name, address, contact details, the Member States where they provide services and their IP ranges to the competent authority. Where the entity is not established in the Union, Article 27(2)(c) and (d) expressly call for the address and the contact details of the representative designated under Article 26(3): the designation is therefore notified as well, only as part of the registration rather than in a separate filing. The Member State's single point of contact forwards that information — the IP ranges excepted — to ENISA for a Union-level registry (Article 27(4)); the initial submissions were due by 17 January 2025, and the information must be kept current. In Germany, §§ 33 and 34 BSIG require registration with the Federal Office for Information Security (BSI) within three months, and § 34(1) nos. 3 and 4 BSIG expressly require the address and contact details of the representative designated under § 60(3) BSIG.13 The German implementation is set out in NIS2 in Germany: what non-EU tech companies must do.
• Data Act: no register and no notification duty. The designation becomes relevant through Article 37(13): it determines which Member State is competent — and, until it is made, every Member State is.

The designation is not an establishment — Article 13(5) DSA

Under none of the five regimes does the designation of a representative, by itself, constitute an establishment of the provider in the Union. The DSA states this expressly in Article 13(5): "The designation of a legal representative within the Union pursuant to paragraph 1 shall not constitute an establishment in the Union." For the GDPR, the European Data Protection Board reaches the same conclusion: the presence of the representative within the Union does not constitute an establishment of a controller or processor by virtue of Article 3(1) GDPR. The AI Act, NIS2 and the Data Act contain no comparable express clause in either direction; what they attach to the designation is supervisory jurisdiction, not establishment.14

§ V When does each duty apply — and which clocks are already running?

Each instrument’s duty is in force: the GDPR since 25 May 2018, the DSA since 17 February 2024, NIS2 since 18 October 2024 (Germany: 6 December 2025), AI Act Article 54 since 2 August 2025 and the Data Act since 12 September 2025. Only Article 22 of the AI Act is still ahead: 2 December 2027 and 2 August 2028.

• GDPR: Article 27 has applied since 25 May 2018 (Article 99(2) GDPR).
• DSA: the Regulation has applied in full since 17 February 2024 (Article 93(2) DSA); for designated very large online platforms and search engines, obligations began four months after their designation, in 2023.
• NIS2: Member States had to transpose the Directive by 17 October 2024 and to apply the transposing measures from 18 October 2024 (Article 41 NIS2); several Member States completed transposition only after that deadline, so the operative national law must be checked in each case. Germany's transposed BSI Act entered into force on 6 December 2025.
• AI Act: the timeline is staged by Article 113. The Regulation entered into force on 1 August 2024. Chapters I and II have applied since 2 February 2025, except for the prohibitions inserted by Regulation (EU) 2026/1744 (Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b)), which apply from 2 December 2026. The general-purpose AI provisions of Chapter V — including the Article 54 authorised-representative duty — have applied since 2 August 2025. Article 101 (Commission fines on providers of general-purpose AI models) has applied since 2 August 2026. Chapter III, Sections 1 to 3 — including the Article 22 authorised-representative duty — were deferred by Regulation (EU) 2026/1744 (OJ 24 July 2026, in force 27 July 2026), which amended Article 113: they apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 to systems classified as high-risk under Article 6(1) and Annex I product legislation.15
• Data Act: Regulation (EU) 2023/2854 has applied since 12 September 2025 (Article 50, second subparagraph). The representative duty of Article 37(11) has therefore been in force for a year, and it is the duty least often reflected in existing compliance documentation.16

For AI Act planning, the sequence matters in practice: a third-country GPAI-model provider has been under the Article 54 duty since August 2025, while the Article 22 duty for high-risk systems does not yet apply: it takes effect on 2 December 2027 (Annex III) and 2 August 2028 (Annex I) and is then a precondition to lawful market access, since the appointment must precede the making available of the system.

§ VI Can one entity hold several of these roles at once?

Yes. None of the five instruments forbids it, and consolidated representation is common. Three constraints apply: the seat rules must be satisfied simultaneously, each role needs its own written mandate with its own task catalog, and the entity accepting the DSA role accepts the own liability that comes with Article 13(3).

The five triggers overlap easily. A third-country provider operating an online marketplace processes personal data of Union users at scale (Article 27 GDPR), provides a hosting-type intermediary service (Article 13 DSA), and belongs to the "online marketplaces" category of Article 26(1)(b) NIS2 — which, because online marketplaces sit in Annex II rather than in the size-independent cases, obliges it under Article 26(3) NIS2 only if it also passes the scope test of Article 2 NIS2; if it also offers connected products or in-scope services under the Data Act, Article 37(11) joins the set, and if it places a general-purpose AI model on the Union market or makes a high-risk AI system available, Articles 54 or 22 AI Act do too. Each duty must be assessed and satisfied separately; none absorbs another, and the regimes contain no mutual-recognition clause.

May the same Union entity hold several of the roles? None of the five instruments forbids it, and the practice of consolidated representation is well established — the European Data Protection Board expressly notes that the function of representative can be exercised on the basis of a service contract and assumed by a wide range of entities, including law firms and consultancies, and that one representative may act for several non-EU controllers and processors. Three constraints shape the arrangement:

• Seat compatibility. The GDPR representative must be established in a Member State where the relevant data subjects are (Article 27(3)); the DSA representative in a Member State where the provider offers its services; the NIS2 representative in a Member State where the services are offered. The AI Act and Data Act representatives may be established anywhere in the Union. For a provider active in Germany, a German representative entity can satisfy all five seat rules at once — and, because the DSA, NIS2 and the Data Act tie supervisory competence to the representative's seat, the choice concentrates oversight in one Member State.
• Separate mandates. Each role rests on its own written designation with its own statutory task catalog: the GDPR mandate includes data-subject addressability; the DSA mandate covers receipt, compliance and enforcement of decisions and requires powers and resources; the AI Act mandate is documentation- and verification-centered and includes the termination duty; the NIS2 role anchors jurisdiction and registration; the Data Act mandate carries the duty to demonstrate compliance comprehensively on request. A single undifferentiated instrument covering "EU representation" across the regimes would misstate the legal position under each of them.
• Divergent risk positions. The entity accepting the DSA role accepts potential own liability under Article 13(3); the entity accepting the AI Act role accepts fine-armored duties of its own plus the obligation to disengage and alert the authorities; the GDPR role imports possible enforcement proceedings and direct liability for the representative's own duties under Article 30 and Article 58(1)(a). Prudent parties reflect these asymmetries in the contractual architecture — scope clauses, information flows, indemnities — rather than treating the five roles as one.

Where the representative function is to be outsourced rather than staffed in-house, you can see the representative services for each regime offered by Regingada UG (haftungsbeschränkt).

§ VII How do the five regimes compare at a glance?

All five regimes impose a designation duty — the youngest, Article 37(11) of the Data Act, since 12 September 2025; only Article 22 of the AI Act is still ahead (2 December 2027, 2 August 2028). They differ in four points: who is caught, where the representative sits, whether it is liable (only Article 13(3) DSA) and what omission costs.

The table below sets those four points and seven further criteria side by side, with the German and Union penalty provisions behind them.17

The table condenses; it does not decide. Whether a specific provider is caught by one, several or none of the five duties turns on service categorization under the DSA, the processing analysis under Article 3(2) GDPR, the risk classification of any AI system or model, the entity-category test of NIS2 and the scope test of the Data Act — five assessments that reward being run together, on one set of facts.