Kanzlei Theo Funk provides legal advice on the EU representative obligations that apply to companies without an establishment in the Union: Art. 27 GDPR, Art. 13 DSA, Art. 54 AI Act — with Art. 22 AI Act from 2 December 2027 and 2 August 2028 —, Art. 26(3) NIS2 and Art. 37(11) Data Act. The advisory work covers four recurring situations: determining whether a designation duty applies, drafting and negotiating the written mandate, advising while the representation is in place, and acting in administrative and fine proceedings — including communications with European supervisory authorities, including the Bundesnetzagentur as Germany’s Digital Services Coordinator.
Legal advice is provided by the law firm under an attorney-client mandate. The representative function itself is a separate, non-advisory service: clients may appoint Regingada UG (haftungsbeschränkt), another representative, or use their own EU structure. There are no referral fees or commissions.
At the client’s election, Regingada UG (haftungsbeschränkt) assumes the named representative role under its own contract. The two engagements coordinate directly and on an ongoing basis, so clients need not mediate between advice and representation. The commercial terms stay apart throughout: two contracts, concluded and invoiced separately; neither appointment presupposes the other; clients remain free to name a different representative; and the firm takes no referral fee or commission.
Do you need a representative under Art. 27 GDPR?
Yes, if your processing falls under Art. 3(2) GDPR and no exemption in Art. 27(2) GDPR applies; the duty has applied since 25 May 2018. The firm checks the trigger, drafts the written designation and advises on Arts. 13, 14 and 30 GDPR. Scope test: which EU regimes require a representative, and when they do not.
Named representative function: GDPR Article 27 representative. Appointment itself is handled by Regingada UG (haftungsbeschränkt), a legally separate company owned by the attorney; legal assessment is a separate mandate with the law firm.
Who must appoint a legal representative under Art. 13 DSA?
Every provider of intermediary services offering them in the Union without an EU establishment, with no user, revenue or size threshold; the duty has applied since 17 February 2024. The firm advises on service categorisation, mandate scope, Art. 13(2) resources and Art. 13(3) own liability. Trigger, liability and notification: the Article 13 DSA representative in detail.
Named representative function: DSA Article 13 legal representative — performed by Regingada UG (haftungsbeschränkt).
When does the AI Act require an authorised representative?
For general-purpose AI models since 2 August 2025 (Art. 54), unless the open-source exemption in Art. 54(6) applies; for high-risk systems (Art. 22) only from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), Regulation (EU) 2026/1744. The firm advises on classification, timing and the written mandate. See the AI Act row of the five-regime comparison.
Named representative function: AI Act authorised representative (Art. 54; Art. 22 from 2 December 2027 for Annex III and 2 August 2028 for Annex I, Regulation (EU) 2026/1744) — performed by Regingada UG (haftungsbeschränkt).
Does NIS2 require an EU representative?
Yes, for the entity types in Art. 26(1)(b) NIS2 — DNS, cloud, data-centre, managed-service and marketplace providers — that offer services in the Union without an establishment there and fall within the scope of Art. 2 NIS2: as a rule from the medium-sized-enterprise threshold up (Art. 2(1)), regardless of size for TLD name registries and DNS service providers (Art. 2(2)(a)) and for domain name registration services (Art. 2(4)). Germany transposed this in § 60(3) BSIG, in force since 6 December 2025. Detail: NIS2 in Germany: representative and registration under the BSIG.
Named representative function: NIS2 representative under Article 26(3) — performed by Regingada UG (haftungsbeschränkt).
Does the Data Act require an EU representative?
Yes, for providers of data processing services and manufacturers of connected products that make them available in the Union without being established there; the duty has applied since 12 September 2025 (Art. 50 Data Act). Until a representative is designated, Art. 37(13) places the entity under the competence of all Member States. Comparison: the Data Act column of the five-regime comparison.
Named representative function: Data Act legal representative under Article 37(11) — performed by Regingada UG (haftungsbeschränkt).
For a systematic five-regime comparison of these duties — triggers, task catalogues, liability profiles and timelines — see the analysis EU Representative Duties Compared.
Step by step, the guide how to appoint an EU representative sets out the scope check, the choice of Member State, the written mandate, publication and notification.
Whether one, several or none of these duties applies to your company depends on your service type, your data processing, any AI system or model involved and your entity category under NIS2. Get in touch to discuss an initial assessment.
Transparency notice: Kanzlei Theo Funk and Regingada UG (haftungsbeschränkt) are legally separate; Regingada UG is wholly owned by attorney Theo Funk. Representative services are contracted and invoiced separately.