Which EU laws require a representative?
Five EU regimes require non-EU companies to designate an EU representative: Articles 27 GDPR, 13 DSA, 54 AI Act, 26(3) NIS2 and 37(11) Data Act. All five already apply. Article 22 AI Act does not apply yet: Regulation (EU) 2026/1744 moved it to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Art. 27 GDPR — non-EU controllers and processors, since 25 May 2018
- Art. 13 DSA — intermediary services offered in the EU, since 17 February 2024
- Art. 54 AI Act — authorised (US: authorized) representative for non-EU general-purpose AI model providers, since 2 August 2025
- Art. 22 AI Act — high-risk AI systems; deferred by Regulation (EU) 2026/1744 to 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
- Art. 26(3) NIS2 — the entity types it lists; transposed in Germany by the BSIG since 6 December 2025
- Art. 37(11) Data Act — connected products, related services and data processing services (cloud) offered in the EU, since 12 September 2025
Does the duty apply to your business model?
Your offering decides, not your location. Article 3(2) GDPR applies when you offer goods or services to people in the Union or monitor their behaviour there. The DSA has its own test, a “substantial connection to the Union” (Article 3(d), (e) DSA): targeting, or a number of EU users significant relative to population, since 17 February 2024.
| Your setup | Typical duties |
|---|---|
| SaaS or app used in the EU | Art. 27 GDPR; Art. 13 DSA once user content is hosted |
| Online marketplace or social platform | Art. 13 DSA (no threshold), Art. 27 GDPR, Art. 26(3) NIS2 typically from medium size |
| Cloud, data center, CDN, managed services; DNS, TLD registry or domain name registration service (any size) | Art. 26(3) NIS2; Art. 37(11) Data Act (cloud) |
| General-purpose AI model provider | Art. 54 AI Act, unless Art. 54(6) applies |
| Connected products and related services | Art. 37(11) Data Act |
Tasks, liability and timing side by side: the five representative duties compared.
When does each duty apply?
All five duties already apply: GDPR since 25 May 2018, DSA since 17 February 2024, Article 54 AI Act since 2 August 2025, Data Act since 12 September 2025, and the NIS2 duty through national implementing law (from 18 October 2024), in Germany through the BSIG since 6 December 2025.
Only Article 22 AI Act (high-risk systems) lies ahead; the deferring Regulation (EU) 2026/1744 is in force since 27 July 2026.
What does the representative actually do?
It is your address in the Union: authorities and, under the GDPR, data subjects turn to it instead of or alongside you. Under Article 30 GDPR it keeps the processing records; under Article 13(2) DSA it needs the powers and resources to cooperate.
Liability is graduated: the European Data Protection Board sees no substitutive liability under the GDPR (Guidelines 3/2018, v2.1), yet authorities may address corrective measures and fines to the representative (Articles 58(2), 83 GDPR) and it answers for its own duties under Articles 30 and 58(1)(a). Article 13(3) DSA goes further: it can be held liable itself.
What happens if you do not appoint one?
You lose the channeling of jurisdiction. Article 37(13) Data Act says so: until a representative is designated, all Member States are competent. The Dutch supervisory authority fined Locatefamily.com 525,000 euros under Article 27 GDPR for this gap, published 12 May 2021.
Penalty ranges by act: fines for not appointing an EU representative.
How do you appoint an EU representative?
In writing, and before you offer the service in the EU — not once a customer signs up: check which duties apply, choose a Member State that fits each regime, conclude the written mandate that Articles 27(1) GDPR and 13(1), (2) DSA require, hand over the required documents, and publish what the law requires.
Every step is in the guide how to appoint an EU representative. If you would rather not build it in-house: the attorney-owned EU representative service by Regingada UG.
When do you not need a representative?
An EU establishment carrying out the activity ends the duty under Articles 27 GDPR, 13 DSA, 26(3) NIS2 and 37(11) Data Act. Article 54 AI Act instead attaches to third-country providers, so an EU subsidiary alone is not enough. Article 22 will follow from 2 December 2027 and 2 August 2028.
- Art. 27(2) GDPR, cumulative: occasional processing, no large-scale Art. 9/10 data, no likely risk; plus public authorities.
- Art. 13 DSA: no exemption, no threshold.
- Art. 54(6) AI Act: free and open-source models with public weights, architecture and usage information — unless they present systemic risks.
- Art. 26(3) NIS2: the entity types in Art. 26(1)(b), mostly from medium size up; DNS, TLD registries and domain name registration services regardless of size (Art. 2(2)(a)(iii) and Art. 2(4) NIS2).
Borderline case? Discuss it with the attorney. If you want the representative function performed for you: Appoint a representative through Regingada UG →
The appointment itself is handled by Regingada UG (haftungsbeschränkt), a legally separate company owned by the attorney; legal assessment is a separate mandate with the law firm. Two contracts, invoiced separately; neither presupposes the other, no referral fees.
Questions we are asked
Does appointing a representative create an EU establishment?
No. Article 13(5) DSA states that the designation of a legal representative shall not constitute an establishment in the Union. The European Data Protection Board takes the same view for the GDPR: the presence of a representative does not make the controller established under Article 3(1).
Can you choose the Member State freely?
Not everywhere. Under Article 27(3) GDPR the representative must be established in a Member State where the data subjects are. The DSA and NIS2 point to a Member State where services are offered. The Data Act leaves the choice open.
Is our data protection officer also our representative?
They are two different roles: the representative under Article 27 GDPR and the data protection officer under Article 37 GDPR. The European Data Protection Board does not consider the two compatible where the DPO is external (Guidelines 3/2018, version 2.1) — an interpretation, not a statutory ban. The two roles side by side: EU representative vs. data protection officer.
We have an EU subsidiary — is that enough?
If the subsidiary is an establishment within the meaning of the regime in question and carries out the relevant activity, the designation duty falls away. Article 54 AI Act works differently: it attaches to providers established in a third country, and Article 22 will attach the same way from 2 December 2027 and 2 August 2028. Each act is assessed on its own facts.
Sources: Regulation (EU) 2016/679 (GDPR) · Regulation (EU) 2022/2065 (DSA) · Regulation (EU) 2024/1689 (AI Act) · Regulation (EU) 2026/1744 · Regulation (EU) 2023/2854 (Data Act) · Directive (EU) 2022/2555 (NIS2) · BSIG · EDPB, Guidelines 3/2018 on the territorial scope of the GDPR (v2.1) · Autoriteit Persoonsgegevens, fine on Locatefamily.com (12 May 2021) · boetebesluit of 10 December 2020 (PDF)
Theo Funk, Rechtsanwalt — admitted to the bar (Rechtsanwaltskammer Bamberg). Last reviewed: 12 September 2026.