The EU representative under Article 37 of the Data Act
Any entity that falls within the scope of Regulation (EU) 2023/2854 (the Data Act), makes connected products available or offers services in the Union, and is not established in the Union must designate a representative in one of the Member States (Art. 37(11)). Regingada UG (haftungsbeschränkt) takes on this named role under its own representative contract: acting as the point of contact for competent authorities and providing documentation and compliance-evidencing support — but not legal advice.
Data Act EU representative service for non-EU manufacturers, IoT vendors and cloud providers offering connected products, related services or data processing services in the Union.
Software and designated EU representative: Regingada UG (haftungsbeschränkt) · Legal advice exclusively by: Kanzlei Theo Funk — separate mandate
Who must designate an EU representative under Article 37
Article 37(11) of the Data Act ties the obligation to establishment status: any entity within the scope of the Regulation that makes connected products available or offers services in the Union and is not established in the Union must designate a representative in one of the Member States. The requirement follows your business activity in the Union, not your place of incorporation.
The Regulation’s scope covers several roles: manufacturers of connected products and providers of related services (the design and information duties of Art. 3); data holders making data available at the request of a user or a third party (Arts. 4 and 5); data recipients receiving data under Art. 5 (Art. 6); and providers of data processing services (cloud/edge) (switching duties from Art. 23 onwards, jurisdiction transparency under Art. 28, third-country access safeguards under Art. 32). A non-EU entity in any of these roles falls within the representative-designation duty of Art. 37(11).
Any entity within scope that makes connected products available or offers services in the Union and is not established in the Union must designate a representative in one of the Member States (Art. 37(11)). The entity falls under the jurisdiction of the representative’s Member State (Art. 37(13)).
The micro/small-enterprise scope question — Article 7(1)
The Chapter II data-access obligations of the Data Act do not apply to data from connected products or related services manufactured or provided by micro or small enterprises (Rec. 2003/361/EC), provided there is no non-small partner/linked enterprise and no subcontracting constellation; medium-sized enterprises are covered only after the one-year thresholds (Art. 7(1)). The Art. 37(11) representative duty itself is assessed on scope and establishment status — the specific size classification is a matter for the law firm under a separate mandate.
The function of the designated Data Act representative
The representative is mandated by the entity to serve as the point of contact for competent authorities — in addition to or instead of the entity itself — on matters concerning the application and enforcement of the Regulation. The representative cooperates with the authorities and, on request, demonstrates comprehensively the compliance measures taken by the entity (Art. 37(12)). Unlike GDPR Art. 27, Article 37 of the Data Act makes the representative the addressee for competent authorities (not for data subjects).
- A designated point of contact in the Union for competent authorities on the application of the Regulation (Art. 37(12))
- Cooperation with the competent authorities on supervision and enforcement needs (Art. 37(12))
- Compliance-evidencing support — demonstrating comprehensively, on request of the authority, the compliance measures taken by the entity (Art. 37(12))
- Jurisdiction — the entity falls under the jurisdiction of the representative’s Member State (Art. 37(13))
The entity falls under the jurisdiction of the representative’s Member State; absent designation, potentially under the jurisdiction of all Member States; designation is without prejudice to the entity’s own liability (Art. 37(13)).
The designation is a written designation in a Member State (Art. 37(11)) and is included in the entity’s documentation as part of the authority-facing compliance evidence (Art. 37(12)).
How it works
Three steps take you from Article 37 scoping to an authority-facing, documented representative function.
-
Scoping
A guided question set recording your Data Act role (manufacturer / related service / data holder / data recipient / data processing service), your Union-offering situation and establishment status.
Deliverablea structured self-assessment record of your Art. 37(11) status — not a legal determination; for a legal determination the law firm advises under a separate mandate.
-
Written mandate
We prepare the in-Member-State representative designation required by Art. 37(11) and a representative contract defining tasks, information channels and response times.
Deliverablea draft written designation and representative contract — model clauses on request.
-
Go-live and evidence-ready
Bring the authority-facing contact channel online and keep the compliance-evidencing process (Art. 37(12)) ready on request.
Deliverablean onboarding pack — authority point-of-contact registration, an authority-communication channel via the representative, and a compliance-evidence collection and forwarding process.
A named role, held by a registered company.
“Article 37(11) is an operational role: competent authorities must be able to reach someone in the Union who cooperates and, on request, demonstrates the entity’s compliance measures. Regingada takes on that named role under its own contract. Legal judgement is handled by my law firm under a separate mandate.”
Regingada UG (haftungsbeschränkt), HRB 12595, AG Bamberg
Appointed EU representative & software: Regingada UG (haftungsbeschränkt) — wholly owned by German attorney Theo Funk, no legal advice · Legal advice: independent law firm Kanzlei Theo Funk (RAK Bamberg) — separate mandate.
EU data discipline → Trust Center · security.txt (RFC 9116)
The same regulatory corpus powers the Regingada Compliance Suite — digital-twin software that maps the Data Act alongside the GDPR, the DSA, the AI Act, the DMA and NIS2.
From the Regingada Radar — we track what we represent
Data Act representative vs. DSA representative vs. GDPR Article 27 representative
All three regimes require an entity not established in the Union to designate an EU representative, but the triggers, the subject matter and the addressee differ. Assess them separately — where several apply, make a separate written designation for each.
| Data Act representative (Art. 37(11)) | DSA legal representative (Art. 13) | GDPR representative (Art. 27) | |
|---|---|---|---|
| Legal basis | Art. 37(11) Reg. (EU) 2023/2854 | Art. 13 Reg. (EU) 2022/2065 | Art. 27 Reg. (EU) 2016/679 |
| Subject matter | Connected-product and related-service data; data processing services (cloud/edge) — non-personal and personal data | Intermediary services (transmission, caching, hosting, platforms, search engines) | Processing of personal data of data subjects in the Union (GDPR Art. 3(2)) |
| Addressee | Competent authorities — in addition to or instead of the entity (Art. 37(12)) | Member State authorities, the Commission and the Board (DSA Art. 13) | Supervisory authorities and data subjects (GDPR Art. 27(4)) |
| Service page | (this page) | DSA legal representative → | GDPR Article 27 representative → |
Data Act Art. 37(11), DSA Art. 13 and GDPR Art. 27 belong to the same family of EU-representative obligations (Data Act Art. 37(11)). Their triggers are independent: a non-EU entity may need only one, or several at once. If you are unsure which one(s) apply, consult Kanzlei Theo Funk (separate mandate).
Switching your Data Act representative
The following describes Regingada’s service practice when taking over or handing over a representative mandate (not a Data Act requirement). A mandate can change when a provider leaves the market, a contract ends or a group reorganises; the practice focuses on avoiding a representation gap and handing over authority-facing matters cleanly.
- Overlap, not a gap — dovetail the termination of the old mandate with the new in-Member-State written designation (Art. 37(11)), so there is no window without a representative in the Union
- Update the compliance documentation — record the current representative’s identity and contact details and keep the authority-facing channel in sync
- Hand over matters — pending authority matters, compliance-evidence materials (Art. 37(12)) and communication logs pass to the new representative with a clear handover date
We take over an existing Art. 37(11) mandate through a structured handover — and hand over the same way if you leave in future. The audit record is yours, not ours.
Three non-EU scenarios that trigger the Article 37(11) duty
The duty follows your business activity in the Union, not your corporate structure. Three patterns we see repeatedly:
-
Art. 37(11) · Art. 3(1) (Art. 50)
Non-EU connected-product manufacturer
A manufacturer of IoT/connected products incorporated outside the Union, with no EU entity, makes connected products available on the EU market. For connected products placed on the market after 12 September 2026, data accessibility must be ensured by design (Art. 3(1) read with Art. 50), and the non-EU manufacturer must designate a representative in a Member State (Art. 37(11)).
-
Art. 37(11) · Art. 23 ff. · Art. 28 · Art. 32
Non-EU cloud / data processing service
A non-EU provider offering cloud or edge data processing services in the Union must remove switching obstacles and phase out switching charges (Art. 23 ff., Art. 29), publish jurisdiction and third-country-access safeguards on its website (Art. 28), and safeguard against unlawful third-country governmental access to non-personal data held in the Union (Art. 32) — and must designate a representative (Art. 37(11)).
-
Art. 37(11) · Art. 4/5 (data holder) · Art. 3 (related service)
Non-EU data holder / related service
A non-EU entity acting as a data holder must make readily available data accessible to the user on request (Art. 4) and share data with third parties at the user’s (or its agent’s) request (Art. 5); providers of related services carry their own design and information duties under Art. 3. Offering such connected products or services in the Union without being established there triggers the designation duty (Art. 37(11)).
What drives the fee
The fee for a Data Act Art. 37(11) representative mandate depends on the work the role actually requires: the roles that apply to you (manufacturer / related service / data holder / data recipient / data processing service), the expected volume of competent-authority contact, documentation and compliance-evidencing needs (Art. 37(12)), and whether the role is combined with GDPR Art. 27, DSA Art. 13 or AI Act Art. 22 representative duties (a multi-regime set-up can lower coordination costs).
Data Act Art. 37(11) representative: on request.
Specific figures will be published with the price-list update; this page does not list price figures. See the full price list →
Frequently asked questions
Who must designate an EU representative under the Data Act?
Any entity within the scope of Regulation (EU) 2023/2854 (the Data Act) that makes connected products available or offers services in the Union and is not established in the Union must designate a representative in one of the Member States (Art. 37(11)). This covers non-EU entities acting as connected-product manufacturers, related-service providers, data holders, data recipients and providers of data processing services within their role.
What is the function of the Data Act representative, and how does it differ from the GDPR Article 27 representative?
The representative serves as the point of contact for competent authorities — in addition to or instead of the entity — cooperates with them and, on request, demonstrates comprehensively the compliance measures taken by the entity (Art. 37(12)). Unlike GDPR Art. 27, Article 37 of the Data Act makes the representative the addressee for competent authorities; the GDPR Art. 27 representative is addressed by supervisory authorities and data subjects (Art. 27(4) GDPR).
Does designating a representative affect our own liability?
No. The entity falls under the jurisdiction of the representative’s Member State; absent designation, potentially under the jurisdiction of all Member States; the designation is without prejudice to the entity’s own liability (Art. 37(13)).
Can the Data Act representative be combined with other EU-representative duties?
Article 37(11) of the Data Act belongs to the same family of EU-representative obligations as GDPR Art. 27, DSA Art. 13 and AI Act Art. 22. Where several duties apply to the same entity, each requires its own written designation; a combined set-up can lower coordination costs. For scope questions, consult the independent law firm (separate mandate).
What are the consequences of no designation?
Without a designation, the entity may fall under the jurisdiction of all Member States rather than only the representative’s (Art. 37(13)). On penalties, Member States must lay down effective, proportionate and dissuasive rules; for infringements of Chapters II, III and V, the data-protection supervisory authorities may impose fines within their competence under Article 83 GDPR (Art. 40). This page does not restate specific penalty amounts.
Is there a micro/small-enterprise exemption?
The Chapter II data-accessibility obligations of the Data Act do not apply to data from connected products or related services manufactured or provided by micro or small enterprises (Rec. 2003/361/EC), provided there is no non-small partner/linked enterprise and no subcontracting constellation (Art. 7(1)). The Art. 37(11) representative duty itself is assessed on scope and establishment status — the specific applicability is a matter for the law firm under a separate mandate.
Is this legal advice?
Regingada UG (haftungsbeschränkt) is the software and EU-representation company, wholly owned by attorney Theo Funk. It does not provide legal advice. For legal advice under a separate mandate, please see the independent law firm Kanzlei Theo Funk.
What does it cost?
The fee for a Data Act Art. 37(11) representative mandate depends on the roles that apply to you, the expected volume of competent-authority contact, documentation and compliance-evidencing needs (Art. 37(12)), and whether the role is combined with other EU-representative duties. On request — see the price list at regingada.com/pricing. This page does not list price figures.
Designate your Article 37(11) EU representative.
Start with a scoping check — it records your Data Act role, your Union-offering situation and your Art. 37(11) status, and takes you straight to a representative-mandate request.
Contact Regingada — book a representative-service scoping →Legal advice on representative obligations — Kanzlei Theo Funk (separate mandate)