EU representative services for companies without an EU establishment
Five EU digital acts require companies with no establishment in the Union to designate a representative there — the GDPR and NIS2 call the role a representative, the DSA a legal representative, the AI Act an authorised (US: authorized) representative, the Data Act a legal representative under Article 37(11); the Data Governance Act adds a sixth role for data intermediation services and data altruism organisations (Articles 11(3) and 19(3)). Regingada UG (haftungsbeschränkt) takes on these six named roles under fixed annual fees, from its registered seat in Bamberg, Germany.
Software & appointed EU representation: Regingada UG (haftungsbeschränkt) · Legal advice exclusively: the law firm Theo Funk — separate mandate
Which representative roles can Regingada take on?
Regingada UG (haftungsbeschränkt) takes on six named representative roles — GDPR Article 27, DSA Article 13, AI Act Article 54, NIS2 Article 26(3), Data Act Article 37(11) and the Data Governance Act role. Each one is a separate designation with its own written mandate: one provider and one onboarding, but never one blanket appointment.
| Regime and norm | What Regingada takes on | Fixed annual fee |
|---|---|---|
| GDPR Article 27 Regulation (EU) 2016/679 · applies since 25 May 2018 |
Named addressee for supervisory authorities and data subjects (Article 27(4)); the record of processing activities kept by the representative (Article 30); a documented forwarding channel to your team. | from €490 / year |
| DSA Article 13 Regulation (EU) 2022/2065 · applies since 17 February 2024 |
Named legal representative for Member State authorities, the Commission and the Board (Article 13(2)); notification of the contact details to the Digital Services Coordinator (Article 13(4)) on your behalf; the Article 11 point of contact. | from €1,480 / year |
| AI Act Article 54 Regulation (EU) 2024/1689 · Article 54 applies since 2 August 2025 |
Authorised representative for providers of general-purpose AI models: the mandate tasks of Article 54(3), documentation kept at the disposal of the AI Office, cooperation on request. | from €690 / year |
| NIS2 Article 26(3) Directive (EU) 2022/2555 · in Germany § 60(3) BSIG, in force since 6 December 2025 |
Representative for the entity types listed in Article 26(1)(b) that are within the scope of NIS2 — from medium-sized enterprise upwards (Article 2(1)), while DNS service providers, TLD name registries (Article 2(2)(a)) and registrars (Article 2(4)) are caught regardless of size; the representative's address and contact details for the BSI registration under § 34 BSIG. | quoted individually |
| Data Act Article 37(11) Regulation (EU) 2023/2854 · applies since 12 September 2025 |
Legal representative addressed in addition to or instead of the entity, who must demonstrate your compliance measures to the competent authorities on request (Article 37(12)). | from €1,480 / year |
| DGA Articles 11(3) and 19(3) Regulation (EU) 2022/868 · applies since 24 September 2023 |
Legal representative for data intermediation services (Article 11(3)) and for entities registering as data altruism organisations (Article 19(3)), in each case established outside the Union; the designation also fixes which Member State has jurisdiction. | quoted individually |
Authorised representation for high-risk AI systems under Article 22 AI Act is quoted separately: that duty does not apply yet — Regulation (EU) 2026/1744 moved it to 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems). See the full price list →
Looking for the legal comparison rather than the service? The law firm Theo Funk sets the five duties side by side in EU representative duties compared — GDPR, DSA, AI Act, NIS2 and the Data Act.
Scope check before the designation
Designation is not automatic: without an EU establishment, it depends on what you offer (GDPR, DSA), monitoring behaviour in the Union (GDPR), your AI model (AI Act) or your entity type or role (NIS2, Data Act), several with exemptions. Whether a duty applies is a question for the law firm: which EU representative duty applies to your business model.
How does onboarding with Regingada work?
Three steps per regime: scoping, representation contract, notification. Several regimes run through one onboarding, one point of contact and one invoice cycle, and each still rests on its own designation. Onboarding runs in English, with responses within one business day, CET/CEST; notification to authorities follows only after the mandate is signed.
-
Scoping
A guided question set records your establishment, your services and your EU nexus, and produces a structured self-assessment record — orientation, not a legal determination.
-
Representation contract
One written mandate per regime, naming tasks, information channels, escalation paths and response times. Several regimes can run under one onboarding and one invoice cycle — but never under one designation.
-
Notification and handover
Where the regime requires it, the designation is notified and published: the Digital Services Coordinator under Article 13(4) DSA, the BSI registration under § 34 BSIG, your privacy notice under Articles 13 and 14 GDPR.
The step-by-step version, written by the law firm: how to appoint an EU representative. Appointment itself is handled by Regingada UG (haftungsbeschränkt), a legally separate company owned by Theo Funk, a German attorney (Rechtsanwalt); legal assessment is a separate mandate with the law firm.
Which page covers your regime?
Each regime has its own page: the GDPR page covers Article 27, the DSA page Article 13, the AI Act page Article 54, the NIS2 page Article 26(3), the Data Act page Article 37(11) and the DGA page Articles 11(3) and 19(3). Every page names the tasks of that role and what it costs: a published fee band for the GDPR, DSA, AI Act and Data Act roles, an individual quotation for NIS2 and the DGA.
-
GDPR · Art. 27
GDPR Representative
For controllers and processors outside the EU that offer goods or services to, or monitor, people in the Union.
To the service page → -
DSA · Art. 13
DSA Legal Representative
For providers of intermediary services — hosting, platforms, marketplaces, search engines — without an EU establishment.
To the service page → -
AI Act · Art. 54
AI Act Authorised Representative
For third-country providers of general-purpose AI models — and, from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), of high-risk AI systems.
To the service page → -
NIS2 · Art. 26(3)
NIS2 EU Representative
For DNS, cloud, data-center, CDN, managed-service and platform entities that offer services in the Union without being established there.
To the service page → -
Data Act · Art. 37(11)
Data Act EU Representative
For non-EU manufacturers, IoT vendors and cloud providers that offer connected products, related services or data processing services in the Union.
To the service page → -
Data Governance Act · Art. 11 / 19
DGA Legal Representative
For non-EU data intermediation services (Art. 11(3)) and data altruism organisations (Art. 19(3)) that offer their services in the Union.
To the service page → -
US companies
EU Representative for US Companies
The US-facing overview: which duties typically hit US SaaS, marketplaces, platforms and AI providers, how onboarding runs, what it costs.
To the segment page → -
Pricing
Representative price list
Published annual fees for the GDPR, DSA, AI Act and Data Act roles, individual quotations for NIS2 and the DGA, plus the multi-regime discount and the commercial terms.
To the price list →
Start the scoping for a regime — orientation, not legal advice.
Auf Deutsch: EU-Vertretung im Überblick · EU-Vertreter nach Art. 27 DSGVO · DSA-Rechtsvertreter nach Art. 13 · KI-VO-Bevollmächtigter nach Art. 54 · NIS2-EU-Vertreter nach Art. 26 Abs. 3 · Data-Act-Vertreter nach Art. 37 Abs. 11
What do companies ask before the mandate?
Can one provider hold several representative roles at once?
Yes — Regingada UG (haftungsbeschränkt) can hold the GDPR, DSA, AI Act, NIS2, Data Act and DGA roles for the same company. Each role rests on its own written mandate with its own tasks, because the acts define the tasks differently — the AI Act with a minimum catalogue the mandate must cover (Article 54(3)), the GDPR without one. One onboarding, several designations.
Does designating a representative create an establishment in the Union?
No. Article 13(5) DSA rules it out expressly for the DSA. The GDPR has no such sentence: under recital 80 the representative acts on behalf of the controller or processor, and Article 27(5) GDPR leaves legal action against the company itself untouched. The provision in full, with what it does and does not change: does appointing a representative create an EU establishment?
In which Member State does the representative have to be?
It depends on the act. Article 27(3) GDPR requires a Member State where data subjects are; Article 13(1) DSA and Article 26(3) NIS2 point to one where services are offered; Article 37(11) Data Act leaves the choice open. Regingada is established in Bamberg, Germany. The sequence of steps: appointing a representative, step by step.
Why Germany?
Because of § 60(3), third sentence, BSIG: with the NIS2 representative in Germany, the Federal Office for Information Security (BSI) is competent for the entity — and under Article 26(3), third sentence, NIS2 the entity is considered to fall under that Member State's jurisdiction. For the DSA, the German Digital Services Coordinator sits at the Bundesnetzagentur, Bonn (§§ 12, 14 DDG).
Is this legal advice?
No. Regingada UG (haftungsbeschränkt) is the software and EU-representation company, owned by Theo Funk, a German attorney (Rechtsanwalt). It does not provide legal advice. Legal assessment, submissions to authorities and representation before them are services of the law firm Theo Funk under a separate mandate.
What happens if no representative is designated?
It differs by act; a fine is not automatic. Under the Data Act an entity without a designated representative “shall be under the competence of all Member States” (Article 37(13)). Under the GDPR the Dutch supervisory authority fined Locatefamily.com €525,000 for the missing representative alone, published on 12 May 2021. The frameworks: fines for not appointing an EU representative.
One provider, six designations, transparent fees.
Tell us where you are established and what you offer in the Union — we will tell you which designations we can hold for you and what they cost — whether a duty applies in your case is a legal question for the law firm.
Contact Regingada →Legal advice on representative obligations — the law firm Theo Funk (separate mandate)
Who stands behind the representative role?
Regingada UG (haftungsbeschränkt), Bamberg, Germany — HRB 12595, Amtsgericht Bamberg (local court, commercial register) — is owned by Theo Funk, a German attorney (Rechtsanwalt). It holds the appointed representative role and builds the software; it does not give legal advice. Legal assessment is a separate mandate with the law firm Theo Funk, which is bound by professional secrecy (§ 43a BRAO). Two contracts, billed separately: neither engagement requires the other, and no referral fees are paid in either direction.
Last reviewed: 27 September 2026