NIS2 EU Representative under Article 26(3)
Certain digital-infrastructure and digital-service entities — from DNS and cloud providers to online marketplaces — that are not established in the European Union but offer services within the Union must designate a representative in the Union, established in one of the Member States where those services are offered (Article 26(3) of Directive (EU) 2022/2555 — NIS2). Regingada UG (haftungsbeschränkt) takes on that named role under its own representation contract: reachability for competent authorities and CSIRTs, routing and documentation — not legal advice.
NIS2 EU representative service for non-EU DNS, cloud, data-centre, CDN, managed-service, marketplace, search-engine and social-networking providers.
Software & appointed EU representation: Regingada UG (haftungsbeschränkt) · Legal advice exclusively: the law firm Theo Funk — separate mandate
Who must designate a NIS2 EU representative?
Article 26(3) of Directive (EU) 2022/2555 (NIS2 Directive), read together with Article 26(1), point (b), addresses a closed catalogue of entity types: DNS service providers, top-level domain (TLD) name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, and providers of online marketplaces, of online search engines and of social networking services platforms. The entity type is only half the test: under Article 2(1) NIS2 the Directive reaches those entities from medium-sized enterprise upwards, while DNS service providers, TLD name registries (Article 2(2)(a)) and providers of domain name registration services (Article 2(4)) are caught regardless of size — as are the further cases of Article 2(2)(b) to (e) and Article 2(3).
If such an entity is not established in the Union but offers services within the Union, it must designate a representative in the Union. The representative must be established in one of the Member States where the services are offered (Article 26(3) NIS2).
One point matters for implementation: NIS2 is a directive, not a regulation. It binds the Member States, which transpose it into national law — the Directive set 17 October 2024 as the transposition deadline (Article 41 NIS2). The operative obligations for your entity therefore follow from national transposition, and details vary by Member State. In Germany, national transposition proceeds through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz — NIS2UmsuCG).
Why does it matter that the representative sits in Germany?
Because German law turns the seat of the representative into the seat of supervision. The new BSI Act (BSIG) has been in force since 6 December 2025. Its § 60(3) BSIG repeats the designation duty for exactly the entity types of Article 26(1)(b) and then adds the sentence that matters: if the representative is established in the Federal Republic of Germany, the Federal Office for Information Security (BSI) is the competent authority for the entity (§ 60(3), third sentence, BSIG). Supervision is then anchored in a single Member State: under Article 26(3), third sentence, NIS2 the entity is considered to fall under the jurisdiction of the Member State where its representative is established. If no representative is designated anywhere in the Union, the BSI may declare itself competent for the entity (§ 60(3), fourth sentence, BSIG).
The second half of the German regime is registration. § 34(1) BSIG requires the entity types of § 60(1) to submit their data to the BSI within three months — including, where the entity is not established in the Union, the address (no. 3) and the contact details (no. 4) of the representative designated under § 60(3). Changes must follow, at the latest within three months (§ 34(2) BSIG); the data are forwarded to ENISA (§ 34(3) BSIG). For entities already covered when the Act entered into force, the three months ran out on 6 March 2026.
The fines of Article 34 NIS2 — at least €10 million or 2% of turnover — attach to Articles 21 and 23, not to a missing representative. In Germany the fine attaches to the missing registration: up to €500,000 (§ 65(2) no. 6, § 65(5) no. 5 BSIG). Penalties for a missing EU representative, regime by regime.
What does the NIS2 representative do?
The Directive defines the representative as a natural or legal person established in the Union, explicitly designated to act on behalf of one of the Article 26(1), point (b), entities not established in the Union, which may be addressed by a competent authority or a CSIRT in the place of the entity itself with regard to that entity’s obligations under the Directive (Article 6 NIS2).
- Named EU addressee — competent authorities and CSIRTs can turn to the representative instead of the entity itself on the entity’s NIS2 obligations
- Routing — documented, timely forwarding of authority and CSIRT correspondence to the people you designate, with a defined escalation path
- Registration data — the representative’s address is part of your Article 27 NIS2 submission; we keep it accurate and update-ready
- Documentation — a written record of receipt, forwarding and follow-up
Once designated, the entity is deemed to be under the jurisdiction of the Member State where its representative is established (Article 26(3) NIS2). The representative’s seat therefore becomes the supervisory anchor.
Without a designated representative, the final sentence of Article 26(3) NIS2 provides that any Member State in which the entity provides services may take legal actions against the entity for infringements of the Directive. Unlike Article 13(3) of the Digital Services Act, Article 26 NIS2 ties the designation to jurisdiction rather than to an express representative-liability rule — our representation contract still defines duties, information flows and escalation paths precisely.
How does the designation work?
Three steps take you from Article 26 scoping to registration data and a documented representative function.
-
Scoping
A guided question set — the same wizard you can start on this page — records your entity type against the Article 26(1), point (b), catalogue, your establishment and your EU service footprint.
Deliverablea structured self-assessment record of your Article 26(3) status — not a legal determination; for that, the law firm advises under a separate mandate.
-
Representation contract
We prepare the representation contract that names the role and its limits: tasks, information channels, escalation paths, response times — and records the jurisdictional consequence of the representative’s German seat.
Deliverablea draft representation contract naming role, duties and information flows — model terms on request.
-
Registration & handover
We assemble the representative details for your registration under Article 27 NIS2 and put the operational contact channel for competent authorities and CSIRTs in place.
Deliverablea registration data package for the Article 27(2) NIS2 submission to the competent national authority, plus a documented contact channel.
How does the NIS2 representative differ from the GDPR representative?
Different acts: Article 26(3) NIS2 anchors jurisdiction where your representative sits; Article 27 GDPR only creates a contact point. One provider may hold both, each by its own written designation.
Side by side: EU representative duties compared (law firm Theo Funk). Our Article 27 service.
A named role, held by a registered company.
“Under NIS2 the seat of the representative is not a formality — the entity is deemed subject to the jurisdiction of the Member State where its representative sits. That anchor, plus reliable reachability for authorities and CSIRTs, is what Regingada holds under its own contract. Legal judgment stays with my firm, under a separate mandate.”
Regingada UG (haftungsbeschränkt), HRB 12595, AG Bamberg
Appointed EU representative & software: Regingada UG (haftungsbeschränkt) — owned by Theo Funk, a German attorney (Rechtsanwalt), no legal advice · Legal advice: independent law firm Theo Funk (RAK Bamberg) — separate mandate.
EU data discipline → Trust Center · security.txt (RFC 9116)
The same regulatory corpus powers the Regingada Compliance Suite — digital-twin software that maps NIS2 alongside the GDPR, the DSA, the AI Act and the DMA.
What does a NIS2 representative cost?
The engagement is priced by what the role actually has to carry: your entity type and the scope of your services, the Member States where you offer them, the expected volume of contacts from competent authorities and CSIRTs, registration and update duties under Article 27 NIS2, whether the role is combined with Article 27 GDPR, DSA or AI Act representation (multi-regime setups reduce coordination overhead), and the response times we commit to.
Engagement terms on request.
Fixed price bands for the DSA, AI Act, GDPR and Data Act roles are published in the representative price list.
Frequently asked questions
Who must designate an EU representative under Article 26(3) NIS2?
Entities listed in Article 26(1), point (b), of Directive (EU) 2022/2555 (NIS2): DNS service providers, top-level domain (TLD) name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, and providers of online marketplaces, of online search engines and of social networking services platforms — where the entity is not established in the European Union but offers services within the Union. Article 2(1) NIS2 adds a size condition for most of them (medium-sized enterprise upwards); DNS service providers, TLD name registries (Article 2(2)(a)) and domain name registration services (Article 2(4)) are caught regardless of size.
In which Member State must the NIS2 representative be established?
In one of the Member States where the services are offered (Article 26(3) NIS2). The choice carries more weight than under other regimes: the entity is deemed to be under the jurisdiction of the Member State where its representative is established. Regingada UG (haftungsbeschränkt) is established in Bamberg, Germany — with Regingada as representative, that anchor is Germany.
What is the jurisdictional effect of designating a representative?
Under Article 26(3) NIS2, an entity that has designated a representative is deemed to be under the jurisdiction of the Member State where the representative is established. Supervision then follows that Member State’s transposition of the Directive — one anchor instead of a patchwork.
What happens if we do not designate a representative?
The final sentence of Article 26(3) NIS2 provides that, in the absence of a designated representative in the Union, any Member State in which the entity provides services may take legal actions against the entity for infringements of the Directive. Instead of one jurisdiction anchor, the entity then faces potentially as many jurisdictions as there are Member States in which it provides services.
How does registration under Article 27 NIS2 work?
ENISA creates and maintains a registry of the entity types listed in Article 26(1), point (b). Member States require those entities to submit information to the competent authorities — including the entity’s name, its sector and type, the address of its main establishment or, for entities not established in the Union, of its representative designated pursuant to Article 26(3), up-to-date contact details, the Member States where it provides services, and its IP ranges (Article 27(2) NIS2). The information is forwarded to ENISA for the registry, and changes must be notified (Article 27(3) NIS2).
NIS2 is a directive — what does that mean for the representative duty?
Directive (EU) 2022/2555 binds the Member States, which transpose it into national law; the Directive set 17 October 2024 as the transposition deadline (Article 41 NIS2). The operative obligations for your entity therefore follow from national transposition, and details vary by Member State. In Germany, national transposition proceeds through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz — NIS2UmsuCG).
Is this legal advice?
Regingada UG (haftungsbeschränkt) is the software and EU-representation company, owned by Theo Funk, a German attorney (Rechtsanwalt). It does not provide legal advice. For legal advice under a separate mandate, please see the independent law firm Theo Funk.
What does it cost?
The engagement depends on your entity type and the scope of your services, the Member States where you offer them, the expected volume of contacts from competent authorities and CSIRTs, registration and update duties under Article 27 NIS2, whether the role is combined with Article 27 GDPR, DSA or AI Act representation (multi-regime setups reduce coordination overhead), and agreed response times. Engagement terms on request.
Designate your Article 26(3) EU representative.
Start with the scoping check — it records your Article 26(3) status and leads straight into the representation request.
Legal advice on representative obligations — the law firm Theo Funk (separate mandate)
Who stands behind the representative role?
Regingada UG (haftungsbeschränkt), Bamberg, Germany — HRB 12595, Amtsgericht Bamberg (local court, commercial register) — is owned by Theo Funk, a German attorney (Rechtsanwalt). It holds the appointed representative role and builds the software; it does not give legal advice. Legal assessment is a separate mandate with the law firm Theo Funk, which is bound by professional secrecy (§ 43a BRAO). Two contracts, billed separately: neither engagement requires the other, and no referral fees are paid in either direction.
Last reviewed: 27 September 2026