Do I need an EU representative?

EU responsible person (economic operator in the EU)

General Product Safety Regulation (EU) 2023/988 · Art. 16 GPSR, with Art. 4 of Regulation (EU) 2019/1020 · since 13 December 2024

Who needs one: Any consumer product placed on the EU market, including products sold online from outside the EU. It may only be sold if an economic operator established in the EU is responsible for it.

What it does: Keeps the safety documentation available, answers market surveillance authorities, reports products that present a risk and cooperates on recalls. Its name and contact details must appear on the product, packaging, parcel or an accompanying document, and in the online listing.

EU economic operator / authorised representative (CE marking)

Market Surveillance Regulation (EU) 2019/1020 · Art. 4 of Regulation (EU) 2019/1020, plus the product law (e.g. Machinery, Toy Safety, LVD, EMC, Radio Equipment, PPE) · since 16 July 2021

Who needs one: Products under the EU harmonisation laws listed in Art. 4(5), which covers most CE-marked consumer and industrial products. They may only be placed on the market if an EU-established economic operator is responsible for them.

What it does: Holds the EU declaration of conformity and technical documentation, gives them to authorities on request, informs authorities about risky products and cooperates on corrective action. Its details go on the product, packaging, parcel or an accompanying document.

Sole EU authorised representative

Medical Devices Regulation (EU) 2017/745 and IVD Regulation (EU) 2017/746 · Art. 11 MDR / Art. 11 IVDR · since 26 May 2021 (MDR) and 26 May 2022 (IVDR)

Who needs one: Manufacturers of medical devices or in vitro diagnostic devices who are not established in an EU Member State. The device may only be placed on the EU market once a single authorised representative is designated.

What it does: Verifies the declaration of conformity and technical documentation, keeps copies available, cooperates with authorities and checks registrations. If the manufacturer has not met its own obligations, the authorised representative is legally liable for defective devices on the same basis as, and jointly and severally with, the manufacturer.

GDPR representative in the EU

General Data Protection Regulation (EU) 2016/679 · Art. 27 GDPR (scope set by Art. 3(2)) · since 25 May 2018

Who needs one: Controllers and processors outside the EU that offer goods or services to people in the EU, or monitor their behaviour there, and process their personal data.

Exemptions: Public authorities, and processing that is occasional, does not involve large-scale special-category or criminal-conviction data, and is unlikely to put people's rights at risk. All three conditions must hold.

What it does: Is the contact point for data protection authorities and individuals on all GDPR matters, in a Member State where your EU users are. Appointing one does not shift your own liability.

AI Act authorised representative (high-risk AI)

EU AI Act, Regulation (EU) 2024/1689 · Art. 22 AI Act · since 2 December 2027 for Annex III systems; 2 August 2028 for AI in Annex I products (after the Digital Omnibus)

Who needs one: Providers established outside the EU of high-risk AI systems, before they make the system available on the EU market.

What it does: Verifies the EU declaration of conformity and technical documentation exist and that conformity assessment was done, keeps them for 10 years, gives authorities the information they request (including logs), cooperates with them and handles or checks EU database registration. It must end the mandate and alert the authority if the provider breaks the rules.

AI Act authorised representative (general-purpose AI model)

EU AI Act, Regulation (EU) 2024/1689 · Art. 54 AI Act · since 2 August 2025

Who needs one: Providers established outside the EU that place a general-purpose AI model on the EU market.

Exemptions: Models released under a free and open-source licence with public weights, architecture and usage information, unless the model presents systemic risk.

What it does: Verifies the model documentation (Annex XI) and the provider's GPAI obligations, keeps the documentation for 10 years, answers the AI Office and cooperates with it and national authorities.

DSA legal representative

Digital Services Act, Regulation (EU) 2022/2065 · Art. 13 DSA · since 17 February 2024

Who needs one: Providers of intermediary services (mere conduit, caching, hosting, including online platforms and marketplaces) with no establishment in the EU that offer services in the EU.

What it does: Receives and acts on decisions from national authorities, the Commission and the Board. Its name and contact details must be notified to the Digital Services Coordinator and published. The legal representative can itself be held liable for non-compliance.

NIS2 representative

NIS2 Directive (EU) 2022/2555 · Art. 26(3) NIS2 · since From national transposition (deadline 17 October 2024)

Who needs one: DNS service providers, TLD registries, domain registration services, cloud computing, data centre and content delivery network providers, managed (security) service providers, online marketplaces, search engines and social networking platforms that are not established in the EU but offer services there.

What it does: Is the contact point in one Member State where you offer services; you fall under that country's jurisdiction. Without one, any Member State where you operate can take action against you.

Do UK companies need an EU representative after Brexit?

Often, yes. Since 1 January 2021 a company established only in Great Britain is a non-EU company for EU law. If it sells consumer or CE-marked products into the EU, processes personal data of people in the EU, runs an online intermediary service or provides high-risk AI there, the same representative rules apply to it as to any other non-EU company. Northern Ireland has its own arrangements for goods, so check those separately.

Do US companies need an EU representative?

If they have no establishment in the EU and fall under one of the laws on this page, yes. The most common cases are an EU responsible person for products sold to EU consumers (GPSR), a GDPR representative for SaaS and online services with EU users, and a DSA legal representative for platforms and hosting services.

Is an EU authorised representative the same as an EU responsible person?

Not exactly. "Responsible person" is the everyday name for the EU economic operator required by the General Product Safety Regulation and the Market Surveillance Regulation; that role can be filled by an importer, an authorised representative or a fulfilment service provider. An authorised representative is one specific type: an EU-based person or company acting under a written mandate from the manufacturer. For medical devices only an authorised representative will do.

Can one company be my representative under several laws?

Often yes, and many providers offer bundles (for example GDPR and DSA, or GPSR and CE). Each role still needs its own written mandate, and some roles have specific requirements, such as a representative in a Member State where your users actually are under the GDPR.

What happens if I do not appoint one?

For products, marketplaces and authorities can block or remove listings and stop goods at the border, because the product cannot legally be placed on the market without an EU operator. Under the GDPR, the DSA and the AI Act, failing to appoint a required representative is itself an infringement that can be fined. Under NIS2, any Member State where you offer services can then take action against you.

Does the AI Act require an EU representative for every AI product?

No. Under the AI Act only providers of high-risk AI systems (Article 22) and of general-purpose AI models (Article 54) that are established outside the EU must appoint one. Most AI products are not high-risk; a free assessment tells you which tier yours is in.