Providers of intermediary services with no establishment in the EU that offer services here need a legal representative under Article 13 of the Digital Services Act. Engage Compliance acts as that representative from its EU establishment.
The short answer: if you provide intermediary services, have no establishment in the Union, and offer your services to users in the Union, DSA Article 13 requires you to designate a legal representative in writing in one of the Member States where you offer services. Engage Compliance provides that representative directly from its EU establishment in Amsterdam, with a written designation and a named contact the authorities can address.
Key takeaways
- Engage Compliance acts as your DSA Article 13 legal representative from its own EU establishment, so this is a mandate we perform directly rather than through a partner.
- Article 13 catches providers of intermediary services that have no establishment in the Union but offer services in the Union. Providers with an EU establishment are outside it.
- The DSA has two separate roles. The Article 11 point of contact is for every provider. The Article 13 legal representative is only for non-EU providers. One entity is allowed to hold both.
- There is no micro or small enterprise carve-out from Article 13 itself. Size does not take you out of the duty.
- The obligation has been live since the DSA applied in full on 17 February 2024.
- The representative can be held liable for non-compliance under Article 13(3), and designating one does not by itself make you established in the Union under Article 13(5).
Who needs a DSA legal representative
Article 13(1) applies to providers of intermediary services that do not have an establishment in the Union but offer services in the Union. Those providers have to designate, in writing, a legal or natural person to act as their legal representative in one of the Member States where they offer their services.
Two parts of that carry the weight. The first is intermediary services, which is a broad category covering conduit, caching and hosting, so a lot of platforms, marketplaces, hosting providers and consumer apps sit inside it. The second is the establishment test. If you already have an establishment in the Union, Article 13 is not your obligation. If you reach EU users but hold no legal entity here, it is.
Who is exempt
Nothing in Article 13 exempts anyone, and there is no micro or small enterprise carve-out written into the article. A small company that provides intermediary services into the EU with no EU establishment is caught the same way a large one is. Do not assume a size threshold takes you out of it, because Article 13 does not contain one.
The Article 11 point of contact is a different role
This is the point that trips people up, so it is worth being plain about. The DSA sets up two separate things:
- The Article 11 point of contact, which every provider needs, including providers that are established in the EU, so that authorities and users have a way to reach you directly.
- The Article 13 legal representative, which only providers with no EU establishment need.
They are not alternatives to each other. The DSA does not stop one entity from performing both, and in practice a non-EU provider often has us cover the point of contact and the legal representative in a single engagement. If you are EU-established you still need the point of contact, you just do not need the Article 13 representative.
When it applies from
The Digital Services Act has applied in full since 17 February 2024. The Article 13 legal representative obligation is live now, not a future date you are preparing for.
Where the representative must be established
Article 13(1) requires the representative to be in one of the Member States where the provider offers its services. For any internet-delivered service that reaches users in the Netherlands, an Amsterdam-established representative meets that test, which is why we can take this mandate from our own EU establishment rather than routing it through a local partner.
Designating a representative does not, on its own, create an EU establishment for you. Article 13(5) says so directly. That matters if you are watching your establishment position for other reasons, because appointing us as your DSA representative does not change it.
One related distinction is worth knowing if you also host content. The DSA Article 13 duty falls away the moment you have any EU establishment. The Terrorist Content Online Regulation works off a different trigger, “main establishment” rather than “no establishment”, so a small EU office can take you out of the DSA representative duty while leaving the TCO one in place. If terrorist content removal orders are in scope for you, the TCO representative page covers that separately.
What the penalty is
Penalties under the DSA are set by the Member States within ceilings the Regulation fixes. Under Article 52(3) the maximum fine cannot exceed 6 percent of the provider’s annual worldwide turnover in the preceding financial year. A lower cap of 1 percent applies to supplying incorrect, incomplete or misleading information, or failing to reply or to submit to an inspection. Article 52(4) allows periodic penalty payments of up to 5 percent of average daily worldwide turnover to compel compliance.
Two honest caveats sit alongside those numbers. The representative itself can be held liable for non-compliance under Article 13(3), without prejudice to action against the provider, so this is a role with genuine exposure rather than a formality. And no DSA Article 13 enforcement action has been brought anywhere yet, so how regulators will approach a missing or thin appointment in practice is still untested. We would rather tell you that than imply a settled enforcement record that does not exist.
What Engage delivers
- Written designation as your Article 13 legal representative, with a mandate that gives the role the powers and resources Article 13(2) expects, not a letterhead arrangement.
- A named EU contact point the authorities can address, published in the form the DSA requires.
- Handling of authority contact, with the substance passed to you and a recommended response, so a message from a Digital Services Coordinator does not sit unanswered.
- The Article 11 point of contact in the same engagement where you need it, since one entity is allowed to hold both roles.
- Annual review, because the appointment stops being accurate the moment your service or your establishment position changes.
There is no separate record-keeping duty on the DSA representative, so this is a conduit and contact role rather than a document-custody one. That keeps it lighter to run than some of the other representative mandates.
What it costs
Pricing is scoped to the mandate rather than fixed, because the right scope depends on your service, your EU footprint and whether you also need the Article 11 point of contact alongside it. Talk to us and we will give you a quote.
Sources and references
Representative mandates
These mandates stack rather than replace each other. One company selling into Europe can be caught by several at once, each is a separate appointment with its own published contact point, and an EU representative does not cover the UK. Engage Compliance holds them together so you have one point of contact across the set.
- EU GDPR Article 27 representative
- UK GDPR Article 27 representative
- Swiss FADP Article 14 representative
- DSA Article 13 legal representative
- EU AI Act GPAI authorised representative
- EU AI Act high-risk authorised representative
- NIS2 representative
- Data Act legal representative
- Data Governance Act representative
- e-Evidence legal representative
- Terrorist Content Online representative
- GPSR responsible person
- CE-marking authorised representative
- Non-EU regimes (Swiss, China, Korea, Turkey)