Digital Services Act legal representative

Providers of intermediary services with no establishment in the EU that offer services here need a legal representative under Article 13 of the Digital Services Act. Engage Compliance acts as that representative from its EU establishment.

The short answer: if you provide intermediary services, have no establishment in the Union, and offer your services to users in the Union, DSA Article 13 requires you to designate a legal representative in writing in one of the Member States where you offer services. Engage Compliance provides that representative directly from its EU establishment in Amsterdam, with a written designation and a named contact the authorities can address.

Key takeaways

• Engage Compliance acts as your DSA Article 13 legal representative from its own EU establishment, so this is a mandate we perform directly rather than through a partner.
• Article 13 catches providers of intermediary services that have no establishment in the Union but offer services in the Union. Providers with an EU establishment are outside it.
• The DSA has two separate roles. The Article 11 and Article 12 points of contact are for every provider. The Article 13 legal representative is only for non-EU providers. One entity is allowed to hold both.
• There is no micro or small enterprise carve-out from Article 13 itself. Size does not take you out of the duty.
• The obligation has been live since the DSA applied in full on 17 February 2024.
• The representative can be held liable for non-compliance under Article 13(3), and designating one does not by itself make you established in the Union under Article 13(5).

Who needs a DSA legal representative

Article 13(1) applies to providers of intermediary services that do not have an establishment in the Union but offer services in the Union. Those providers have to designate, in writing, a legal or natural person to act as their legal representative in one of the Member States where they offer their services.

Two parts of that carry the weight. The first is intermediary services, which is a broad category covering conduit, caching, and hosting, so a lot of platforms, marketplaces, hosting providers, and consumer apps sit inside it. The second is the establishment test. If you already have an establishment in the Union, Article 13 is not your obligation. If you reach EU users but hold no legal entity here, it is. Operators of a marketplace should also read privacy compliance for marketplace platforms for the data protection side.

Who is exempt

Nothing in Article 13 exempts anyone, and there is no micro or small enterprise carve-out written into the article. A small company that provides intermediary services into the EU with no EU establishment is caught the same way a large one is. Do not assume a size threshold takes you out of it, because Article 13 does not contain one.

The Article 11 point of contact is a different role

This is the point that trips people up, so it is worth being plain about. The DSA sets up two separate things:

1. The Article 11 and Article 12 points of contact, which every provider needs, including providers that are established in the EU: Article 11 so the authorities can reach you, Article 12 so your users can.
2. The Article 13 legal representative, which only providers with no EU establishment need.

They are not alternatives to each other. The DSA does not stop one entity from performing both, and in practice a non-EU provider often has us cover the point of contact and the legal representative in a single engagement. If you are EU-established you still need the point of contact, you just do not need the Article 13 representative.

When it applies from

The Digital Services Act has applied in full since 17 February 2024. The Article 13 legal representative obligation is live now, not a future date you are preparing for.

Where the representative must be established

Article 13(1) requires the representative to be in one of the Member States where the provider offers its services. For any internet-delivered service that reaches users in the Netherlands, an Amsterdam-established representative meets that test, which is why we can take this mandate from our own EU establishment rather than routing it through a local partner.

Designating a representative does not, on its own, create an EU establishment for you. Article 13(5) says so directly. That matters if you are watching your establishment position for other reasons, because appointing us as your DSA representative does not change it.

One related distinction matters if you also host content. The DSA Article 13 duty falls away the moment you have any EU establishment. The Terrorist Content Online Regulation works off a different trigger, “main establishment” rather than “no establishment”, so a small EU office can take you out of the DSA representative duty while leaving the TCO one in place. If terrorist content removal orders are in scope for you, the TCO representative page covers that separately.

What the penalty is

Penalties under the DSA are set by the Member States within ceilings the Regulation fixes. Under Article 52(3) the maximum fine cannot exceed 6 percent of the provider’s annual worldwide turnover in the preceding financial year. A lower cap of 1 percent applies to supplying incorrect, incomplete, or misleading information, or failing to reply or to submit to an inspection. Article 52(4) allows periodic penalty payments of up to 5 percent of average daily worldwide turnover to compel compliance.

Two honest caveats sit alongside those numbers. The representative itself can be held liable for non-compliance under Article 13(3), without prejudice to action against the provider, so this is a role with genuine exposure rather than a formality. And no DSA Article 13 enforcement action has been brought anywhere yet, so how regulators will approach a missing or thin appointment in practice is still untested. We would rather tell you that than imply a settled enforcement record that does not exist.

What Engage delivers

• Written designation as your Article 13 legal representative, with a mandate that gives the role the powers and resources Article 13(2) expects, not a letterhead arrangement.
• A named EU contact point the authorities can address, published in the form the DSA requires.
• Handling of authority contact, with the substance passed to you within one business day, so a message from a Digital Services Coordinator does not sit unanswered.
• The Article 11 point of contact in the same engagement where you need it, since one entity is allowed to hold both roles.
• Annual review, because the appointment stops being accurate the moment your service or your establishment position changes.
• Translation included, both ways, automated, with an independent second check.

There is no separate record-keeping duty on the DSA representative, so this is a conduit and contact role rather than a document-custody one. That keeps it lighter to run than some of the other representative mandates.

The GDPR version of the same appointment is explained on EU authorized representative.

Another EU appointment for non-EU services is the NIS2 representative.

What it costs

The appointment is €1,200 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold, charged once, up front, with no setup fee. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.

Company size	DSA Legal Representative
1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold	€1,200
11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold	€1,724
51 to 250 people, or €10m to €50m revenue	€3,993
251 or more people, or over €50m revenue	From €7,833

The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.

If your company grows into a bigger band during the year, nothing changes mid-term: you pay the new band’s price from your next renewal.

Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.

Every appointment you hold is a separate mandate, and only the highest-priced one in the basket is charged in full. Every other appointment is charged at a share of its own price, and for this one that share is three quarters of its own price. So adding this to an appointment you already hold costs €900 at band 0, €1,293 at band 1, €2,995 at band 2, from €5,875 at band 3, rather than a second full price.

One extra is optional, and it is charged once per order rather than once per appointment. Higher-risk processing, which covers special category data and criminal offense data, is €250 at band 0, €500 at band 1, €750 at band 2, from €1,000 at band 3.

Every band is published and buyable, so you can see your price and appoint online without talking to anyone first. The full table for every mandate is on representative services.

The appointment issues in seconds. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment. Nobody at Engage has to approve anything, unless our sanctions screen flags a possible match.

Sources and references

• Regulation (EU) 2022/2065 (Digital Services Act), Article 13, EUR-Lex