e-Evidence legal representative under Directive (EU) 2023/1544

Service providers offering services in the Union that are not established in a participating Member State must appoint a legal representative under Article 3 of the e-Evidence Directive. The compliance deadline for providers already trading passed on 18 August 2026.

The short answer: Directive (EU) 2023/1544, Article 3 requires every service provider offering services in the Union to designate at least one addressee for production and preservation orders. If you are not established in the Union, that addressee is a legal representative in a participating Member State, and Engage Compliance holds that appointment from its EU establishment. The deadline for providers already offering services was 18 August 2026, which is now behind us.

Engage Compliance acts as your e-Evidence legal representative, receives orders from Member State authorities on your behalf, and gives you the powers-and-resources structure the Directive requires so the appointment holds up when an order actually arrives.

Key takeaways

• The duty sits in Directive (EU) 2023/1544, Article 3, not in the companion Regulation (EU) 2023/1543. The Regulation creates the orders; the Directive creates the addressee.
• Engage Compliance takes this appointment directly from its EU establishment, because the Netherlands is a participating Member State. Ireland participates too; Denmark does not, so a Danish representative would not be valid.
• Every service provider offering services in the Union must designate at least one addressee. Providers not established in the Union appoint a legal representative in a participating Member State. There is no exemption and no size threshold.
• The compliance deadline for providers already trading was 18 August 2026, and it has passed. New entrants have six months from when they start.
• Article 3(5) requires joint and several liability between the provider and its addressee, so who you appoint, and how, is a real risk decision rather than a formality.

The duty is in the Directive, not the Regulation

Get this right before anything else. The e-Evidence package has two instruments. Regulation (EU) 2023/1543 creates the European Production Order and the European Preservation Order, the actual mechanisms authorities use to get electronic evidence in criminal proceedings. Directive (EU) 2023/1544 creates the person who receives those orders. The obligation to appoint a legal representative is in Article 3 of the Directive.

So if a vendor or a checklist tells you your representative duty comes from “the e-Evidence Regulation”, it is citing the wrong instrument. The point matters because the Directive is transposed into national law by each Member State, and the details you have to comply with live in that national law, keyed off Article 3.

Who needs one

Article 1 frames it broadly: the Directive lays down rules on the designation of designated establishments and the appointment of legal representatives of certain service providers that offer services in the Union, for receiving, complying with and enforcing orders for the purpose of gathering electronic evidence in criminal proceedings.

Article 3(1) then requires every service provider offering services in the Union to designate at least one addressee. How that works depends on where you sit:

• Providers established in the Union designate a “designated establishment”.
• Providers not established in the Union appoint a legal representative in a participating Member State.
• Providers established only in a non-participating Member State appoint a representative in a participating Member State.

The scope of which providers are caught is set by the service categories in Article 1(2), which reads across to Regulation (EU) 2023/1543, Directive 2014/41/EU and the EU Mutual Assistance Convention.

Who is exempt

Nobody, within scope. There is no exemption written into Article 3 and no turnover, headcount or user-count threshold. If you fall inside the service categories in Article 1(2) and you offer services in the Union, you have to designate an addressee. Whether that addressee is a designated establishment or a legal representative turns on where you are established, not on how big you are.

When it applies from

There is a real, current deadline here.

• Member States had to transpose the Directive by 18 February 2026 (Article 7).
• Service providers already offering services on 18 February 2026 had to comply by 18 August 2026 (Article 3(6)).
• New entrants have six months from when they start offering services.

Today is 27 August 2026, so the compliance date for providers that were already trading has passed. If you were offering services in the Union in February and have not appointed an addressee, you are already past the deadline, which is a different conversation from getting ready for a future one.

Where the representative must be established

Article 3(2) sets two conditions, and the second is the one people miss. The addressee must:

• be established or reside in a Member State where you offer your services, and
• be able to be subject to enforcement procedures.

That second limb means the representative has to be a real entity that an authority can actually enforce against. A shell company set up only to hold the title will not satisfy it. The Netherlands is a participating Member State and Engage Compliance is a real, enforceable EU establishment there, which is why we can hold this appointment directly rather than through a partner.

Participation is worth spelling out, because it is a live trap. Ireland participates in the e-Evidence regime. Denmark does not. So an Irish or a Dutch representative is valid; a Danish one is not. If someone offers you a representative in a non-participating Member State, it does not meet Article 3.

Joint and several liability

Article 3(5) is the sharpest liability provision across the whole family of representative mandates. It requires Member States to establish joint and several liability between service providers and their designated addressees for non-compliance. Neither the provider nor the addressee can plead the absence of internal procedures as a justification, and the only carve-out is for conduct that constitutes a criminal offense.

In plain terms: your representative is on the hook alongside you, and cannot hide behind “we did not have a process for that”. This is why the appointment has to be run properly. Article 3(4) requires you to give the representative the necessary powers and resources to comply with orders, and Member States have to verify that you actually did. A thinly resourced appointment is exposed in a way it would not be under a lighter regime, so the structure behind the name is the point, not an afterthought.

What the penalty is

Article 5 leaves penalties to the Member States. It requires them to lay down rules on penalties for infringements of the national provisions adopted under Articles 3 and 4, and those penalties must be “effective, proportionate and dissuasive”. There is no harmonized EU ceiling and no single figure, so the exposure depends on the national law of the Member State involved. Member States had to notify their penalty rules to the Commission by 18 February 2026 and report annually on enforcement actions and penalties.

The more useful way to think about it is not the fine. It is that the joint and several liability in Article 3(5) puts your representative in the enforcement frame with you, and that an order in a criminal matter is not something you want landing at an address that is not set up to act on it.

What Engage Compliance delivers

• The appointment itself, from a real EU establishment in a participating Member State, so it satisfies both limbs of Article 3(2).
• A structured addressee for orders, so production and preservation orders reach a point that can receive and act on them rather than a mailbox nobody watches.
• The powers-and-resources setup Article 3(4) requires, documented, so that when a Member State verifies it, the answer is already in place.
• Written notification to the central authority under Article 4, including the official EU languages you can be contacted in, and, where you designate more than one addressee, their territorial scope. Details are published on the European Judicial Network webpage.
• A named contact who stays on your account, so the person who scoped the appointment is the person who handles the first order.

The Netherlands participates, so this is delivered from our EU establishment directly. We do not need a local partner for the e-Evidence mandate, unlike the jurisdictions where the law requires a representative established in that specific country.

What it costs

Pricing is scoped to the mandate. The right number depends on the service categories you fall under, whether you need a single addressee or several with different territorial scope, and how the appointment sits alongside any other representative duties you carry. Talk to us for a quote.

Sources and references

• Directive (EU) 2023/1544, Article 3, EUR-Lex