Service providers offering services in the Union that are not established in a participating Member State must appoint a legal representative under Article 3 of the e-Evidence Directive. The compliance deadline for providers already trading passed on 18 August 2026.
The short answer: Directive (EU) 2023/1544, Article 3 requires every service provider offering services in the Union to designate at least one addressee for production and preservation orders. If you are not established in the Union, that addressee is a legal representative in a participating Member State, and Engage Compliance holds that appointment from its EU establishment. The deadline for providers already offering services was 18 August 2026, which is now behind us.
Engage Compliance acts as your e-Evidence legal representative, receives orders from Member State authorities on your behalf, and gives you the powers-and-resources structure the Directive requires so the appointment holds up when an order actually arrives.
Key takeaways
- The duty sits in Directive (EU) 2023/1544, Article 3, not in the companion Regulation (EU) 2023/1543. The Regulation creates the orders; the Directive creates the addressee.
- Engage Compliance takes this appointment directly from its EU establishment, because the Netherlands is a participating Member State. Ireland participates too; Denmark does not, so a Danish representative would not be valid.
- Every service provider offering services in the Union must designate at least one addressee. Providers not established in the Union appoint a legal representative in a participating Member State. There is no exemption and no size threshold.
- The compliance deadline for providers already trading was 18 August 2026, and it has passed. New entrants have six months from when they start.
- Article 3(5) requires joint and several liability between the provider and its addressee for the obligations that arise once a decision or order is received, so who you appoint, and how, is a real risk decision rather than a formality.
The duty is in the Directive, not the Regulation
Get this right before anything else. The e-Evidence package has two instruments. Regulation (EU) 2023/1543 creates the European Production Order and the European Preservation Order, the actual mechanisms authorities use to get electronic evidence in criminal proceedings. Directive (EU) 2023/1544 creates the person who receives those orders. The obligation to appoint a legal representative is in Article 3 of the Directive.
So if a vendor or a checklist tells you your representative duty comes from “the e-Evidence Regulation”, it is citing the wrong instrument. The point matters because the Directive is transposed into national law by each Member State, and the details you have to comply with live in that national law, keyed off Article 3.
Who needs one
Article 1 frames it broadly: the Directive lays down rules on the designation of designated establishments and the appointment of legal representatives of certain service providers that offer services in the Union, for receiving, complying with and enforcing orders for the purpose of gathering electronic evidence in criminal proceedings.
Article 3(1) then requires every service provider offering services in the Union to designate at least one addressee. How that works depends on where you sit:
- Providers established in the Union designate a “designated establishment”.
- Providers not established in the Union appoint a legal representative in a participating Member State.
- Providers established only in a non-participating Member State appoint a representative in a participating Member State.
The scope of which providers are caught is set by the service categories in Article 1(2), which reads across to Regulation (EU) 2023/1543, Directive 2014/41/EU and the EU Mutual Assistance Convention.
Who is exempt
Nobody, within scope. There is no exemption written into Article 3 and no turnover, headcount or user-count threshold. If you fall inside the service categories in Article 1(2) and you offer services in the Union, you have to designate an addressee. Whether that addressee is a designated establishment or a legal representative turns on where you are established, not on how big you are.
When it applies from
There is a real, current deadline here.
- Member States had to transpose the Directive by 18 February 2026 (Article 7).
- Service providers already offering services on 18 February 2026 had to comply by 18 August 2026 (Article 3(6)).
- New entrants have six months from when they start offering services.
Today is 27 August 2026, so the compliance date for providers that were already trading has passed. If you were offering services in the Union in February and have not appointed an addressee, you are already past the deadline, which is a different conversation from getting ready for a future one.
Where the representative must be established
Article 3(2) sets two conditions, and the second gets missed. The addressee must:
- be established or reside in a Member State where you offer your services, and
- be able to be subject to enforcement procedures.
That second limb means the representative has to be a real entity that an authority can actually enforce against. A shell company set up only to hold the title will not satisfy it. The Netherlands is a participating Member State and Engage Compliance is a real, enforceable EU establishment there, which is why we can hold this appointment directly rather than through a partner.
Participation is worth spelling out, because it is a live trap. Ireland participates in the e-Evidence regime. Denmark does not. So an Irish or a Dutch representative is valid; a Danish one is not. If someone offers you a representative in a non-participating Member State, it does not meet Article 3.
Joint and several liability
Article 3(5) is the sharpest liability provision across the whole family of representative mandates. It requires Member States to establish joint and several liability between service providers and their designated addressees for non-compliance with the obligations that arise once a decision or order is received. Neither the provider nor the addressee can plead the absence of internal procedures as a justification, and the only carve-out is for conduct that constitutes a criminal offense.
In plain terms: your representative is on the hook alongside you, and cannot hide behind “we did not have a process for that”. This is why the appointment has to be run properly. Article 3(4) requires you to give the representative the necessary powers and resources to comply with orders, and Member States have to verify that you actually did. A thinly resourced appointment is exposed in a way it would not be under a lighter regime, so the structure behind the name is the point, not an afterthought.
What the penalty is
Article 5 leaves penalties to the Member States. It requires them to lay down rules on penalties for infringements of the national provisions adopted under Articles 3 and 4, and those penalties must be “effective, proportionate and dissuasive”. There is no harmonized EU ceiling and no single figure, so the exposure depends on the national law of the Member State involved. Member States had to notify their penalty rules to the Commission by 18 February 2026 and report annually on enforcement actions and penalties.
The more useful way to think about it is not the fine. It is that the joint and several liability in Article 3(5) puts your representative in the enforcement frame with you, and that an order in a criminal matter is not something you want landing at an address that is not set up to act on it.
What Engage Compliance delivers
- The appointment itself, from a real EU establishment in a participating Member State, so it satisfies both limbs of Article 3(2).
- A structured addressee for orders, so production and preservation orders reach a point that can receive and act on them rather than a mailbox nobody watches.
- The powers-and-resources setup Article 3(4) requires, documented, so that when a Member State verifies it, the answer is already in place.
- Written notification to the central authority under Article 4, including the official EU languages you can be contacted in, and, where you designate more than one addressee, their territorial scope. Details are published on the European Judicial Network webpage.
- A named contact who stays on your account, so the person who scoped the appointment is the person who handles the first order.
The Netherlands participates, so this is delivered from our EU establishment directly. We do not need a local partner for the e-Evidence mandate, unlike the jurisdictions where the law requires a representative established in that specific country.
What it costs
The appointment is €550 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold, charged once, up front, with no setup fee. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.
| Company size | e-Evidence Legal Representative |
|---|---|
| 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold | €550 |
| 11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold | €790 |
| 51 to 250 people, or €10m to €50m revenue | €1,830 |
| 251 or more people, or over €50m revenue | From €3,590 |
The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.
Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.
Every appointment you hold is a separate mandate, and only the highest-priced one in the basket is charged in full. Every other appointment is charged at a share of its own price, and for this one that share is half its own price. So adding this to an appointment you already hold costs €275 at band 0, €395 at band 1, €915 at band 2, €1,795 at band 3, rather than a second full price.
Two extras are optional, and each is charged once per order rather than once per appointment. Higher-risk processing, which covers special category data and criminal offense data, is €250 at band 0, €500 at band 1, €750 at band 2, €1,000 at band 3. Same-business-day response is a service level on authority and data subject correspondence rather than substantive advice, and is €1,200 a year.
Every band is published and buyable, so you can see your price and appoint online without talking to anyone first. The full table for every mandate is on representative services.
The appointment issues in seconds. After payment you answer a short form about your company and who we should send correspondence to, about three minutes of typing, and the appointment document, the certificate, the public verification link and the wording you need all issue automatically at that moment. Nobody at Engage has to approve anything.
Sources and references
- Directive (EU) 2023/1544, Article 3, EUR-Lex
Representative verification register
Representative mandates
These mandates stack rather than replace each other. One company selling into Europe can be caught by several at once, each is a separate appointment with its own published contact point, and an EU representative does not cover the UK. Engage Compliance holds them together so you have one point of contact across the set.
- EU GDPR Article 27 representative
- UK GDPR Article 27 representative
- Swiss FADP Article 14 representative
- DSA Article 13 legal representative
- EU AI Act GPAI authorised representative
- EU AI Act high-risk authorised representative
- NIS2 representative
- Data Act legal representative
- Data Governance Act representative
- e-Evidence legal representative
- Terrorist Content Online representative
- GPSR responsible person
- CE-marking authorised representative
- Non-EU regimes (Swiss, China, Korea, Turkey)