DSA Article 13: Legal representatives

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

If you run an intermediary service, offer it in the EU and have no establishment there, Article 13 makes you appoint someone in a Member State to receive and act on decisions issued under the Digital Services Act. It is an addressability requirement rather than a compliance service: appointing a legal representative does not move any of your own DSA obligations onto them.

Who it binds

• Providers of intermediary services offering services in the Union with no establishment in the Union. Intermediary services covers mere conduit, caching and hosting, so it reaches hosting providers, online platforms, marketplaces and search as well as the infrastructure layer.
• It does not bind you if you have an establishment in the Union. Article 13(1) applies only to providers that do not.
• It says nothing about your size. Unlike the very large online platform thresholds elsewhere in the Regulation, Article 13 carries no user-number test at all.

What it makes somebody do

• You, the provider. Designate the representative in writing, in one of the Member States where you offer the service (Article 13(1)).
• You, the provider. Mandate them to be addressed in addition to or instead of you by competent authorities, the Commission and the Board, on everything needed for the receipt of, compliance with and enforcement of DSA decisions (Article 13(2)).
• You, the provider. Give them the powers and the resources to cooperate efficiently and in time, and to comply with those decisions. Article 13(2) makes this a duty on you, not a courtesy.
• You, the provider. Notify their name, postal address, email address and telephone number to the Digital Services Coordinator in the Member State where they reside or are established (Article 13(4)).
• You, the provider. Keep those details publicly available, easily accessible, accurate and up to date (Article 13(4)). Public means published, not supplied on request.
• The representative. Be reachable by those authorities and act on what arrives. Article 13(3) makes it possible for the representative itself to be held liable for non-compliance with obligations under the Regulation.

What it does not say

• It does not make the representative an establishment. Article 13(5) says the designation does not constitute an establishment in the Union, so appointing one does not by itself create a taxable or regulatory presence.
• It does not transfer your obligations. Article 13(3) preserves the liability and legal actions that can be brought against the provider, so the representative's exposure sits beside yours rather than instead of it.
• It does not require a document from you. Article 13 puts no record-keeping or document-custody duty on the representative, which is unusual against GDPR Article 27 and unusual against the AI Act.
• It does not let you appoint a nameplate. The powers-and-resources duty in Article 13(2) is on you, and Article 13(3) means the person you appoint carries real exposure.
• No Article 13 enforcement action has been brought anywhere yet, so how authorities will treat a thin appointment in practice is untested. That is worth saying rather than implying a record that does not exist.

How it sits beside the other mandates

• A company caught by Article 13 is very often caught by GDPR Article 27 as well, and the two are separate appointments with different duties. Article 27 puts your record of processing in the representative's hands; Article 13 puts no document there at all.
• Article 13 is not the Article 11 point of contact. Article 11 is a contact point for authorities that every provider needs, including established ones. One entity is allowed to hold both roles, and holding one does not satisfy the other.
• Hosting providers that let users share content publicly are also likely to be in scope of the Terrorist Content Online Regulation, whose Article 17 representative carries a one-hour removal clock that Article 13 does not.