Contact us
Contact us

e-Evidence Directive Article 3: Designated establishments and legal representatives

1. Member States shall ensure that service providers offering services in the Union designate or appoint at least one addressee for the receipt of, compliance with and enforcement of decisions and orders falling within the scope laid down in Article 1(2) (‘decisions and orders falling within the scope laid down in Article 1(2)’) issued by competent authorities of Member States for the purpose of gathering evidence in criminal proceedings, as follows:

(a) for service providers established in the Union with legal personality, the Member States where the service providers are established shall ensure that such service providers designate the designated establishment or designated establishments responsible for the activities described in the introductory part of this paragraph;

(b) for service providers that are not established in the Union, with legal personality, Member States shall ensure that such service providers offering services on their territory appoint the legal representative or legal representatives responsible for the activities described in the introductory part of this paragraph in Member States taking part in the instruments referred to in Article 1(2);

(c) for service providers established in Member States not taking part in the instruments referred to in Article 1(2), Member States shall ensure that such service providers offering services on their territory appoint the legal representative or legal representatives responsible for the activities described in the introductory part of this paragraph in Member States taking part in such instruments.

2. Member States shall ensure that the addressees referred to in paragraph 1:

(a) are established or reside in a Member State where the service providers offer their services; and

(b) can be subject to enforcement procedures.

3. Member States shall ensure that decisions and orders falling within the scope laid down in Article 1(2) are addressed to the designated establishment or legal representative designated or appointed for that purpose in accordance with paragraph 1 of this Article.

4. Member States shall ensure that service providers established or offering services on their territory provide their designated establishments and legal representatives with the necessary powers and resources to comply with decisions and orders falling within the scope laid down in Article 1(2) received from a Member State. Member States shall also verify that the designated establishments established or legal representatives residing on their territory have received from the service providers the necessary powers and resources to comply with those decisions and orders received from a Member State and that they cooperate with the competent authorities when receiving those decisions and orders, in accordance with the applicable legal framework.

5. Member States shall ensure that both the designated establishment or the legal representative and the service provider can be held jointly and severally liable for non-compliance with obligations deriving from the applicable legal framework upon the receipt of decisions and orders falling within the scope laid down in Article 1(2), so that each of them may be subject to penalties for non-compliance by any of them. In particular, Member States shall ensure that it is not possible for the service provider or the designated establishment, or the legal representative where applicable, to use the lack of appropriate internal procedures between the service provider and the designated establishment or the legal representative as a justification for non-compliance with those obligations. Joint and several liability shall not apply for actions or omissions of either the service provider or the designated establishment, or the legal representative where applicable, which constitute a criminal offence in the Member State applying the penalties.

6. Member States shall ensure that service providers that offer services in the Union on 18 February 2026 have the obligation to designate designated establishments or to appoint legal representatives by 18 August 2026 and that service providers that start offering services in the Union after 18 February 2026 have the obligation to designate designated establishments or to appoint legal representatives within six months of the date when they start offering services in the Union.

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

If you offer services in the EU, Article 3 requires you to have an addressee inside the Union for production and preservation orders in criminal proceedings: a designated establishment if you are established in the EU, a legal representative if you are not. The provision that matters most commercially is Article 3(5), which makes you and your representative jointly and severally liable for non-compliance.

Who it binds

  • Service providers offering services in the Union. Article 3(1)(a) covers those established in the Union with legal personality, which designate an establishment; Article 3(1)(b) covers those not established in the Union, which appoint a legal representative.
  • Article 3(1)(c) catches a case people miss: a provider established in a Member State that does not take part in the instruments still has to appoint a representative in a Member State that does.
  • The addressee has to be established or resident in a Member State where you actually offer services, and has to be capable of being subject to enforcement procedures (Article 3(2)).
  • This is a Directive, so what binds you is your Member State's transposing law. The text here is what those laws implement.

What it makes somebody do

  • You, the provider. Designate or appoint at least one addressee for the receipt of, compliance with and enforcement of orders within the Article 1(2) scope (Article 3(1)).
  • You, the provider. Give that addressee the powers and resources needed to comply with orders received from a Member State (Article 3(4)). Member States are required to verify that you have actually done so, which makes this a checkable duty rather than a stated one.
  • You, the provider. Meet the deadlines in Article 3(6): providers already offering services in the Union on 18 February 2026 had to appoint by 18 August 2026, and a provider starting after that date has six months from when it starts.
  • The addressee. Receive the orders, which are addressed to it rather than to you (Article 3(3)), and cooperate with the competent authorities under the applicable legal framework (Article 3(4)).
  • Both of you. Carry joint and several liability for non-compliance, so either can be penalised for a failure by the other (Article 3(5)).

What it does not say

  • It does not let you point at internal process to excuse a failure. Article 3(5) says expressly that a lack of appropriate internal procedures between you and your representative is not a justification for non-compliance.
  • The joint and several liability is not unlimited. Article 3(5) carves out actions or omissions that constitute a criminal offence in the Member State applying the penalties.
  • It does not create the orders. This Directive creates the addressee; the production and preservation orders themselves come from Regulation (EU) 2023/1543, the other half of the package.
  • One appointment does not automatically cover every Member State. Article 3(2)(a) ties the addressee to a Member State where you offer services, and the plural in Article 3(1) contemplates more than one.
  • It is not a data-protection appointment. The counterparties are criminal justice authorities and the subject is evidence, so a GDPR Article 27 representative does not satisfy it and does not overlap with it.

How it sits beside the other mandates

  • Article 3(5) is the sharpest liability provision across this whole family of representative mandates. Most instruments say the appointment does not affect the provider's own liability; this one says both parties can be penalised for either party's failure.
  • A provider in scope here is very often in scope of the Digital Services Act Article 13 and of the Terrorist Content Online Regulation Article 17 as well. Three appointments, three counterparties, three clocks.
  • Article 4 sets the notification and language requirements, and Article 5 the penalties, so an appointment made without reading those two is made without knowing what it costs to get wrong.

The e-Evidence package is two instruments and the representative duty is in this one, the Directive. Regulation (EU) 2023/1543, published beside it, is what creates the production and preservation orders a represented provider actually receives; it is a separate dataset in this library. The Directive is a Directive, so the binding obligations live in each Member State's transposing law and this is the text those laws implement.

Source text: EUR-Lex, Official Journal HTML (CELEX 32023L1544). The parser was validated against the anchor articles verified in REP-08.