TCO Article 17: Legal representative

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

If you run a hosting service, offer it in the EU and have no main establishment there, Article 17 makes you designate a legal representative in the Union in writing to receive and act on removal orders. What makes this appointment different from every other representative mandate is the clock attached to it: a removal order under this Regulation runs to one hour.

Who it binds

• Hosting service providers without a main establishment in the Union that offer services in the Union (Article 17(1)). Hosting service is broad and reaches platforms, file storage, forums and comment infrastructure, not only what a reader would call a social network.
• It carries no size threshold and no user-number test. A small provider with EU users is in scope on the same terms as a large one.
• It does not bind providers whose main establishment is in the Union. Those providers deal with their own Member State's competent authority directly.

What it makes somebody do

• You, the provider. Designate a natural or legal person in writing as your legal representative in the Union, for the receipt of, compliance with and enforcement of removal orders and decisions (Article 17(1)).
• You, the provider. Give the representative the powers and resources needed to comply with those orders and to cooperate with the competent authorities (Article 17(2)). Resources is the operative word: an appointment that cannot answer inside the hour is not compliant with this paragraph.
• You, the provider. Place the representative in a Member State where you actually offer services (Article 17(2)).
• You, the provider. Notify the competent authority named under Article 12(1)(d) of the Member State where the representative resides or is established (Article 17(4)).
• You, the provider. Make the information about the representative publicly available (Article 17(4)). Public means published, not supplied on request.
• The representative. Receive removal orders and decisions and act on them. Article 17(3) makes the representative itself liable for infringements of the Regulation.

What it does not say

• It does not move your liability onto the representative. Article 17(3) makes the representative liable without prejudice to any liability of, or legal action against, the provider, so this adds a liable party rather than substituting one.
• It does not give the representative the power to remove content. The representative receives the order; the removal happens on your systems and the one-hour clock is yours to meet.
• It is not satisfied by an address on a website. Article 17(2) requires powers and resources, and an order arriving at 02:00 on a Sunday is the case this provision is written for.
• Publication under Article 17(4) is not the same as notification. Two separate things happen: you tell one named competent authority, and you publish for everyone else.
• The Regulation is about terrorist content specifically. It is not a general content-moderation regime, and a provider in scope of the Digital Services Act is not thereby out of scope of this one.

How it sits beside the other mandates

• The Digital Services Act Article 13 appointment and this one catch overlapping populations and are separate appointments. A hosting provider offering services in the EU can need both, and the counterparties differ: Digital Services Coordinators there, the Article 12(1)(d) competent authority here.
• This is the only representative mandate in the family with a one-hour statutory clock. Every other appointment in this library runs to a working day or longer, which changes what an appointment has to be resourced to do rather than merely what it says.
• Article 18 sets the penalties, and Article 5 the specific measures duty, so the exposure behind Article 17 is not confined to the appointment itself.