NIS2 representative under Article 26(3)

Only a narrow set of non-EU digital providers need a NIS2 representative, and it comes from Article 26(3), not Article 27. Engage Compliance acts as that representative from its EU establishment for the entities that are actually caught.

The short answer: if your entity is non-EU, sits in the Article 26(1)(b) list of digital infrastructure and digital service providers, and offers services in the Union, Article 26(3) of Directive (EU) 2022/2555 requires you to designate a representative established in a Member State where those services are offered. Engage Compliance provides that representative directly from its EU establishment. If you are a non-EU energy, transport, health, water, manufacturing, food, or postal entity, you have no NIS2 representative obligation at all, and we will tell you so rather than sell you one.

Key takeaways

• The correct provision is Article 26(3) of Directive (EU) 2022/2555, not Article 27. Getting the article right matters, because much of the market cites the wrong one.
• Engage Compliance acts as your NIS2 Article 26(3) representative directly from its EU establishment, which is where the law requires the representative to sit.
• The trigger is narrow. Only the digital providers listed in Article 26(1)(b) are caught. Most sectors named in the NIS2 annexes carry no representative duty.
• The size test is broadly medium-sized, at least 50 staff or turnover and balance sheet above €10 million, with Article 2(2) overriding that cap for certain provider types regardless of size.
• There is no specific penalty for failing to designate. The consequence is losing the single-jurisdiction benefit and facing enforcement in every Member State where you provide services.
• Appointing a representative fixes your regulator: you fall under the jurisdiction of the Member State where the representative is established.

Who needs a NIS2 representative

The representative duty in Article 26(3) reaches only the entities named in Article 26(1)(b). That list is:

• DNS service providers
• TLD name registries
• entities providing domain name registration services
• cloud computing service providers
• data centre service providers
• content delivery network providers
• managed service providers
• managed security service providers
• providers of online marketplaces
• providers of online search engines
• providers of social networking services platforms

If your entity is established outside the Union, sits in that list, and offers services within the Union, you need to designate a representative. That is the whole trigger.

Who is exempt

Every other sector is exempt from the representative duty, even where it is otherwise in scope for NIS2. Article 26(1)(a) and (c) do not carry a representative obligation, so a non-EU entity in energy, transport, health, water, manufacturing, food, or postal services has nothing to appoint under Article 26(3). This is the point vendors get wrong most often, and it is worth being blunt about: being an important or essential entity under NIS2 is not the same as owing a representative duty. The representative duty is reserved for the digital infrastructure and digital service providers in the 26(1)(b) list.

Entities below the size threshold are also out, subject to the Article 2(2) override described next.

What size a company has to be

The size test is broadly medium-sized. In practice that means at least 50 staff, or annual turnover and balance sheet total above €10 million.

Article 2(2) overrides the size cap for certain provider types, which are in scope regardless of how small they are. Those include DNS service providers, TLD name registries, trust service providers, and providers of public electronic communications networks or services. So a small DNS provider can be caught where a much larger company in an exempt sector is not.

When it applies from

NIS2 had a transposition deadline of 17 October 2024. Because it is a Directive rather than a Regulation, the binding obligation lives in each country’s national law, not in the Directive itself, and Member States have diverged in both the timing and the drafting of their transposition. So the answer to “does this apply to me yet” depends on the specific Member States where you offer services, and it is worth checking those national laws rather than reading the deadline as a single switch that flipped everywhere on the same day.

Where the representative must be established

The representative must be established in one of the Member States where the services are offered. Engage Compliance meets that from its EU establishment, so for a provider serving the Netherlands, or serving the Union broadly, we can act as the representative directly, with no separate local entity needed.

Article 26(3) says only “designate”. It does not require the appointment to be in writing, unlike the GDPR, the DSA, and the AI Act. A contract is still how the appointment is evidenced, and with no writing requirement in the text, the contract becomes the only proof the designation happened.

What the penalty is

There is no specific fine for failing to designate a NIS2 representative. The consequence written into Article 26(3) is different in kind: you lose the single-jurisdiction benefit, and any Member State where you provide services can take legal action against you for infringing the Directive. In other words, the sanction for not appointing is broader exposure, not a set fine.

The NIS2 fines people quote, up to €10 million or 2 percent of worldwide turnover for essential entities and up to €7 million or 1.4 percent for important entities, come from Article 34 and are keyed to Articles 21 and 23, the risk-management and incident-reporting duties. They are not the penalty for missing the Article 26 designation.

Appointing a representative chooses your regulator

This is the part clients tend to value most. Under Article 26(3), the entity is considered to fall under the jurisdiction of the Member State where the representative is established. So the appointment does more than tick a box: it settles which single national authority you answer to for NIS2, instead of leaving you exposed across every country you serve. Without a representative, any Member State where you provide services can pursue you. With one, you have one regulator and one point of contact.

What Engage Compliance delivers

• The Article 26(3) representative appointment, performed directly from our EU establishment.
• A contract that evidences the designation, since the text sets no writing requirement and the contract is your proof.
• A named, published point of contact for the national authority in your jurisdiction of establishment.
• Handling of correspondence from the competent authority, routed to your internal owner with the substance and a recommended response.
• A scoping review first, so if you are not actually caught by Article 26(1)(b), we say so and stop rather than sell you a mandate you do not owe.

There is no record-keeping duty on the NIS2 representative, so this is a point-of-contact and jurisdiction role, not a document-custody one.

What it costs

Pricing is scoped to the mandate. The right number depends on which provider type you are, the Member States you serve, and how the appointment sits alongside any other representative or DPO work you need. Tell us what you do and we will quote it. Talk to us for a scoped price.

Sources and references

• Directive (EU) 2022/2555 (NIS2), EUR-Lex