Key takeaways
- Several EU and UK laws make a company established outside them appoint a named local representative. These are separate appointments, not alternatives, and one company can be caught by more than one.
- Engage Compliance holds twelve of these mandates: GDPR Article 27 in the EU and the UK, the Swiss FADP, the Digital Services Act, both EU AI Act representative roles, NIS2, the Data Act, both Data Governance Act roles, the e-Evidence Directive and the Terrorist Content Online Regulation.
- Every price is published for every company size band, charged once a year up front, and bought online with no sales call. The smallest band is for very small organizations only, and its caps are stated wherever its price appears.
- Every active appointment is listed on the public register, with its own verification page, so a regulator or a customer can check it without asking us.
The twelve mandates
One page per mandate: who is caught, what the law makes the representative do, and what it costs.
- GDPR Article 27 EU Representative Companies with no establishment in the EU that offer goods or services to, or monitor the behavior of, people in the EU.
- UK GDPR Article 27 UK Representative Companies with no establishment in the UK that offer goods or services to, or monitor the behavior of, people in the UK.
- Swiss FADP Article 14 Swiss Representative Companies based outside Switzerland whose processing of Swiss people’s data is large scale, regular, and high risk, and is tied to offering goods or services in Switzerland or monitoring behavior there.
- Digital Services Act Article 13 DSA Legal Representative Providers of intermediary services, which includes hosting, online platforms, marketplaces and search, that offer services in the EU without an establishment there.
- NIS2 Directive Article 26(3) NIS2 Representative DNS providers, TLD registries, domain registration services, cloud and data centre providers, CDNs, managed service and managed security providers, online marketplaces, search engines and social platforms that offer services in the EU without being established there.
- Data Act Article 37(11) Data Act Legal Representative Any company in scope of the Data Act that makes connected products available or offers related services in the EU without being established there.
- Data Governance Act Article 11(3) and Data Governance Act Article 19(3) DGA Data Intermediation Representative and DGA Data Altruism Representative Data intermediation service providers, meaning data marketplaces and data-sharing intermediaries, that offer those services in the EU without being established there.
- e-Evidence Directive Article 3 e-Evidence Legal Representative Service providers offering electronic communications, domain name, IP numbering or other information society services in the EU that have no establishment in a Member State bound by the Directive.
- EU AI Act Article 54 AI Act Representative for general-purpose AI Providers established outside the EU that place a general-purpose AI model on the EU market. Models released under a genuinely free and open-source licence are outside this, unless they present systemic risk.
- EU AI Act Article 22 AI Act Representative for high-risk systems Providers established outside the EU that make a high-risk AI system available on the EU market. The appointment has to be in place before the system goes on the market.
- TCO Regulation Article 17 TCO Legal Representative Hosting service providers without a main establishment in the EU that let users store and share content publicly.
On the product side, for physical goods placed on the EU market, we also act as the GPSR responsible person and the EU authorized representative for CE-marked goods, both scoped on enquiry. Regimes outside the EU and UK, such as China, Korea and Turkey, are covered on non-EU representative services.
What it costs
One annual price per mandate per company size band, charged once, up front.
Your band is set by how many people work at your company, your global annual revenue, and how many people in the EU and UK you hold personal data about. Whichever puts you highest wins. There is no setup fee, no monthly option and no call.
The smallest band is for very small organizations only: 1 to 10 people, under €2m in global annual revenue, and under 5,000 people in the EU and UK whose personal data you hold. All three must be true. If any one of them is not, the next band up applies.
| EU Representative | UK Representative | Every other mandate |
|---|---|---|
| Band 0: 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold | ||
| €690 a year | €550 a year | Standard €550 a year AI Act and TCO €690 a year |
| Band 1: 11 to 50 people, or €2m to €10m revenue, or 5,000 or more people in the EU and UK whose data you hold | ||
| €990 a year | €790 a year | Standard €790 a year AI Act and TCO €990 a year |
| Band 2: 51 to 250 people, or €10m to €50m revenue | ||
| €2,290 a year | €1,830 a year | Standard €1,830 a year AI Act and TCO €2,290 a year |
| Band 3: 251 or more people, or over €50m revenue | ||
| €4,490 a year | €3,590 a year | Standard €3,590 a year AI Act and TCO €4,490 a year |
Standard price: Swiss Representative, DSA Legal Representative, NIS2 Representative, Data Act Legal Representative, DGA Data Intermediation Representative, DGA Data Altruism Representative, e-Evidence Legal Representative.
AI Act and TCO price: AI Act Representative for general-purpose AI, AI Act Representative for high-risk systems, TCO Legal Representative.
More than one mandate. Only the most expensive appointment in your basket is charged in full. Every other one is charged at half its own price. At the smallest band, adding the UK appointment to the EU one costs €275, and the two together are €965 a year.
Optional extras, charged once per order and never per appointment. Higher-risk processing, which covers GDPR Article 9 special category data and Article 10 criminal offense data, is €250, €500, €750 or €1,000 by band 0 to 3. Same-business-day response acknowledges and forwards authority and data subject correspondence the same business day instead of the next working day, and is €1,200 a year.
Commercial pricing bands based on familiar market-size and market-pricing thresholds. They are not a statutory size test.
The public register
Every active appointment we hold is listed on the representative verification register, with an appointment date, a status and a verification page of its own. A supervisory authority, a customer or a due-diligence reviewer can confirm an appointment there without contacting us or you, and the wording we give you for your privacy notice links straight to that page. Nobody else in this field publishes a browsable register.
How it works
From your first answer to a live appointment.
-
1. Answer five questions
Which mandates you need, how many people work at your company, roughly what your global revenue is, how many people in the EU and UK you hold data about, and whether you process health, biometric or other higher-risk data. The price appears as you answer.
-
2. Accept the agreement and pay
One annual charge, up front, by card or SEPA. The agreement has one shared set of terms and a schedule per mandate, so the AI Act appointment and the GDPR one are not sold under the same liability clause.
-
3. Everything issues
After payment you complete a short form about your company and who should receive correspondence, about three minutes of typing. The appointment document, the certificate, the public verification page and the exact wording for your privacy notice then issue automatically, in seconds.