Representative services

Representative Service Agreement

This Representative Service Agreement (the Agreement) is between the Customer who appoints us through the representative service sign-up (the Customer, you) and:

Engage Data Consulting B.V., a private limited company registered in Amsterdam, the Netherlands, KvK number 82538638; and
Engage Compliance UK Ltd, a company registered in England and Wales, 124 City Road, London EC1V 2NX.

Engage, we and us mean whichever of those entities is named in the schedule for the mandate concerned. Clause 16 sets out which entity contracts with you for each mandate.

Clauses 1 to 17 apply to every appointment. Each mandate has a schedule setting out what that appointment covers, what you publish, and what we need from you. Where a schedule and these clauses differ, the schedule applies to that appointment.

1. Scope of the service

Engage acts as your representative under the mandates you have purchased, under the instrument named in each schedule. In that role we act as your named point of contact for the authorities named in that schedule, and for individuals where the instrument provides for it. We carry out the representative function and nothing more under this Agreement.

Each mandate is a separate appointment. Buying one does not give you another, and ending one does not end another.

2. Your obligations

Accurate information. You provide complete and accurate information about your organisation and your processing, and you keep it current.

Accuracy warranty. You warrant that the information you give us at sign-up and during the appointment, including your legal name and company details, country of incorporation, company size and whether you carry out higher-risk processing, is true, accurate and complete. We rely on it, including to set your fee. If any of it is or becomes materially inaccurate or misleading, we may correct the fee for future billing cycles, suspend the service or terminate it.

Your own compliance. You remain responsible for your own compliance under each instrument under which you appoint us. You perform your own compliance work; we do not perform it for you under this Agreement.

Records and documentation. You give us, and keep current, whatever the schedule for each of your mandates requires. What is required differs by mandate and may include, without limitation, a record of processing activities, technical documentation, and contact details for the person responsible for keeping it current. Some mandates place the record in our hands rather than yours, and some require us to hold documentation for a period that outlives this Agreement. Each schedule states which applies.

3. Role limits

Under this Agreement:

Engage is not your Data Protection Officer. That is a separate role and a separate engagement.
Engage is not a controller or a processor of your personal data.
Engage does not provide compliance, legal or regulatory advice, and does not advise you on how to respond to any correspondence we forward.

4. Service level

We forward communications from authorities and from individuals to you no later than the next working day after we receive them.

Same-business-day response. Where you have purchased the same-business-day response add-on, we forward those communications to you the same business day we receive them. It applies to every mandate on your order. It sets when correspondence reaches you and nothing else. It is not advice, it is not a review of your programme, and it does not change what any appointment covers.

Both service levels commit us to passing correspondence on. Answering the sender is yours to do. Nothing in this clause commits us to reply on your behalf, to advise you on a reply, or to confirm receipt to whoever wrote in. Where a schedule puts a further step on us for a particular mandate, that schedule says so and it applies.

Both service levels are subject to reasonable use and do not apply to communications that are unlawful, abusive or outside the scope of the appointment.

Where an instrument sets a shorter period than ours, that period applies. The Terrorist Content Online Regulation gives you one hour from receipt of a removal order to remove the content; we pass an order of that kind to your named contact immediately on receipt, and the obligation to act on it within the hour is yours.

5. Scope exclusion and refunds

Any enquiry, complaint, investigation or correspondence from an authority that existed or was notified before your appointment date is outside the scope of this service.

Engage may decline an appointment. If we do, we cancel the subscription and refund your payment in full, automatically. You do not need to ask, and no appointment comes into effect.

6. Fees and renewal

Fees are as set out in the plan you select at sign-up, including any add-ons. Billing is annual, in advance, in one payment at the start of each cycle. The subscription renews automatically at the end of each cycle unless cancelled under clause 12. Fees are non-refundable except where a refund is required by law or by clause 5. We may change fees for a future cycle by giving you notice before that cycle begins. If fees are not paid when due, we may suspend or withdraw the appointment after giving you notice.

7. Liability

Engage's total aggregate liability arising out of or in connection with this Agreement is capped at the fees you paid to us in the twelve months before the event giving rise to the liability.

Engage is liable only for loss caused directly by Engage's own breach of this Agreement or its own negligence. Engage is not liable for indirect or consequential loss, loss of profit, loss of business, loss of goodwill or loss of data.

Engage's obligations under any mandate are limited to those the instrument places on the representative itself. Engage does not assume, and is not liable for, any obligation the instrument places on you.

Engage maintains professional indemnity insurance appropriate to the services for the duration of the appointment.

Nothing in this Agreement limits liability that cannot be limited under applicable law.

8. Your indemnity

You indemnify Engage against third-party claims, regulatory proceedings, fines and losses, including reasonable legal costs, arising from your processing of personal data, from your operation of the service or system to which a mandate relates, or from your breach of this Agreement. This does not require you to indemnify Engage for loss caused by Engage's own breach of this Agreement or its own negligence.

9. Engage's data handling

To perform the representative function, Engage processes only the personal data needed for that purpose: your contact details and the correspondence we relay between you, authorities and individuals. Engage is not a processor of your broader personal data under this Agreement and does not access, host or process the personal data you hold about your own users beyond what is described here. Each party handles that data in line with applicable data protection law.

10. Confidentiality

Each party keeps the other party's confidential information confidential and uses it only to perform this Agreement. This does not apply to information that is or becomes public through no breach of this Agreement, that a party already held without a duty of confidence, or that a party is required to disclose by law or to an authority.

This clause does not prevent Engage publishing the representative contact page described in clause 15. That page carries your legal entity name, the mandates you hold, the name and address of the Engage entity appointed under each one, and a route to contact us. It carries nothing else about you, and nothing on it is information the instruments do not already require you to publish.

11. Acceptable use and sanctions

You warrant that your processing of personal data, and your operation of any service or system to which a mandate relates, is lawful. Engage may suspend or terminate the service immediately if your use is unlawful, abusive, sanctioned or fraudulent.

Sanctions law binds each Engage entity under the law of its own jurisdiction. Engage Data Consulting B.V. is a Netherlands company, so EU restrictive measures apply to it directly. Engage Compliance UK Ltd is a company incorporated in England and Wales, so applicable UK sanctions law applies to it directly. Neither entity may make or maintain an appointment that the sanctions law binding it prohibits.

We screen the country of incorporation you give us against the EU list of countries under restrictive measures before any appointment is issued. Where that screen stops an order, no appointment comes into effect, nothing is issued, and clause 5 applies. The screen is one check rather than the whole of the law: where sanctions law binding either entity prohibits an appointment the screen did not stop, we decline or end that appointment and clause 5 applies in the same way.

12. Term and termination

Either party may terminate this Agreement on notice to the other. Where you give notice, the appointment ends at the end of the billing cycle you have paid for, and that cycle's fee is not refunded. Where Engage gives notice, the appointment ends at the end of the billing cycle you have paid for unless we say otherwise. Notice is given by email under clause 14.

On termination you must remove Engage as your representative from your privacy notice, your website, your records and any register or notification where a schedule required you to publish or notify us, within thirty days.

Each mandate ends separately. Public verification of an appointment reflects its current status and ends when that appointment ends.

Where an instrument requires Engage to terminate a mandate and notify an authority in defined circumstances, Engage may do so, and doing so is not a breach of this Agreement. The schedule for that mandate states where this applies.

13. Governing law and jurisdiction

Where Engage Data Consulting B.V. is the contracting entity, this Agreement is governed by the laws of the Netherlands and the courts of Amsterdam have exclusive jurisdiction.

Where Engage Compliance UK Ltd is the contracting entity, this Agreement is governed by the laws of England and Wales and the courts of England and Wales have exclusive jurisdiction.

In each case this is without prejudice to any mandatory right you have to bring proceedings in another forum.

14. General

Entire agreement. This Agreement is the entire agreement between the parties about its subject and replaces any earlier discussions or agreements about it.

Assignment. You may not assign or transfer this Agreement without our prior written consent. Engage may assign or transfer it to an affiliate or to a successor of its business.

Severability. If any part of this Agreement is held invalid or unenforceable, the rest remains in force.

Changes to these terms. Engage may update these terms by giving you notice. Where a change materially reduces your rights, you may cancel under clause 12.

Force majeure. Neither party is liable for any failure or delay caused by events beyond its reasonable control.

Notices. We give notices to the email address you provide at sign-up. You give notices to representative@engagecompliance.co. Notices are treated as received on the next working day after they are sent.

15. Your representative contact page

Engage provides you, as part of this service, a hosted public page identifying your legal entity and the representative appointed for it. The page carries the representative's email address, the postal address of the relevant establishment, and a route to submit a request. It is included in the fee for every mandate.

You are required to use the URL of that page, as provided to you, as the representative contact route. You publish it on the surface each schedule identifies, which may be your privacy notice, your terms of use, your data processing agreement, your trust centre or an equivalent public page, as set out in the representative communications setup we send you on issuance.

Publishing it is your obligation. Engage is not liable for any consequence of your failure to publish it, or of publishing it incorrectly or incompletely.

The page ends when the appointment ends. It reflects the current status of each appointment, so a terminated appointment shows as ended, and when your last appointment ends the page ends with it.

16. Which Engage entity contracts with you

Engage represents you through the establishment the instrument requires, and that is not the same legal entity for every mandate. The entity named below contracts with you for that mandate, is appointed under it, and appears on the appointment document, the certificate and the wording you publish.

Engage Data Consulting B.V., Amsterdam, Noord-Holland, Netherlands. KvK 82538638.

EU Representative (GDPR Article 27); DSA Legal Representative (Digital Services Act Article 13); NIS2 Representative (NIS2 Directive Article 26(3)); Data Act Legal Representative (Data Act Article 37(11)); DGA Data Intermediation Representative (Data Governance Act Article 11(3)); DGA Data Altruism Representative (Data Governance Act Article 19(3)); e-Evidence Legal Representative (e-Evidence Directive Article 3); AI Act Representative for general-purpose AI (EU AI Act Article 54); AI Act Representative for high-risk systems (EU AI Act Article 22); TCO Legal Representative (TCO Regulation Article 17).

Engage Compliance UK Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.

UK Representative (UK GDPR Article 27).

Engage Compliance Switzerland, Switzerland.

Swiss Representative (Swiss FADP Article 14).

Where an entity above is not yet registered, no appointment issues under it. Your order for that mandate is confirmed and reserved, and the documents issue on the day the entity is in place. You are told which of your mandates this applies to when you order and again in writing afterwards. Nothing further is asked of you in the meantime.

17. Sub-processors

Clause 9 limits what Engage handles to your contact details and the correspondence we relay. Nothing in this clause widens clause 9.

You give Engage general written authorisation to engage sub-processors for that limited purpose. Engage publishes and maintains the current list, with what each sub-processor does and where it processes, at engagecompliance.co/privacy.

Engage publishes an intended addition or replacement at that address before that sub-processor begins processing. Publication at that address is notice to you of the change. Engage gives no separate individual notice. You may subscribe at that address to be alerted when the list changes.

You may object to an intended change on reasonable data protection grounds. If we cannot agree a resolution, you may terminate this Agreement on written notice for the affected mandates, without penalty.

Engage imposes on each sub-processor data protection obligations no less protective than those in this Agreement, and remains responsible to you for what each does with that data.

Where a sub-processor processes personal data outside the EU or the UK, that transfer is made under one or more of: a European Commission adequacy decision; UK adequacy regulations; the EU-US Data Privacy Framework or its UK Extension, where the recipient is certified under it; or Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum. Engage applies supplementary technical and organisational measures, and carries out a transfer impact assessment, where required.

Schedules

One schedule per mandate. Only the schedules for the mandates you bought apply to you. Every reference below is to the primary text of the instrument named.

EU Representative

GDPR Article 27

What this appointment covers

Engage acts as the point of contact in the European Union for supervisory authorities and for data subjects in relation to your processing of personal data, as named in your privacy notice.

What it does not cover

The Article 27 EU Representative function only. It does not appoint Engage as your Data Protection Officer, nor as a controller or processor of your personal data. You remain responsible for your own compliance under the GDPR.

Who needs it

Organisations with no establishment in the EU that offer goods or services to, or monitor the behaviour of, people in the EU.

What you publish

Your privacy notice must name Engage and give the address and contact URL we provide. Articles 13(1)(a) and 14(1)(a) require this: where a controller has a representative, the representative's identity and contact details belong in the information you give the people whose data you process. We send you the exact wording on issuance.

What we need from you

Your Article 30 record of processing activities, in whatever format you keep it, and the name and email of the person we should contact when it needs updating.

Article 30 requires you to keep a written record of what personal data you process and why, and requires us to hold a copy as your EU Representative. The record remains yours. You write it, you keep it current, and you answer to an authority about its contents. We hold the copy and produce it if we are asked for it.

Send it using the documents link in your issuance email. That link is signed to your order, which is why the page is not reachable from the site menu. If you have lost it, email us for a fresh one.

Have this reviewed by your own legal or compliance team before you send it to us. Engage cannot produce it, draft it or review it for you. Where a template is linked below, it is a third party's official template and using it is your decision.

Where to read the law

If nothing has reached us, we remind you at 15, 30 and 45 days after your appointment issues, and then we stop.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

You maintain an Article 30 record of your processing. Engage holds a copy and produces it to a supervisory authority on request.
Your privacy notice names Engage and gives the address and contact URL we provide.
Engage forwards correspondence from data subjects and supervisory authorities to you. You answer it.

UK Representative

UK GDPR Article 27

What this appointment covers

Engage acts as the point of contact in the United Kingdom for the Information Commissioner's Office and for data subjects in relation to your processing of personal data, as named in your privacy notice.

What it does not cover

The Article 27 UK Representative function only. It does not appoint Engage as your Data Protection Officer, nor as a controller or processor of your personal data. You remain responsible for your own compliance under the UK GDPR.

Who needs it

Organisations with no establishment in the UK that offer goods or services to, or monitor the behaviour of, people in the UK.

What you publish

Your privacy notice must name Engage and give the UK address and contact URL we provide. Articles 13(1)(a) and 14(1)(a) of the UK GDPR require this: where a controller has a representative, the representative's identity and contact details belong in the information you give the people whose data you process. We send you the exact wording on issuance.

What we need from you

Your Article 30 record of processing activities, in whatever format you keep it, and the name and email of the person we should contact when it needs updating.

Article 30 requires you to keep a written record of what personal data you process and why, and requires us to hold a copy as your UK Representative. The record remains yours. You write it, you keep it current, and you answer to the Information Commissioner's Office about its contents. We hold the copy and produce it if we are asked for it.

Send it using the documents link in your issuance email. That link is signed to your order, which is why the page is not reachable from the site menu. If you have lost it, email us for a fresh one.

Where to read the law

If nothing has reached us, we remind you at 15, 30 and 45 days after your appointment issues, and then we stop.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

You maintain an Article 30 record of your processing. Engage holds a copy and produces it to the Information Commissioner's Office on request.
Your privacy notice names Engage and gives the UK address and contact URL we provide.
Engage forwards correspondence from people in the UK and from the Information Commissioner's Office to you. You answer it.

Swiss Representative

Swiss FADP Article 14

What this appointment covers

Engage acts as the point of contact in Switzerland for the Federal Data Protection and Information Commissioner and for data subjects in relation to your processing of personal data.

What it does not cover

The Article 14 representative function only, including the record of processing activities the representative maintains under Article 15. It does not appoint Engage as your Data Protection Officer, nor as a controller or processor of your personal data. You remain responsible for your own compliance under the FADP.

Who needs it

Organisations based outside Switzerland whose processing of the data of people in Switzerland is large scale, regular and high risk, and is tied to offering goods or services in Switzerland or monitoring behaviour there.

What you publish

You publish the name and the Swiss address of your representative, as provided to you, on a public page. Your privacy notice is the usual place. Article 14(3) requires this, and it has to be somewhere anyone can read it without asking you for it. We send you the exact wording on issuance.

What we need from you

Article 15 places the record of your processing activities in our hands rather than yours, and requires us to produce it to the Federal Data Protection and Information Commissioner on request. So this mandate needs the underlying detail rather than a finished document, and needs you to tell us when it changes. What we assemble from it is still your account of your own processing.

We need, without limitation:

What personal data you hold about people in Switzerland, and why.
Who you share it with, and which countries it goes to.
How long you keep it.
The name and email of the person we should contact when this changes.

Send it using the documents link in your issuance email. That link is signed to your order, which is why the page is not reachable from the site menu. If you have lost it, email us for a fresh one.

Where to read the law

The Swiss Federal Act on Data Protection, official text at Fedlex, Article 14 for the representative and Article 15 for the record

If nothing has reached us, we remind you at 15, 30 and 45 days after your appointment issues, and then we stop.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Engage maintains the record of your processing under Article 15 and produces it to the Federal Data Protection and Information Commissioner on request. You supply the detail and keep it current.
You publish the name and Swiss address of your representative, as provided to you, on a public page.
Engage forwards correspondence from data subjects in Switzerland and from the Federal Data Protection and Information Commissioner to you. You answer it.

DSA Legal Representative

Digital Services Act Article 13

What this appointment covers

Engage acts as the point of contact in the European Union for the Digital Services Coordinators of the Member States, the European Commission and the European Board for Digital Services, on all issues necessary for the receipt of, compliance with and enforcement of decisions issued under the Regulation.

What it does not cover

The Article 13 legal representative function only. It does not make Engage a provider of intermediary services, and under Article 13(5) it does not constitute an establishment of yours in the Union. You remain responsible for your own compliance.

Who needs it

Providers of intermediary services, including without limitation hosting, online platforms, marketplaces and search, that offer services in the EU without an establishment there.

What you publish

You publish the details of your legal representative, as provided to you, in a place that is publicly available, easily accessible, accurate and kept up to date. Your terms of use or a legal notice page is the usual place. Article 13(4) requires this. We send you the exact wording on issuance.

What we supply is our name, the address of the Engage establishment appointed under this mandate, and an email address. Article 13(4) names a postal address and a telephone number as well. The address we give says where we are rather than giving a street that post can be delivered to, and Engage publishes no telephone number, on any surface and for any client. Both of those are standing Engage decisions about what we publish, the same for every client on every mandate, rather than anything left out of your appointment. You may publish your own postal address and telephone number on the same page alongside the wording we send you.

What you notify

You notify those same details to the Digital Services Coordinator of the Member State where your legal representative is established, which for a Netherlands appointment is the Autoriteit Consument en Markt. Article 13(4) requires this as well as the publication above, and it is a separate step: publishing the block on your own page does not do it.

What we need from you

No document is required for this appointment. Keep your contact details with us current.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Engage is addressable by the European Commission, the European Board for Digital Services and Member State authorities on all issues necessary for the receipt of, compliance with and enforcement of decisions issued under the Regulation.
You publish your representative's details and notify them to the Digital Services Coordinator.
You give Engage the powers and resources needed to cooperate with those authorities.
Engage holds no documents for you under this mandate.

NIS2 Representative

NIS2 Directive Article 26(3)

What this appointment covers

Engage acts as the point of contact in the European Union for the competent authorities and CSIRTs of the Member State in which the representative is established, on all issues relating to your obligations under the Directive.

What it does not cover

The Article 26(3) representative function only. It does not transfer your cybersecurity risk-management or incident-reporting obligations to Engage, and it does not make Engage responsible for your network and information systems.

Who needs it

Entities that offer services in the EU without being established there, including without limitation DNS providers, TLD registries, domain name registration services, cloud and data centre providers, CDNs, managed service and managed security providers, online marketplaces, search engines and social platforms. TLD name registries, DNS service providers and entities providing domain name registration services are in scope regardless of their size.

What you publish

Nothing goes on your website under this mandate.

What you notify

You notify the name, address and contact details of your representative to the competent authority in the Member State where your representative is established, under Article 27(2). That authority's single point of contact forwards the entry to ENISA, so you do not file with ENISA separately. We send you the exact details to submit on issuance.

What we need from you

No document is required for this appointment. Keep your contact details with us current.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Engage is the point of contact for the competent authorities and CSIRTs of the Member State where Engage is established.
Under Article 26(3), your appointment places you under the jurisdiction of the Member State where your representative is established.
You notify your representative's details to that competent authority under Article 27(2) and keep the notification current.
Engage holds no documents for you under this mandate.

Data Act Legal Representative

Data Act Article 37(11)

What this appointment covers

Engage acts as the point of contact in the European Union for the competent authorities and the data coordinator of the Member State in which the representative is located, on all issues relating to your obligations under the Regulation.

What it does not cover

The Article 37(11) legal representative function only. It does not make Engage a data holder, a data recipient or a provider of data processing services, and it does not transfer any of your obligations under the Regulation to Engage.

Who needs it

Organisations in scope of the Data Act that make connected products available or offer related services in the EU without being established there.

What you publish

Nothing is published and nothing is notified under this mandate. We send you your representative's details on issuance, for you to give to a competent authority that asks and to use in any form that requires them.

What we need from you

No document is required for this appointment. Keep your contact details with us current.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Under Article 37(12), Engage is addressable by competent authorities in addition to, or instead of, you on all issues relating to you.
Under Article 37(13), you fall under the competence of the Member State where Engage is located.
Engage holds no documents for you under this mandate.

DGA Data Intermediation Representative

Data Governance Act Article 11(3)

What this appointment covers

Engage acts as the point of contact in the European Union for the competent authority for data intermediation services, and for data subjects and data holders, on all issues related to the data intermediation services you provide.

What it does not cover

The Article 11(3) legal representative function only. It does not make Engage a data intermediation services provider, and the notification you must submit under Article 11(1) remains yours.

Who needs it

Data intermediation service providers, including without limitation data marketplaces and data-sharing intermediaries, that offer those services in the EU without being established there.

What you publish

You publish the address of your representative, as provided to you, on a public website carrying complete and up-to-date information about you and your activities. Article 11(6)(d) requires this. We send you the exact wording on issuance.

What you notify

You notify your representative's details to the competent authority for data intermediation services in the Member State where your representative is located, under Article 11(1). Changes go to that authority within 14 days. The Commission's public register of data intermediation services providers is filled in from what you notify, so you do not file with it separately. This is a separate step from the publication above.

What we need from you

No document is required for this appointment. Keep your contact details with us current.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Engage is the point of contact for the competent authority for data intermediation services, and for data subjects and data holders, on the services you provide.
Your appointment determines which Member State's competent authority you answer to.
You publish your representative's address, notify your representative's details to that authority, and notify changes within 14 days.
Engage holds no documents for you under this mandate.

DGA Data Altruism Representative

Data Governance Act Article 19(3)

What this appointment covers

Engage acts as the point of contact in the European Union for the competent authority for the registration of data altruism organisations, and for data subjects and data holders, on all issues related to you.

What it does not cover

The Article 19(3) legal representative function only. It does not make Engage a data altruism organisation, and it is not a grant or a guarantee of registration in any Member State register.

Who needs it

Organisations seeking recognition as a data altruism organisation that are not established in the EU. The representative is what makes registration in a Member State register possible.

What you publish

You publish the address of your representative, as provided to you, on a public website carrying complete and up-to-date information about you and your activities. Article 19(4)(f) requires this. We send you the exact wording on issuance.

What you notify

You apply for registration with the competent authority for the registration of data altruism organisations in the Member State where your representative is located, under Article 19(1) to (3), giving your representative's details. Changes go to that authority within 14 days, under Article 19(7). The national and Union public registers of recognised data altruism organisations are filled in from what you notify, so you do not file with them separately. This is a separate step from the publication above.

What we need from you

No document is required for this appointment. Keep your contact details with us current.

How long we hold it

Six years.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Engage is the point of contact for the competent authority for the registration of data altruism organisations, and for data subjects and data holders.
Your appointment determines which Member State's competent authority you answer to.
You publish your representative's address, give your representative's details in your registration application, and notify changes within 14 days.
Engage holds no documents for you under this mandate.

e-Evidence Legal Representative

e-Evidence Directive Article 3

What this appointment covers

Engage acts as the point of contact in the European Union for the competent authorities of the Member States, for the receipt of, compliance with and enforcement of European Production Orders and European Preservation Orders and other decisions addressed to you.

What it does not cover

The designated legal representative function under Article 3 only. It does not make Engage a service provider, and it does not authorise Engage to produce or preserve your data. You remain responsible for acting on any order you receive.

Who needs it

Service providers with no establishment in a Member State bound by the Directive that offer services in the EU, including without limitation electronic communications, domain name and IP numbering services and other information society services.

What you publish

Nothing goes on your website under this mandate.

What you notify

Under Article 4(1) and (2), you notify your representative's details in writing to the central authority, designated under Article 6, of the Member State where your legal representative resides, naming the languages the representative can be addressed in. The Member State publishes what you notify on the dedicated web page of the European Judicial Network in criminal matters, so you do not file there separately. We send you the exact details to submit on issuance.

What we need from you

No document is required for this appointment. Keep your contact details with us current.

How long we hold it

Six years.

Response window

Production and preservation orders are passed to your named contact immediately on receipt. Regulation (EU) 2023/1543 gives eight hours in an emergency case, so this is one of two appointments where your own out-of-hours cover matters as much as ours.

What this appointment requires

Engage receives decisions and orders for gathering electronic evidence in criminal proceedings and forwards them to you.
Under Article 3(4), you must give Engage the powers and resources needed to comply with such an order, and this obligation continues for the life of the appointment. Member States verify that Engage has them.
You notify your representative's details to the Member State central authority and keep the notification current.
Engage holds no documents for you under this mandate.

AI Act Representative for general-purpose AI

EU AI Act Article 54

What this appointment covers

Engage acts as the point of contact in the European Union for the AI Office and the national competent authorities, on all issues related to ensuring compliance with the Regulation.

What it does not cover

The Article 54 authorised representative function only. It does not make Engage the provider of the model, and it does not transfer the obligations in Article 53 to Engage.

Under Article 54(5), Engage must terminate this mandate and inform the AI Office, giving its reasons, if Engage considers or has reason to consider that you are acting contrary to your obligations under the Regulation.

Who needs it

Providers established outside the EU that place a general-purpose AI model on the EU market. Models released under a genuinely free and open-source licence are outside this, unless they present systemic risk.

What you publish

What we need from you

Article 54 requires Engage to keep your documentation at the disposal of the AI Office and the national competent authorities for ten years after the model is placed on the EU market. That duty is the Regulation's and not a free-standing promise of ours: Engage owes it to the extent, and for as long as, the Regulation imposes it on Engage in respect of your model, and Engage does not undertake it beyond what the Regulation requires. It is why we need the documents themselves rather than a link to them, and why we need the current version whenever one supersedes it.

The documents you supply to us:

The Annex XI technical documentation for the model, in full, as a file rather than a link.
The Annex XII information and documentation made available to downstream providers.
The policy required by Article 53(1)(c) for complying with Union copyright law, including how reservations of rights under Article 4(3) of Directive (EU) 2019/790 are identified and respected.
The publicly available summary of the training content required by Article 53(1)(d), together with the URL where it is published.
Where the model is one with systemic risk under Article 55: the model evaluation and adversarial testing records, the systemic-risk assessment and mitigation record, the serious-incident tracking and reporting procedure, and a description of the cybersecurity protection in place.
The date the model was placed on the EU market, which starts the ten-year period and which only you have.
Your own contact details as the provider, which we hold alongside the documents.
A signed copy of this mandate.

Your written statement, signed by someone authorised to give it, confirms:

That the Annex XI technical documentation has been drawn up and that the copy supplied to us is the current version.
That the obligations in Article 53 are fulfilled in respect of the model.
Where Article 55 applies to the model, that the obligations in Article 55 are fulfilled, and where it does not apply, why not.
That you will tell us within thirty days if any of that stops being true, or if any document supplied is superseded.

Send these using the documents link in your issuance email. That link is signed to your order, which is why the page is not reachable from the site menu. If you have lost it, email us for a fresh one.

Have these reviewed by your own legal or compliance team before you send them to us. Engage cannot produce them, draft them or review them for you. Where a template is linked below, it is a third party's official template and using it is your decision.

Where to read the law

If nothing has reached us, we remind you at 15, 30 and 45 days after your appointment issues, and then we stop.

How we verify, and what that does and does not mean

Article 54(3)(a) requires Engage to verify that the Annex XI technical documentation has been drawn up and that the obligations under Article 53 and, where applicable, Article 55 have been fulfilled by the provider. The Regulation prescribes no audit standard, method, depth or frequency, so this schedule sets the scope of that verification and this is it.

Engage's verification consists of receiving and inspecting the documents listed above, and of your written statement. Inspecting means Engage checks that each document is present, identifiable, dated, and on its face the document it claims to be.

What Engage does not do. This list is part of the scope rather than a disclaimer around it:

Engage does not audit you, and this is not an audit.
Engage does not test, evaluate, red-team or benchmark the model.
Engage does not re-perform or review any conformity assessment, evaluation or risk assessment.
Engage does not check whether the technical content of a document is correct, complete or adequate, and gives no opinion on whether the model complies with the Regulation.
Engage does not verify the accuracy of your training-content summary against your actual training data.

If a document is missing, or your statement cannot be given, Engage tells you what is outstanding. Where Engage cannot complete the verification because you have not supplied something, that is a failure of your obligation under clause 2, and clause 11 permits suspension or withdrawal of the appointment if it stays outstanding.

How long we hold it

Ten years, running from the date the model was placed on the EU market rather than from the date Engage is appointed. You supply that date at onboarding and Engage records it on the appointment. Where you cannot give that date, Engage holds the documents for ten years from the date it receives them.

That period is the Regulation's and not a free-standing undertaking of ours. Engage holds the documentation to the extent, and for as long as, the Regulation imposes that duty on Engage in respect of your model. If the Regulation does not apply to your model, or ceases to apply to it, or its application dates move, or the duty is amended or withdrawn, Engage's duty moves with it. Engage does not undertake it beyond what the Regulation requires.

When this appointment ends, for any reason and by either party, Engage returns the documentation it holds under this schedule to you, or transfers it to the authorised representative you appoint in Engage's place, at your written election made before the appointment ends. Engage makes the return or transfer within thirty days of the appointment ending, in the formats in which the documentation is held. Where you make no election before the appointment ends, Engage returns it to the contact address on your order.

On completing the return or transfer, Engage's obligation to hold, retain or make available that documentation ends. Engage keeps no copy except any copy it is required by law to keep, and Engage gives no undertaking to hold the documentation for any period after this appointment ends.

Where you want Engage to go on holding a copy after this appointment ends, and to go on making it available to you or to a competent authority on request, that is the Archive Service. It is charged at EUR 300 a year per appointment, is arranged with us separately, runs for successive periods of twelve months, renews only where you renew it, and never starts on its own when an appointment ends.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Engage holds your Annex XI technical documentation at the disposal of the AI Office and the national competent authorities for ten years after the model is placed on the EU market, to the extent and for as long as the Regulation imposes that duty on Engage in respect of your model.
When this appointment ends, Engage returns that documentation to you or transfers it to your incoming representative within thirty days, keeps no copy after that, and gives no undertaking to hold it afterwards. The Archive Service is the way to have Engage go on holding it.
Under Article 54(5), Engage must terminate the mandate and inform the AI Office, giving its reasons, if Engage considers or has reason to consider that you are acting contrary to your obligations under the Regulation.
Engage verifies the documents to the extent set out above, keeps a copy of the mandate for the AI Office, and holds your contact details.
You supply and keep current the documents and the written statement set out above.

AI Act Representative for high-risk systems

EU AI Act Article 22

What this appointment covers

Engage acts as the point of contact in the European Union for the market surveillance authorities and the national authorities and bodies referred to in Article 74(10), on all issues related to ensuring compliance with the Regulation.

What it does not cover

The Article 22 authorised representative function only. It does not make Engage the provider of the system, and it does not transfer the conformity-assessment or technical-documentation obligations to Engage.

Under Article 22(4), Engage must terminate this mandate and inform the relevant market surveillance authority, and the notified body where there is one, giving its reasons, if Engage considers or has reason to consider that you are acting contrary to your obligations under the Regulation.

Who needs it

Providers established outside the EU that make a high-risk AI system available on the EU market. The appointment has to be in place before the system goes on the market.

What you publish

Nothing goes on your website under this mandate.

What you notify

Nothing is notified by you either. Under Article 22(3)(e) with Article 49(1), registration in the EU database for high-risk AI systems listed in Annex III is Engage's act where the mandate covers it, and it happens before the system is placed on the market or put into service. Where you register the system yourself, Engage checks that your entry is correct.

What we need from you

Article 22(3)(b) requires Engage to keep your documentation at the disposal of the authorities for ten years after the system is placed on the market or put into service. That duty is the Regulation's and not a free-standing promise of ours: Engage owes it to the extent, and for as long as, the Regulation imposes it on Engage in respect of your system, and Engage does not undertake it beyond what the Regulation requires. It is why we need the documents themselves rather than a link to them, and why we need the current version whenever one supersedes it.

The documents you supply to us:

The EU declaration of conformity for the system.
The Annex IV technical documentation, in full, as a file rather than a link.
The certificate issued by the notified body, where a notified body was involved.
A statement of which conformity assessment procedure under Article 43 was carried out, and by whom.
The Annex VIII registration entry, or its reference in the EU database, where registration under Article 49 applies.
The date the system was placed on the market or put into service, which starts the ten-year period and which only you have.
Your own contact details as the provider, which we hold alongside the documents.
A signed copy of this mandate.

Your written statement, signed by someone authorised to give it, confirms:

That the EU declaration of conformity and the technical documentation have been drawn up, and that the copies supplied to us are the current versions.
That an appropriate conformity assessment procedure under Article 43 has been carried out, naming which one.
That you will tell us within thirty days if any of that stops being true, or if any document supplied is superseded.

Where to read the law

If nothing has reached us, we remind you at 15, 30 and 45 days after your appointment issues, and then we stop.

How we verify, and what that does and does not mean

Article 22(3)(a) requires Engage to verify that the EU declaration of conformity and the technical documentation have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider. The Regulation prescribes no audit standard, method, depth or frequency, so this schedule sets the scope of that verification and this is it.

What Engage does not do. This list is part of the scope rather than a disclaimer around it:

Engage does not audit you, and this is not an audit.
Engage does not test or evaluate the system.
Engage does not re-perform, review or second-guess the conformity assessment, and Engage is not a notified body.
Engage does not check whether the technical content of a document is correct, complete or adequate, and gives no opinion on whether the system conforms.

How long we hold it

Ten years, running from the date the system was placed on the market or put into service rather than from the date Engage is appointed. You supply that date at onboarding and Engage records it on the appointment. Where you cannot give that date, Engage holds the documents for ten years from the date it receives them.

That period is the Regulation's and not a free-standing undertaking of ours. Engage holds the documentation to the extent, and for as long as, the Regulation imposes that duty on Engage in respect of your system. If the Regulation does not apply to your system, or ceases to apply to it, or its application dates move, or the duty is amended or withdrawn, Engage's duty moves with it. Engage does not undertake it beyond what the Regulation requires.

Response window

Correspondence forwarded to you within one business day.

What this appointment requires

Engage holds your EU declaration of conformity, Annex IV technical documentation and any notified body certificate at the disposal of the authorities for ten years after the system is placed on the market or put into service, to the extent and for as long as the Regulation imposes that duty on Engage in respect of your system.
When this appointment ends, Engage returns that documentation to you or transfers it to your incoming representative within thirty days, keeps no copy after that, and gives no undertaking to hold it afterwards. The Archive Service is the way to have Engage go on holding it.
Under Article 22(4), Engage must terminate the mandate and inform the relevant market surveillance authority, and the notified body where there is one, giving its reasons, if Engage considers or has reason to consider that you are acting contrary to your obligations under the Regulation.
Engage registers the system in the EU database under Article 22(3)(e) where the mandate covers it, verifies the documents to the extent set out above, and provides a copy of the mandate to authorities on request.
You supply and keep current the documents and the written statement set out above.

TCO Legal Representative

TCO Regulation Article 17

What this appointment covers

Engage acts as the point of contact in the European Union for the competent authorities of the Member States, for the receipt of, compliance with and enforcement of removal orders and decisions issued under the Regulation.

What it does not cover

The Article 17 legal representative function only. It does not make Engage a hosting service provider and it does not transfer the one-hour removal obligation in Article 3(3) to Engage. You remain responsible for removing or disabling access to the content.

Who needs it

Hosting service providers with no main establishment in the EU that let users store and share content publicly.

What you publish

You publish the name and contact details of your legal representative, as provided to you, somewhere anyone can read it without asking you for it. Your terms of use or a legal notice page is the usual place. Article 17(4) requires this. We send you the exact wording on issuance.

What you notify

You notify those same details to the competent authority designated under Article 12(1)(d) in the Member State where your legal representative resides or is established, which for a Netherlands appointment is the Autoriteit Terroristische Content en Kindermisbruikmateriaal. Article 17(4) requires this as well as the publication above, and it is a separate step.

What we need from you

No document is required for this appointment. Keep your contact details with us current.

How long we hold it

Six years.

Response window

Removal orders are passed to your named contact immediately on receipt. Article 3(3) gives you one hour from receipt to remove the content, so this is one of two appointments where your own out-of-hours cover matters as much as ours.

What this appointment requires

Engage receives removal orders and decisions and passes them to your named contact immediately on receipt.
Under Article 3(3), the one-hour removal clock is yours. Engage cannot remove your content for you.
You publish your representative's details and notify them to the competent authority.
Engage holds no documents for you under this mandate.

Version: 2026-09-08.1.