--- title: "TCO Legal Representative | Article 17" url: "https://www.engagecompliance.co/tco-representative" type: "service" date: "2026-08-27" --- # Terrorist Content Online legal representative under Article 17 Hosting providers whose main establishment sits outside the EU need a legal representative in the Union under Article 17 of the Terrorist Content Online Regulation. Engage Compliance takes that role from its EU establishment, with a staffed escalation path for the one-hour removal clock, not a mailbox. **The short answer: if you run a hosting service that offers services in the Union and disseminates information to the public, and your main establishment is outside the EU, Article 17 of Regulation (EU) 2021/784 requires you to designate a legal representative in the Union in writing.** That representative receives removal orders on your behalf, and those orders carry a one-hour deadline to act. Engage Compliance provides the role from its EU establishment and runs it with a real escalation path so the clock can actually be met. ## Key takeaways - Engage Compliance acts as your Article 17 legal representative in the Union, appointed in writing and performed from our EU establishment, with the details made public as the Regulation requires. - The trigger is your **main establishment** being outside the Union, not the absence of any EU presence. A provider with a small EU subsidiary but its head office abroad is still caught. This is a wider trigger than the DSA, and it is almost never drawn correctly in the market. - The representative is the designated recipient of removal orders, and Article 3(3) gives a hosting provider one hour to remove or disable access after an order is received. We run the mandate with a staffed escalation route, because a one-hour clock landing in an unstaffed inbox is an unmanaged risk. - There is no exemption and no size threshold. If you are a hosting provider that disseminates information to the public and offers services in the Union, the obligation applies. - The obligation has been in force since 7 June 2022, so this is a current duty, not a future one. ## Who needs a TCO legal representative Article 17(1) requires a hosting service provider which does not have its main establishment in the Union to designate, in writing, a natural or legal person as its legal representative in the Union, for the receipt of, compliance with and enforcement of removal orders and decisions issued by the competent authorities. The scope in Article 1(2) reaches hosting service providers offering services in the Union, whatever their place of main establishment, insofar as they disseminate information to the public. Offering services in the Union means enabling people in one or more Member States to use the service where there is a substantial connection to those Member States, which can come from a significant number of users in a Member State or from targeting activity at one. So you are in scope when both of these hold: you host content that is disseminated to the public, and you offer that service to people in the EU. If both are true and your main establishment is outside the Union, you need the appointment. ## How this differs from the DSA (the trap most providers miss) This is the point worth getting right, because the wording looks similar and the effect is not. The DSA Article 13 duty catches a provider that has **no** establishment in the Union at all. The TCO duty in Article 17 catches a provider whose **main** establishment is outside the Union, even if it has an EU subsidiary. The gap between those two tests is real: a company that opens a small Dublin office moves out of the DSA representative duty, because it now has an EU establishment, and stays inside the TCO one, because its main establishment is still abroad. The practical consequence is that a hosting provider can need a TCO representative and a DSA representative for overlapping but not identical reasons, and clearing one does nothing for the other. We size both separately rather than treating them as one appointment. ## Who is exempt Nobody, by design. Article 17 carries no exemption and no carve-out, and there is no turnover, headcount or user-count threshold. If your service meets the scope test in Article 1(2), the duty applies whatever your size. ## When it applies from 7 June 2022, under Article 24. The obligation is live now, and Member States had to have their penalty rules in place from the same date. If you have been offering a public hosting service into the EU from outside the Union and have never appointed a representative, the duty has already applied to you for some time. ## Where the representative must be established Under Article 17(2), the legal representative must reside or be established in one of the Member States where the hosting service provider offers its services. The provider also has to give the representative the powers and resources needed to comply with removal orders and decisions and to cooperate with the competent authorities. Engage Compliance performs this role from its EU establishment. For a provider that offers services in the Netherlands, we act directly, with no local partner in the middle. Under Article 17(4) the provider notifies the competent authority and makes the representative's details public, and we give you the wording to do that. ## The one-hour clock, and why the appointment has to work This is where a TCO mandate is different in kind from a quieter representative role. Article 3(3) requires a hosting provider to remove terrorist content, or disable access to it in all Member States, as soon as possible and in any event within one hour of receiving a removal order. The legal representative is the designated recipient of that order, so the hour starts when the order reaches the representative. A one-hour deadline running to an inbox that nobody watches around the clock is not a compliance arrangement, it is exposure with a contact name on it. We run the mandate with a defined escalation path into your team, so an incoming order reaches the person who can act on it and the clock is treated as the emergency it is. Any TCO appointment sold as a plain forwarding address is mis-sold. ## What the penalty is Member States lay down the penalties under Article 18(1). Article 18(3) then sets a specific ceiling for the removal duty: a systematic or persistent failure to comply with the one-hour obligation in Article 3(3) is subject to financial penalties of up to 4% of the provider's global turnover for the preceding business year. Read that ceiling carefully. The 4% figure is tied to the Article 3(3) removal obligation, not to the appointment in Article 17. Failing to appoint a representative is punishable under whatever national penalty regime a Member State has adopted, rather than under the 4% ceiling. The 4% is the reason the appointment has to be operational rather than nominal: it is the removal clock, not the paperwork, that carries the heavy penalty, and the representative is the point the clock runs to. One more thing to know about the role's own risk. Under Article 17(3), the legal representative may be held liable for infringements of the Regulation, without prejudice to any liability of, or legal action against, the hosting provider itself. So the representative is not a purely passive letterbox in the eyes of the law, which is another reason to run the mandate properly. ## What Engage delivers - **Appointment in writing** that meets the Article 17(1) requirement, performed from our EU establishment. - **A published contact point** for the competent authorities, in a form you can use to meet the notification and publication duty in Article 17(4). - **A staffed escalation route** for incoming removal orders, built around the one-hour clock in Article 3(3), so an order reaches someone who can act rather than sitting in a queue. - **Handling of correspondence** from the competent authorities, routed to your named internal owner with the deadline flagged. - **Annual review**, because the appointment stops being accurate the moment your service footprint or establishment changes. There is no record-keeping duty on the representative under the TCO Regulation, so this is a receipt-and-response mandate rather than a document-custody one. That keeps it lean, but it is exactly why the response side has to be fast. ## What it costs Pricing is scoped to the mandate, because the right shape depends on your service, where you offer it, and whether you also need a DSA or other EU appointment alongside it. Tell us what you run and we will give you a quote. [Talk to us](/contact) to get started. ## Sources and references - [Regulation (EU) 2021/784 (Terrorist Content Online Regulation)](https://eur-lex.europa.eu/eli/reg/2021/784/oj), EUR-Lex ## Frequently asked questions ### What is a TCO legal representative? It is the person or company a hosting service provider designates in writing, under Article 17 of Regulation (EU) 2021/784, to receive, comply with and enforce removal orders and decisions from the competent authorities. The representative is the designated point that a removal order is sent to, and the order runs a one-hour clock from the moment it is received. ### Who needs a TCO Regulation representative? A hosting service provider that offers services in the Union and disseminates information to the public, where its main establishment is not in the Union. The trigger is main establishment, so a provider with a small EU subsidiary but its head office in California is still caught. There is no exemption and no size threshold. ### How is this different from a DSA legal representative? The DSA Article 13 duty turns on having no EU establishment at all. The TCO duty turns on your main establishment being outside the Union. A provider that opens a small Dublin office exits the DSA duty but stays inside the TCO one, so the two are not interchangeable and a company can need both at once. ### What is the one-hour removal rule? Article 3(3) requires a hosting provider to remove terrorist content, or disable access to it in all Member States, within one hour of receiving a removal order. The legal representative is the designated recipient of that order, so the clock starts when it reaches the representative. A representative that is only a mailbox cannot meet it. ### What is the penalty under the TCO Regulation? Member States set the penalties under Article 18(1). Article 18(3) requires that a systematic or persistent failure to meet the one-hour removal obligation in Article 3(3) is subject to financial penalties of up to 4% of the provider's global turnover for the preceding business year. The 4% figure is tied to the removal obligation, not to the appointment itself, and failing to appoint is punishable under the applicable national penalty regime. ### Where must the TCO representative be established? Under Article 17(2), the legal representative must reside or be established in one of the Member States where the hosting service provider offers its services. Engage Compliance provides the role from its EU establishment, so for a provider offering services in the Netherlands it is performed directly, with no local partner needed.