Introduction
The EU Data Act (Regulation (EU) 2023/2854) introduces a representation duty for certain non‑EU businesses operating within the EU’s data economy. If these businesses are within the scope of the Regulation and engage with EU users through connected products or covered services, they must appoint a legal representative in the EU to interface with national authorities and help ensure compliance.
Who must appoint a representative?
From 12 September 2025, any entity that (i) falls within the Data Act’s scope, (ii) makes connected products available on the EU market or offers services in the Union, and (iii) is not established in the EU, must designate a legal representative in one EU Member State. ’Connected product’ is broadly defined as an item that obtains, generates or collects data about its use or environment, and can communicate that data; ’services’ include, for example, related services for connected products.
What does the representative have to do?
The Data Act requires that the designated representative be mandated to act as the addressee for authorities and to support compliance:
- Be addressable by authorities ’in addition to or instead of’ the non‑EU entity on all issues relating to that entity under the Data Act.
- Cooperate with authorities and (on request) demonstrate the measures that the entity has taken to comply with the Regulation.
- Respond to information requests: competent authorities may require users, data holders, data recipients, or their legal representatives under their competence to provide all information necessary to verify compliance; requests must be reasoned and proportionate.
Where should the representative be located, and who is the competent authority?
Placing the representative in a given Member State has jurisdictional effects: the non‑EU entity is considered to be under the competence of that Member State. Until a representative is designated, the entity is under the competence of all Member States for enforcement purposes (subject to safeguards against parallel action based on the same facts).
Does the representative assume liability?
Designating a representative does not affect the entity’s liability: the legal responsibility for Data Act compliance remains with the non‑EU entity. However, the representative must fulfil the cooperation and information‑provision duties set out in the Regulation. Member States may establish penalties for infringements, including failure to comply with these duties.
Sanctions and enforcement risk
The Data Act leaves penalty regimes to Member States, requiring them to set effective, proportionate and dissuasive penalties and notify the Commission by 12 September 2025. Practically, failing to appoint a representative by the applicable date can expand enforcement exposure, as any Member State may take action until a representative is appointed.
Practical checklist (for non‑EU businesses)
- Scoping: Confirm you “make available” any connected product in the EU or offer services covered by the Data Act (e.g., related services, data processing services).
- Select location: Choose an EU Member State for your representative (this will anchor administrative competence).
- Mandate in place: Put in place a mandate empowering the representative to be addressed by authorities, to cooperate, and to demonstrate your compliance measures.
- Information readiness: Establish document and data flows so that the representative can respond to proportionate, reasoned information requests.
- Deadline: Ensure the appointment and readiness by 12 September 2025.
Summary
If you are a non‑EU entity within the Data Act’s scope that engages with EU users through connected products or covered services, you must appoint an EU‑based legal representative. This representative is your regulatory interface, empowered to be addressed by authorities, obliged to cooperate and to show your compliance, while your entity remains legally responsible. Choose the representative’s location strategically, complete the mandate and compliance documentation, and prepare for enforcement from 12 September 2025.
Need assistance? Please reach out!
