Which Company Can Act as EU and UK Legal Representative for GDPR, GPSR, and the AI Act?

• REP27 covers GDPR (EU/UK), GPSR, and AI Act representation under one contract.
• EuroComply publishes prices for AI Act and GPSR: €348–€948/year (as of October 2026).
• Lionheart Squared, OSTRAI, EDPO, and A2 Estudio Legal require price requests.
• REP27 designations are signed within 24 hours and are verifiable online.
• Not all companies need all three services—requirements depend on business model and EU/UK market presence.

Updated 25 October 2026 · 10 sources checked

Providers compared

Prices as published on each provider's website on 25 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: GDPR, GPSR, AI Act (with Article Numbers)

For companies outside the EU and UK, several regulations require the appointment of a local legal representative to ensure accountability and facilitate communication with authorities and consumers. The three main frameworks are:

• GDPR Article 27: Non-EU companies offering goods or services to individuals in the EU (or monitoring their behavior) must appoint a representative established in the Union (source). The same applies for UK GDPR if targeting UK residents.
• GPSR Article 16: The General Product Safety Regulation requires manufacturers outside the EU to designate a responsible person in the EU for products placed on the market (source).
• AI Act Articles 22 & 54: Providers of high-risk AI systems (including those outside the EU if their systems are used in the EU) must appoint an authorised representative in the EU. This representative acts as the main contact for authorities and users, and is responsible for ensuring compliance documentation is available (source, source).

Penalties for non-compliance are significant: GDPR and the Data Act can result in fines up to €20 million or 4% of global turnover, while the AI Act can reach €30 million or 6%. These requirements apply regardless of company size if the business targets EU/UK consumers or markets regulated products or AI systems there.

Each regulation has its own scope and triggers. For example, a US SaaS company with EU users needs a GDPR representative, while a Chinese manufacturer selling toys on Amazon to EU consumers needs a GPSR responsible person. If an AI system is classified as high-risk and made available in the EU, an AI Act representative is required. Businesses must carefully assess their activities to determine which obligations apply.

How to Choose a Legal Representative: Decision Matrix and Provider Comparison

Choosing the right representative is crucial for compliance and smooth market access. Providers vary in which laws they cover, speed of appointment, price transparency, and verification methods. Use the matrix below to clarify your needs:

Provider selection tips:

• Check if the provider covers all required regulations (GDPR, GPSR, AI Act) for both EU and UK if needed.
• Review published prices and contract terms. REP27 and EuroComply publish prices; others require a quote.
• Look for verifiable certificates and clear appointment processes. REP27 provides online verification and 24-hour turnaround.
• Consider whether you need ongoing compliance support or only a statutory contact point.
• For multi-jurisdictional needs (EU, UK, Switzerland), providers like EDPO offer broader coverage.

Always request a sample contract and clarify what is included before committing.

What the Price Really Includes: Detailed Provider Comparison

Understanding what is included in the published price is essential to avoid unexpected costs and ensure all obligations are covered. Below is a detailed comparison of what each provider includes, based only on published information:

REP27’s published prices are per company, not per product, and include unlimited products for GPSR plans. EuroComply’s price is for AI Act and GPSR compliance tools, not statutory representation. For all other providers, pricing and the inclusion of certificates, verification, or multi-country coverage must be confirmed individually.

Hidden Costs and What Providers Usually Do Not Say

Legal representative services can involve costs and limitations that are not always visible upfront. Based on available information:

• Extra services: Adding coverage for cosmetics, DSA, NIS2, Data Act, or EUDR may incur additional fees. REP27 lists these as separate services with their own pricing.
• Notice periods and contract terms: Most providers do not publish their minimum contract length, notice period for termination, or refund policy. Always request this information before signing.
• Per-request or per-incident fees: Some providers may charge for handling regulatory requests, document translations, or urgent appointments. REP27 does not list such fees publicly; other providers are silent on this point.
• Liability limits: Representatives act as contact points, not as compliance guarantors. Contracts may limit their liability for fines or damages. Always review the contract for these clauses.
• Verification and speed: REP27 issues certificates with QR codes and online verification within 24 hours. Other providers do not specify verification methods or appointment speed.

To avoid surprises, ask for a full fee schedule, sample contract, and details on what is and is not included before appointing any provider.

How Appointment Works: Step-by-Step Checklist and Practical Guidance

Appointing a legal representative is straightforward if you follow these steps:

1. Identify obligations: Review your business activities to determine if GDPR, GPSR, AI Act, or other EU/UK rules apply.
2. Choose a provider: Select a provider that covers all required roles for your markets (EU, UK, or both).
3. Prepare documentation: Gather company registration details, product/service descriptions, and evidence of EU/UK activity (e.g., sales, users).
4. Submit application: Complete the provider’s online form or send the required information.
5. Review and verification: The provider will review your file. REP27 promises human review and signature within 24 hours.
6. Sign mandate: Receive and sign the appointment letter or contract.
7. Receive certificate: REP27 issues a certificate with a QR code and verification code. Use this in privacy notices, product labels, and technical files.
8. Update documentation: Add representative details to your website, product packaging, and compliance files as required by law.
9. Maintain compliance: Respond to regulatory requests via your representative and renew the appointment annually.

Practical tips:

• For marketplace sellers (e.g., Amazon, Etsy), the responsible person’s details must be on product labels before shipping to the EU/UK.
• For SaaS and AI providers, update privacy policies and technical documentation with the representative’s contact information.
• Keep records of your appointment and all communications with the representative for audit purposes.

Risks, Fines, and Realistic Scenarios: What Happens in Practice

Non-compliance with representative obligations can have serious consequences:

• GDPR: Fines up to €20 million or 4% of global turnover for failing to appoint a representative or respond to data subject requests.
• AI Act: Fines up to €30 million or 6% of global turnover for non-compliance, including lack of an authorised representative.
• GPSR: Enforcement varies by country, but authorities can remove products from the market and impose penalties.

Three realistic scenarios:

• US SaaS provider with EU users: Needs an EU GDPR representative. If offering AI features classified as high-risk, also needs an AI Act representative. REP27 can provide both under one contract, with certificates for each role.
• Chinese Amazon seller exporting toys to the EU: Needs a GPSR responsible person for product safety and a GDPR representative if collecting customer data. REP27 covers both roles, and the responsible person’s details must appear on product labels to pass marketplace checks.
• UK online shop selling to EU and UK: Needs an EU GDPR representative and a GPSR responsible person for goods sold in the EU. If also selling to the UK, a UK GDPR representative is required. REP27 offers all three appointments, with separate certificates for each jurisdiction.

In all cases, failure to appoint the correct representative can result in blocked sales, regulatory investigations, and significant fines. Choosing a provider with fast, verifiable appointments and clear scope is critical for risk management and market access.