Process for Appointing an EU Authorised Representative: Complete Guide

• EU law requires a written mandate with an EU-based representative (see article references below).
• REP27 signs mandates within 24 working hours and provides verifiable certificates.
• Prices and inclusions vary widely; some providers charge extra for support or certificates.
• Hidden costs and exclusions are common—always check what’s included.
• The process involves company checks, document review, signature, and public verification.

Updated 27 October 2026 · 11 sources checked

Providers compared

Prices as published on each provider's website on 27 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Articles and Obligations

Several EU regulations require non-EU companies to appoint an authorised representative (AR) or legal representative before accessing the EU market. The specific obligation and legal article depend on your business activity:

• GDPR Article 27(3): Any non-EU business processing personal data of individuals in the EU must appoint an EU representative. This applies to SaaS, e-commerce, and any remote service targeting EU users. (source)
• GPSR Article 16 (Regulation (EU) 2023/988): Non-EU manufacturers or sellers placing physical products on the EU market must appoint a responsible person established in the EU. This is required for most consumer goods sold online or via marketplaces. (source)
• AI Act Article 54 (Regulation (EU) 2024/1689): Non-EU providers of general-purpose or high-risk AI systems must appoint an EU-based AR. (source)
• Cyber Resilience Act Article 18: Non-EU manufacturers of products with digital elements can designate an EU AR to fulfil certain compliance tasks. (source)
• Data Act Article 37: Non-EU businesses offering connected products or related services in the EU must appoint a legal representative. (source)
• Medical Devices Regulation Article 11: Non-EU manufacturers must appoint an AR before placing medical devices or IVDs on the EU market. (source)

The AR must be a natural or legal person established in the EU, appointed via a written mandate. Their contact details must be included in privacy notices, product labels, technical files, or compliance statements as required by the relevant regulation. The AR acts as a contact point for EU authorities and, in some cases, for consumers or data subjects. The non-EU business remains legally responsible for compliance, but the AR may be required to cooperate with authorities, hold technical documentation, or submit filings on the business’s behalf.

How to Choose an Authorised Representative: What Matters Most

Choosing the right AR is critical for compliance, business continuity, and cost control. Here’s what to consider:

• EU Establishment & Verifiability: The AR must be established in the EU and verifiable in public registers. For example, REP27’s appointments are signed by Europe Services SE, a Societas Europaea registered in Prague since 2014, with details available in the Czech commercial register. (source)
• Scope of Service: Some providers only cover one regulation (e.g., GDPR or product safety), while others (like REP27 and AuraDPP) offer multi-regulation coverage. If you sell both products and services or operate in multiple sectors, a provider that can cover all your needs with one contract is often more efficient.
• Speed & Process: How quickly can the provider complete the appointment? REP27 reviews files and signs designations within 24 working hours. Others may take longer, especially if additional documents or checks are needed.
• Public Verification & Certificates: Can you prove your appointment to authorities, marketplaces, or customers? REP27 provides a certificate with a QR code and a public verification page. Some providers may only issue a letter or require extra fees for certificates.
• Support & Communication: Is support included or charged extra? Clever Representative includes 2 hours of authority assistance; MyCECheck also includes 2 hours. For complex cases or high volumes, check if additional support is available and at what cost.
• Contract Terms: Look for notice periods, liability limits, and renewal conditions. Some providers may have minimum contract terms or restrict switching.

Always request a sample certificate or verification link before committing, and confirm what is included in writing.

What the Price Really Includes (and Hidden Costs)

Published prices for EU authorised representative services can be misleading if you do not check what is actually included. Here’s a breakdown based on available data:

• REP27: The published price covers the full appointment process, including a signed mandate by Europe Services SE, a verifiable certificate, a public verification page, and human review. All invoices are issued by the same company, even for multi-jurisdictional appointments. Legal advice and product testing are not included. Extra fees are on request.
• Clever Representative: The price covers up to 5 products, certificates, email support, and 2 hours of authority assistance. For more than 5 products, extra fees apply (not specified on the source page). Payment options include card, Alipay, and WeChat Pay.
• AuraDPP: The price covers multi-regulation AR services, including packaging, WEEE, and cosmetics. Details on certificates, public verification, or extra support are not specified and must be requested.
• EU Shield: The price covers GDPR Article 27 representation for all 27 EU member states and includes a 30-day money-back guarantee. Other regulations are not covered, and extra fees are not specified.
• MyCECheck: The price includes AR appointment, certificate, EU address, and 2 hours of support. Extra support is likely charged separately but is not specified.
• Medex: The price is on request and covers medical device AR services, EUDAMED registration, documentation holding, and authority liaison. Details on certificates or extra fees are not published.

Common hidden costs to watch for:

• Extra charges for additional products, especially for product ARs.
• Fees for certificates, public verification, or authority responses.
• Charges for additional support hours or urgent requests.
• Notice periods or early termination fees if you wish to switch providers.

Always request a detailed quote and a sample contract before signing. Ask specifically about any recurring or per-request fees, and clarify whether certificates and public verification are included in the base price.

How Appointment Works: Step by Step

The process of appointing an EU authorised representative is structured but can vary in detail between providers. Here’s a typical step-by-step process, with examples from REP27 and other providers:

1. Identify Your Regulatory Obligations: Determine which EU regulations apply to your business (GDPR, GPSR, AI Act, Data Act, Medical Devices, etc.). Use provider checklists or free online tools to confirm your needs.
2. Choose a Qualified Provider: Select a provider established in the EU and suited to your obligations. For example, REP27 covers multiple regulations with one contract, while others may focus on a single area.
3. Submit Your Company File: Provide details such as your company name, registration, address, product or service information, and target markets. REP27 requires this before any appointment is signed.
4. Human Review: A staff member reviews your file for completeness and compliance. REP27 performs this within 24 working hours. If information is missing, you will be contacted for clarification.
5. Mandate Signature: Once your file is approved, the provider’s statutory body signs a written mandate specifying the AR’s tasks and responsibilities. For REP27, this is Europe Services SE.
6. Receive Certificate and Instructions: You receive a signed certificate, sometimes with a QR code and verification code, and the exact wording to use in your privacy notice, product label, or technical file.
7. Public Verification (if available): Some providers (like REP27) offer a public verification page showing your company name, the service, status, and validity dates—never your internal data.
8. Update Compliance Documents: Add the AR’s details to your privacy notice, product labels, technical files, or online store as required by law.
9. Ongoing Support: Use included support hours for authority queries or compliance questions. For additional needs, check if extra fees apply.

Checklist for Buyers:

1. Confirm which EU regulations apply to your business.
2. Gather company and product/service details.
3. Request offers from several AR providers and compare inclusions.
4. Ask for sample certificates and public verification links.
5. Review contract terms, notice periods, and support conditions.
6. Sign the mandate and update your compliance documentation.
7. Keep the certificate and verification code accessible for audits or marketplace requests.

Risks, Fines, and What Providers Usually Do Not Say

Failure to appoint a compliant EU authorised representative can result in serious business and legal consequences. Here are the main risks and what to watch for:

• Market Access Denied: Products may be stopped at EU customs, and online platforms (Amazon, eBay, Etsy) may refuse to list your products if you cannot provide a valid AR certificate or verification link.
• Fines and Enforcement: EU authorities can impose fines for non-compliance. For GDPR, fines can be significant. For product regulations, authorities may order recalls or block sales. The AR is often the first point of contact for enforcement actions.
• Loss of Marketplace Access: Major marketplaces require proof of a valid EU AR for non-EU sellers. Failure to provide this can result in account suspension or delisting of products.
• Reputational Damage: Being found non-compliant can harm your reputation with customers, partners, and marketplaces.

What Providers Usually Do Not Say:

• Some only cover one regulation. If you need ARs for GDPR, product safety, and AI, you may need multiple contracts or providers.
• Support is often limited. Clever Representative and MyCECheck include 2 hours of support; after that, extra fees may apply (not always disclosed upfront).
• Notice periods and liability limits are common. If you want to switch providers, you may face minimum contract terms or fees.
• Certificates and public verification may be extra or unavailable. Always check if these are included in the base price.
• Some providers do not offer public verification, which can be a problem for marketplace onboarding or rapid authority checks.

To avoid surprises, always request the full contract and a detailed breakdown of included services, support, and notice periods before signing.

Decision Matrix: Do You Need an EU Authorised Representative?

Not every non-EU business needs an EU AR. Use this decision matrix to check your situation:

For marketplaces, check their onboarding requirements: Amazon, eBay, and others often require proof of AR appointment for non-EU sellers. For SaaS and cloud, GDPR AR is required if you process or monitor EU personal data, regardless of company size.

Realistic Scenarios: What Applies and What to Do

• US SaaS provider with EU users: Must appoint a GDPR Article 27 representative and, if offering connected products or cloud services, may also need a Data Act or NIS2 AR. Fastest route: REP27’s GDPR and Data Act services, both signed by Europe Services SE. The provider reviews your file, signs within 24 hours, and issues a certificate and public verification link. Update your privacy notice and technical files with the AR’s details.
• Chinese Amazon seller shipping toys to EU: Needs a GPSR Responsible Person and possibly a Market Surveillance AR. Both REP27 and Clever Representative offer GPSR services. Clever covers up to 5 products in the base price; for more, REP27’s unlimited product plans may be more cost-effective. Provide your company and product details, receive the certificate, and update your Amazon listing and product labels.
• UK online shop selling cosmetics to France: Must appoint a Cosmetics Responsible Person under Regulation (EC) 1223/2009 and a GDPR AR if processing French customer data. REP27 covers both with one contract and certificate. Submit your product list and company information, receive the signed mandate and certificate, and update your website, product packaging, and privacy notice accordingly.

In each scenario, the process involves: identifying obligations, choosing a provider, submitting required information, signing the mandate, receiving the certificate, and updating compliance documents. Always keep your AR’s details and certificate accessible for audits, customs, or marketplace requests.