How to Verify and Choose a Real EU or UK Representative

• EU/UK law requires a local representative for many non-EU/UK businesses
• Verify the provider’s legal establishment and written mandate
• Check for public, verifiable certificates and clear documentation
• Compare what is included in the published price and ask about hidden fees
• Ensure the provider is accepted by authorities and marketplaces
• Understand which obligations apply to your business before appointing

Updated 27 October 2026 · 8 sources checked

Providers compared

Prices as published on each provider's website on 27 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article Numbers and Practical Impact

Several EU and UK laws require non-EU/UK companies to appoint a local representative. This obligation is not optional and applies in specific scenarios:

• GDPR Article 27: Any non-EU company processing personal data of EU residents (offering goods/services or monitoring behavior) must appoint an EU representative. The same applies for UK residents under UK GDPR. Exemptions are rare and only apply to occasional, low-risk processing not involving special categories of data or criminal records, and not to public authorities (source).
• GPSR (Regulation (EU) 2023/988): Requires a Responsible Person for consumer products. This person must be established in the EU and act as the contact for market surveillance authorities. Without this, products may be blocked at customs or removed from sale (source).
• MDR Article 11: Non-EU manufacturers of medical devices must appoint an EU Authorized Representative before placing devices on the EU market. The mandate must be written, specify the representative's tasks, and the representative must keep technical documentation and cooperate with authorities (source).

The representative must be established in the EU (or UK for UK rules), have a written mandate, and be publicly verifiable. For product rules, the representative’s details must appear on labels and technical files. For GDPR, the representative’s details must be in the privacy notice. Marketplaces and authorities will check these details and may reject or delist products or services if the requirements are not met.

Other regulations, such as the AI Act, NIS2, Data Act, and Cyber Resilience Act, also require a local representative or contact point for certain activities. The exact requirement depends on your business model, product type, and customer location. Always check which laws apply to your specific case before appointing a representative.

How to Choose a Real EU or UK Representative: Verification and Comparison

Choosing a genuine representative is critical for compliance and business continuity. Authorities and marketplaces will verify the provider’s credentials, so your choice must withstand scrutiny. Here’s how to make a safe, informed decision:

1. Verify legal establishment: Confirm the provider’s registration in a public EU/UK register. For example, REP27’s EU appointments are signed by Europe Services SE, a Societas Europaea registered in Prague since 2014, and UK appointments by REP27 LTD, registered in England and Wales. AuraDPP is based in Slovakia. If the provider’s address or company details are missing or unverifiable, do not proceed.
2. Check the written mandate: The mandate must specify the provider’s role, jurisdiction, and the regulations covered (GDPR, GPSR, MDR, etc.). It should be signed by the statutory body of the provider and by your company. Ask for a sample before committing.
3. Public certificate and verification: The provider should issue a certificate with a QR code or verification code, allowing anyone (authorities, marketplaces, customers) to check the appointment’s validity online. REP27 provides this for every appointment; AuraDPP states acceptance by all major EU marketplaces. If a provider cannot offer public verification, their certificate may not be accepted.
4. Marketplace acceptance: Check if the provider is recognized by Amazon, Etsy, eBay, Shopify, Zalando, and others. AuraDPP specifically lists acceptance by these marketplaces. REP27 clients use certificates for marketplace onboarding and compliance checks.
5. Compare included services: Not all providers cover every regulation. Some only cover product rules; others also cover GDPR, AI Act, or cosmetics. Use the table below to compare what is included, what is not, and any extra fees.

Always request documentation before paying, and confirm acceptance with your marketplace or regulator if in doubt.

What the Price Really Includes and Hidden Costs: Practical Comparison

Published prices for EU/UK representative services can be misleading if you do not check the details. Here’s what to look for:

• Scope of appointment: Does the price cover all the regulations you need? Some providers only cover one (e.g., MDR or GPSR), while others (like REP27) offer multiple appointments under one contract. If you need both GDPR and GPSR, confirm both are included.
• Certificate and public verification: Is a verifiable certificate included, or is it an extra charge? REP27 includes this as standard. AuraDPP states acceptance by major marketplaces, implying their documentation is recognized.
• Per-product or per-company pricing: Conformity Point charges per product, with a higher first-year fee and lower renewal. This can add up quickly for sellers with large catalogs. EU UK Compliance offers a low monthly rate but does not specify if this covers multiple products or only one.
• Renewal and update fees: Some providers charge for annual renewals, updates to documentation, or technical file reviews. Always ask for a full price list and clarify what triggers extra costs.
• Hidden costs: These may include urgent signing, additional product categories, or per-request handling. For example, REP27 does not list extra fees publicly—ask for a quote if you have complex needs.

Comparison Table:

Always ask for a detailed quote and clarify what is included before you commit.

How Appointment Works: Step-by-Step Process and Checklist

Appointing a representative is a regulated process. Here’s how it works in practice, using REP27 as a model (steps may be similar for other providers):

1. Identify obligations: Use a free check or consult the provider to determine which laws apply (GDPR, GPSR, MDR, etc.). REP27 offers a free check and human review.
2. Collect company information: Prepare details about your business, products, and where you sell. This includes company registration, product types, and target markets.
3. Submit your file: Send your information to the provider via their online form or by email. REP27 reviews each file within 24 working hours.
4. Human review: A real person checks your file for completeness and compliance. If anything is missing or unclear, you will be contacted for clarification.
5. Mandate signed: Once approved, the provider’s statutory body signs the written mandate. You also sign, formalizing the appointment.
6. Receive certificate: You receive a signed certificate, a QR code or verification code, and the exact text to use in your privacy notice or on product labels. REP27 provides a public verification page for each appointment.
7. Update documentation: Add the representative’s details to your privacy notice, product labels, or technical files as required by law.
8. Verification by third parties: Authorities, marketplaces, and customers can verify your appointment online using the certificate or code.

Buyer Checklist:

1. Check which EU/UK laws apply to your business.
2. Confirm you do not already have an EU/UK establishment acting as importer or data controller.
3. Research providers and verify their legal establishment and public registration.
4. Request a sample mandate and certificate for review.
5. Clarify exactly what is included in the price and any extra fees.
6. Sign the mandate and update your compliance documentation.
7. Test the public verification process before going live.

Following these steps ensures you are compliant, reduces the risk of market disruption, and provides proof to authorities and marketplaces.

Risks, Fines, and What Providers Usually Do Not Say

Not appointing a required EU or UK representative exposes your business to significant risks:

• Regulatory fines: For GDPR, fines can reach millions of euros. For product rules, authorities can block imports, remove listings from marketplaces, or require product recalls.
• Marketplace removal: Amazon, Etsy, eBay, Shopify, and others routinely delist non-compliant sellers. Lack of a valid representative is a common reason for account suspension or product removal.
• Import bans: Customs and market surveillance authorities may block shipments at the border if the required Responsible Person or Authorized Representative is missing from documentation or labels.

What providers usually do not say:

• Notice periods: Contracts may require notice before termination or changes. If you switch providers, you must update all documentation and inform authorities/marketplaces.
• Per-request or per-product fees: Some providers charge for each product, each request, or for document updates. Always clarify this in advance.
• Limits of liability: The representative does not assume your compliance obligations. You remain responsible for meeting all legal requirements. Most providers do not offer legal advice or court representation.
• Exclusions: Services like legal advice, regulatory defense, or technical consulting are usually not included unless specifically stated.

Always read the contract carefully and ask for clarification on these points before signing. If a provider cannot answer these questions, consider another option.

Decision Matrix: Who Needs an EU/UK Representative?

Use this matrix to determine if you need a representative and which type:

Examples:

• A US SaaS company with EU users: needs an EU GDPR Article 27 representative.
• A Chinese Amazon seller shipping toys to the EU: needs a GPSR Responsible Person and possibly an EU Authorized Representative.
• A UK online shop selling cosmetics to the EU: needs both an EU Responsible Person for cosmetics and an EU GDPR representative.

Always check the specific regulation for your product or service. If unsure, use a provider’s free check or consult a compliance expert.

Realistic Scenarios: Practical Guidance for Different Businesses

1. US SaaS company with EU users: Under GDPR Article 27, this company must appoint an EU representative. The simplest route is to use a provider like REP27, submit company details, receive a signed mandate and certificate, and update the privacy notice. No product rules apply unless the company also sells physical goods.
2. Chinese Amazon seller shipping toys to EU: This seller must appoint a GPSR Responsible Person and, for certain products, an EU Authorized Representative. The provider must be accepted by Amazon and issue a certificate. AuraDPP specifically states acceptance by all major EU marketplaces. The seller uploads the certificate to Amazon Seller Central and updates product packaging as required.
3. UK online shop selling cosmetics to EU: This business needs both an EU Responsible Person for cosmetics (under Regulation (EC) 1223/2009) and an EU GDPR representative. Providers like REP27 can cover both roles under one contract. The shop submits details, receives certificates, and updates product labels and privacy policies accordingly.

For each scenario, the process is:

1. Determine which laws apply (use provider’s free check if available).
2. Choose a provider covering all required roles.
3. Submit company and product details for review.
4. Sign the mandate and receive verifiable documentation.
5. Update all relevant documentation and submit proof to authorities or marketplaces as needed.

This approach minimizes compliance risk and ensures smooth market access.