What Non-EU Online Sellers Need to Sell Legally in the EU & UK

• EU/UK GDPR Article 27: appoint a local representative if selling to or tracking people in the EU/UK.
• GPSR: non-EU sellers of consumer products need an EU Responsible Person since 13 Dec 2024.
• Data Act, AI Act, Cosmetics: specific mandates for connected products, AI, or cosmetics.
• REP27 covers all major obligations with verifiable certificates.
• Fines for non-compliance can reach €20 million or 4% of turnover (Data Act).

Updated 27 October 2026 · 8 sources checked

Providers compared

Prices as published on each provider's website on 27 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: Article Numbers and Obligations

Non-EU online sellers must comply with several EU and UK laws before selling to consumers. The main obligations are:

• GDPR Article 27 (EU & UK): If you are a non-EU/UK company offering goods or services to individuals in the EU or UK, or monitoring their behavior (such as through website tracking), you must appoint a local representative. This representative acts as a contact point for data protection authorities and individuals. Exemptions are rare and only apply if processing is occasional, low-risk, and not large-scale.
• GPSR (Regulation (EU) 2023/988, Article 16): Since 13 December 2024, non-EU sellers must designate an EU-based Responsible Person before placing consumer products on the EU market. This person’s details must appear on product labels and listings. Without this, products risk being removed from marketplaces or seized at the border.
• Data Act (Article 37): Non-EU companies selling connected products or related services in the EU must appoint a legal representative. This is required for compliance with the new rules on data access and sharing. Penalties for non-compliance can reach €20 million or 4% of annual turnover.
• AI Act: Non-EU providers of AI-enabled services to EU clients must comply with the EU AI Act, which may require appointing an EU representative for certain high-risk or general-purpose AI systems.
• Cosmetics (Regulation (EC) 1223/2009): Any non-EU company selling cosmetics or perfumes in the EU must appoint a Responsible Person established in the EU. This person is responsible for safety, compliance, and notification requirements.

Failure to comply with these laws can result in severe penalties, including fines, product delisting, or customs seizures. The requirements apply regardless of company size or sales volume if you are targeting EU/UK consumers or processing their data.

How to Choose a Legal Representative or Responsible Person

Choosing the right provider is essential for compliance and business continuity. Consider these factors:

• Scope of services: Does the provider cover all obligations you face (GDPR, GPSR, AI Act, Data Act, cosmetics)? Some, like REP27, offer a comprehensive suite, while others focus on one area.
• Verification and acceptance: Authorities and marketplaces (Amazon, eBay, Etsy) increasingly require certificates that can be publicly verified. Ensure your provider issues a certificate with a verification code or public lookup.
• Speed of appointment: Time to issuance can be critical if you need to launch or relist products quickly. REP27 typically signs within 24 working hours; eugpsr.eu activates in 1–5 days.
• Support and communication: Check if support is included and how responsive the provider is to authority or marketplace requests. Some providers charge extra for support or document handling.
• Coverage for multiple countries: One appointment is usually sufficient for the entire EU or UK, but check if your provider’s certificate is accepted across all required markets.

Here is a decision matrix to help you determine your needs:

Always confirm with the provider which obligations they cover and if their certificate is accepted by your chosen sales channels.

What the Price Really Includes: Provider Comparison

Published prices can vary widely, and what is included is not always clear. Here is a detailed comparison of what each provider offers, based on published data:

Some providers, like REP27, offer unlimited products per plan for product compliance, while others may charge per product or per audit. Always request a full price breakdown and clarify if support, document handling, or additional certificates are extra. Legal advice and court representation are not included by any provider listed here.

Hidden Costs and What Providers Usually Do Not Say

When comparing providers, it is important to look beyond the headline price. Many providers do not publish all possible fees or exclusions. Based on available data:

• Legal advice and court representation: Not included by REP27 or most competitors. Providers act as the legal contact and certificate issuer, but do not represent you in legal disputes or offer legal advice.
• Per-request or per-product fees: Some providers charge for additional products, audits, or store configurations. For example, Garay Quality charges for audits and marketplace checks, and EAS Project (not in the main table) charges for extra store configurations and product HS code assignments.
• Notice periods and liability limits: These are not stated in public data for most providers. Always request terms and conditions before appointing a provider, especially if you may need to change or cancel your representative.
• Support and document handling: Some providers may charge for document review, additional support requests, or expedited processing. REP27 includes 24-hour designation and public verification in the base price.

What providers usually do not say:

• Appointing a representative does not transfer your legal liability; you remain responsible for compliance.
• Some certificates may not be accepted by all marketplaces; always check with your sales channels.
• Changing providers may require advance notice and could disrupt your listings if not managed carefully.

Always ask for a full list of included services, extra fees, and terms before signing up.

How Appointment Works: Step by Step

The process to appoint a legal representative or Responsible Person is generally straightforward but varies by provider. Here is a typical step-by-step process, using REP27 as an example:

1. Identify your obligations: Use the provider’s free check or contact their support team to determine which laws apply to your business (GDPR, GPSR, AI Act, Data Act, cosmetics, etc.).
2. Submit your company details: Provide information about your business, what you sell, and your target markets. This may include company registration documents, product lists, and compliance documentation.
3. File review: A human reviews your submission for completeness and compliance. REP27 typically completes this within 24 working hours. If something is missing, you will be contacted for clarification.
4. Signature and certificate: The provider’s statutory body (e.g., Europe Services SE for REP27) signs the designation. You receive a signed letter, a certificate with a QR code, and a verification code.
5. Public verification: Anyone (authorities, marketplaces, customers) can verify your appointment online using the certificate or code.
6. Implementation: Update your privacy notice, product labels, and marketplace listings with the required contact details. Providers supply the exact wording to use.
7. Ongoing support: The provider receives and forwards requests from authorities or the public, and helps you maintain compliance.

Checklist for buyers:

1. Identify what you sell and where you sell it.
2. Check which obligations apply (GDPR, GPSR, etc.).
3. Compare providers for coverage, verification, and price.
4. Appoint a representative before listing or shipping products/services.
5. Update your documentation and listings.
6. Keep certificates and verification links accessible.

Risks, Fines, and What Happens If You Ignore These Rules

Non-compliance with EU and UK legal representative requirements can have severe consequences:

• Data Act: Fines up to €20 million or 4% of annual turnover for failing to appoint a legal representative or comply with data sharing obligations.
• GPSR: Product listings can be removed from Amazon, eBay, or other marketplaces. EU customs may seize goods at the border if the Responsible Person is missing from labels or documentation.
• GDPR: Authorities may impose fines, issue enforcement actions, or block your sales. The absence of a local representative is a common reason for enforcement against non-EU/UK companies.

Marketplaces increasingly enforce these requirements, often requiring a certificate or public verification before allowing listings. Authorities can contact your representative directly for compliance checks. If you cannot provide proof of appointment, you risk losing access to the EU/UK market and facing legal penalties.

Ignoring these rules can also damage your reputation and result in lost sales opportunities. Compliance is not optional if you target EU/UK consumers or process their data.

Three Realistic Scenarios: What Applies and How to Comply

• US SaaS provider selling to EU: Needs an EU GDPR Article 27 representative if processing personal data of EU individuals. If offering connected products or services, a Data Act legal representative may also be required. If providing AI-enabled services, check if the AI Act applies. The simplest compliant route is to appoint a provider like REP27 that covers all these obligations with verifiable certificates.
• Chinese Amazon seller shipping toys to EU: Must appoint a GPSR Responsible Person for products (since 13 December 2024), and a GDPR representative for customer data. If selling CE-marked goods (like toys), may also need a market surveillance contact. The Responsible Person’s details must be on the product label and Amazon listing. REP27 and several competitors offer these services, but ensure the certificate is accepted by Amazon and can be verified publicly.
• UK online shop selling skincare to EU: Needs an EU Responsible Person for cosmetics (Regulation (EC) 1223/2009), a GDPR Article 27 representative, and possibly a GPSR Responsible Person if selling non-cosmetic products. The Responsible Person’s details must be on the product packaging and in the CPNP notification. Appointing a single provider for all obligations simplifies compliance.

In each scenario, the key is to identify all applicable obligations and select a provider that can supply all required certificates, with public verification and marketplace acceptance.