One EU representative for all digital laws: GDPR, DSA, NIS2, AI Act, CRA and Data Act
A software, cloud or platform company outside the EU meets six EU laws that each ask for a representative or an entity in the EU. Each law has its own article, its own supervisor and its own register. One Dutch company (BV) can be the representative under every law at once, with one address, one register entry and your own staff as the contact point.
Ask about your situationSix laws, six representative duties. The General Data Protection Regulation (GDPR) asks for a representative in the EU since 25 May 2018 (Article 27). The Digital Services Act (DSA) asks every intermediary service provider outside the EU for a legal representative since 17 February 2024 (Article 13), and that representative can be held liable. The network and information security directive (NIS2) asks cloud, data centre, DNS, managed service and platform providers outside the EU for a representative (Article 26); in the Netherlands this is the Cyberbeveiligingswet, in force since 15 August 2026, with registration at the National Cyber Security Centre. The AI Act asks providers of general-purpose AI models for an authorised representative since 2 August 2025 and providers of high-risk systems from 2 December 2027 (Articles 54 and 22). The Data Act asks every company outside the EU that offers connected products or data services in the EU for a legal representative since 12 September 2025 (Article 37). The Cyber Resilience Act (CRA) makes an authorised representative optional (Article 18); its reporting duties apply since 11 September 2026 and the full rules from 11 December 2027.
Your own Dutch company can be the representative under all six laws. It is established in the EU, it has an address in the Netherlands, it registers in its own name and your own staff answer the supervisors. A rented representative is a separate contract per law, with a separate address and a separate mandate. We set up the company and arrange its registrations, bookkeeping and payroll. Where a law or a supervisor wants an independent party, a specialist partner takes that role, at a price you see first.
Tell us what you make or sell, where your company is and what you plan in Europe. Our team looks at it and replies with the steps and the dates that apply to you.
Who does what
We set up and manage the Dutch company. Specialist partners do the licence and product work. We are your only contact, with one file for all the work.
Your company
- Own the service, the data, the models and the technical documentation
- Decide which laws apply to which products and services, with the compliance partner
- Sign the mandates and the power of attorney, and name the people who answer the supervisors
- Keep the incident process and the documentation current
The Dutch company
- Set up the Dutch company (a BV), by power of attorney, with the notary
- KVK number, tax number and VAT number
- Bank account, bookkeeping, VAT returns, annual accounts and corporate tax
- Payroll for your European staff and the expat scheme applications
- One contact for the privacy, AI and cybersecurity partners
Licences and product rules
- Privacy lawyer: the GDPR mandate, the privacy notice and the data processing agreements; data protection officer where you want one outside your company
- DSA specialist: the notification to the ACM, the points of contact and the transparency reports
- Cybersecurity partner: the NIS2 registration at the NCSC, the incident reporting process, the CRA technical documentation
- AI compliance specialist: classification of your systems, the technical documentation and the EU database entry
Step by step
From your first question to one company with every register entry in place.
- Your question. You describe your services, your products and your customers in the EU. You get a written answer with the laws that apply and a suitable structure.
- The Dutch company. The notary sets up the BV by power of attorney, with your parent company as shareholder. You receive the KVK number, the tax number and the VAT number. We prepare the bank application.
- The mandates. Your Dutch company receives the written mandates under the GDPR, the DSA, the AI Act and the Data Act. The privacy lawyer and the AI specialist draft them.
- The registrations. The DSA notification goes to the ACM, the NIS2 registration to the NCSC, the AI Act entry to the EU database where required. Your privacy notice names the representative.
- The contact point. Your staff on the Dutch payroll, or your team abroad with the Dutch company as address, answer the supervisors within the deadlines of each law.
- Operations. Your Dutch company invoices your European customers. The bookkeeping, VAT and payroll are done for you. You have one contact person.
The six laws, who must appoint, since when, and which Dutch authority
| Law | Who must appoint | Since when | What the representative does | Liability | Dutch authority |
|---|---|---|---|---|---|
| GDPR, Regulation (EU) 2016/679, Article 27 | A controller or processor outside the EU that offers goods or services to people in the EU or monitors their behaviour. Exceptions: occasional, low-risk processing free of large-scale special categories of data; public authorities. | 25 May 2018 | Is addressed by supervisory authorities and by people in the EU, next to or in place of the company, on all issues of processing. Established in a member state where those people are. Appointed in writing. | The company itself stays liable (Article 27(5)). The representative is subject to enforcement when the company fails to comply (recital 80). | Autoriteit Persoonsgegevens (Dutch Data Protection Authority) |
| Digital Services Act, Regulation (EU) 2022/2065, Article 13 | Every provider of intermediary services (hosting, marketplaces, platforms, search engines, networks) outside the EU that offers services in the EU. | 17 February 2024 | Is addressed by national authorities, the Commission and the Board on all decisions under the Act, with the powers and resources to comply with those decisions. Established in a member state where the service is offered. Its contact details are notified to the Digital Services Coordinator and published. | The representative can be held liable for breaches of the Act, next to the provider (Article 13(3)). | Autoriteit Consument & Markt (ACM) as Digital Services Coordinator; the Autoriteit Persoonsgegevens for two provisions on personal data |
| NIS2, Directive (EU) 2022/2555, Article 26(3); in the Netherlands the Cyberbeveiligingswet | DNS service providers, top-level domain registries, domain registration services, cloud, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, search engines and social networks outside the EU that offer services in the EU. | Cyberbeveiligingswet in force 15 August 2026; registration mandatory from that date | Is the entity’s representative in a member state where the services are offered; the entity then falls under the jurisdiction of that member state. Its address and contact details go into the register of entities (Article 27). Incidents are reported to the CSIRT and the competent authority. | Legal action against the entity itself stays possible (Article 26(4)). Free of a representative, every member state where the service is provided can act against the entity. | National Cyber Security Centre (NCSC) for the register and the reports; the Rijksinspectie Digitale Infrastructuur (RDI) supervises digital infrastructure and digital providers |
| AI Act, Regulation (EU) 2024/1689 as amended by (EU) 2026/1744, Articles 22 and 54 | Providers in third countries of general-purpose AI models (Article 54) and of high-risk AI systems (Article 22), before placing them on the EU market. | Models: 2 August 2025; fines for model providers by the AI Office: 2 August 2026. High-risk systems in Annex III: 2 December 2027. AI in regulated products (Annex I): 2 August 2028. | Verifies that the technical documentation and the declaration of conformity exist, keeps them for ten years, cooperates with the AI Office and national authorities, registers the system where required. Appointed by written mandate. | The representative must end the mandate and inform the authority when it considers the provider in breach (Article 22(4)). Fines apply to representatives as well (Article 99(4)). | Autoriteit Persoonsgegevens and RDI coordinate the supervision, with sector supervisors; the Dutch law is pending |
| Cyber Resilience Act, Regulation (EU) 2024/2847, Article 18 | Optional: a manufacturer may appoint an authorised representative by written mandate. The importer in the EU has its own duties. | In force 10 December 2024. Reporting of exploited vulnerabilities and severe incidents: 11 September 2026. Full application: 11 December 2027. | Keeps the EU declaration of conformity and the technical documentation for at least ten years, gives them to the market surveillance authorities on request and cooperates on risk measures. | The manufacturer keeps the main duties, wherever it is established. | The market surveillance authority for the product |
| Data Act, Regulation (EU) 2023/2854, Article 37(11) | Every entity in scope that makes connected products available or offers services in the EU and is established outside the EU. | 12 September 2025. Switching charges for cloud and data processing services end on 12 January 2027 (Article 29). | Is addressed by the competent authorities next to or in place of the entity, and demonstrates on request what the entity does to comply. The entity falls under the competence of the member state of the representative. | The liability of the entity itself stays in place (Article 37(13)). Until a representative is appointed, every member state is competent. | Autoriteit Consument & Markt (ACM) as data coordinator |
The dates for high-risk AI systems come from Regulation (EU) 2026/1744, in force since 27 July 2026. See the AI Act representative for the full timetable and the product deadlines of 2027 for the Cyber Resilience Act and the Machinery Regulation.
Why one own company, and where a partner takes the role
One address for all. Each law wants a representative established in a member state where you offer your service. The Netherlands is one such state for a service offered EU-wide. Your Dutch company has one address, one Chamber of Commerce number and one set of contact details that go into the GDPR privacy notice, the DSA notification to the ACM, the NIS2 register at the NCSC, the AI Act documentation and the Data Act contacts.
Registrations in your own name. The NIS2 register asks for the name of the entity, its sector, the address of its representative, its contact details, the member states where it provides services and its IP ranges. Your own company files these and keeps them current. The same company signs the DSA notification and the AI Act mandate.
A contact point with your own staff. Supervisors send orders and questions to the representative, with deadlines. Under NIS2 an early warning of a significant incident is due within 24 hours. A rented representative forwards; your own company answers, with your engineers and your legal team on the Dutch payroll or on call. Under the DSA the representative can be held liable, so you want that risk inside your own group, with your own people.
A contracting entity at the same time. European customers sign the contract, the data processing agreement and the invoice with the same Dutch company. See setting up a subsidiary in Europe.
Where a partner takes the role. The European Data Protection Board considers the GDPR representative role incompatible with the role of external data protection officer or of processor for the same company; a specialist partner takes one of those roles. A compliance partner reviews the AI Act technical documentation and the DSA transparency reports. Partner work has its own price, which you see first.
Tell us what you make or sell, where your company is and what you plan in Europe. Our team looks at it and replies with the steps and the dates that apply to you.
One Dutch company, many roles
One company is the GDPR representative, the DSA legal representative, the NIS2 representative with the register entry, the AI Act authorised representative, the Data Act legal representative and, if you choose, the CRA authorised representative and importer. It is also the company that invoices your European customers and employs your European staff.
The company is yours. You choose the address, you appoint the directors and you own the shares. We provide the formation, the registrations and the administration. See which EU representative your products need for the product laws and a Dutch entity for payments and fintech for licensed services.
Prices: your Dutch company (BV) from €2,950 excl. VAT, and a holding with an operating company from €4,950 excl. VAT. Partner work has its own price, which you see first. See company formation in the Netherlands.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 27 and 99 and recital 80, EUR-Lex (2016); European Data Protection Board, Guidelines 3/2018 on territorial scope, version 2.0 (12 November 2019).
- Regulation (EU) 2022/2065 (Digital Services Act), Article 13 and recital 44, EUR-Lex (2022); European Commission, questions and answers on the DSA: application 17 February 2024; ACM, intermediary services (2 July 2026); explanatory memorandum to the Dutch DSA implementation act, Kamerstuk 36531, nr. 3: ACM as Digital Services Coordinator.
- Directive (EU) 2022/2555 (NIS2), Articles 26 and 27 and recital 116, EUR-Lex (2022); Government of the Netherlands, Cyberbeveiligingswet in force (15 August 2026); NCSC, information brochure on the Cyberbeveiligingswet: the 18 sectors and the supervisors; explanatory memorandum, Kamerstuk 36764, nr. 3: Article 42 on the representative.
- Regulation (EU) 2024/1689 (AI Act), consolidated text of 27 July 2026, Articles 22, 54, 99 and 113, EUR-Lex; European Commission, AI Act Service Desk, Article 22 and the AI Act timeline (2026).
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 14, 18 and 71, EUR-Lex (2024); European Commission, CRA reporting obligations and the Cyber Resilience Act (2026).
- Regulation (EU) 2023/2854 (Data Act), Articles 29, 37 and 50, EUR-Lex (2023); European Commission, Data Act: applies since 12 September 2025; ACM, cloud services (14 August 2026): switching charges end 12 January 2027.
Last reviewed: 27 October 2026. Based on the laws named in the table, as they apply in October 2026. Compliance documentation is prepared by specialised partners; we coordinate.
Common questions
Ask about your own situation
Tell us what you offer, who your users in the EU are and where your company is. You receive advice on the laws that apply and the structure that suits you.
Related guides
More guides about selling in Europe.