Software, AI and platforms, one EU representative company of your own
A software, AI or platform company outside the EU that serves users in Europe must name a representative in the EU under several laws at once, the Digital Services Act, the General Data Protection Regulation, the NIS2 directive, the Data Act, the AI Act and, for connected products, the Cyber Resilience Act. Under the Digital Services Act the representative itself can be held liable, and from 9 December 2026 the EU importer or representative of software is liable for a defective product with its maker. One Dutch company can hold every one of these roles, or go one step further and become your EU establishment that signs the contracts with European customers. We set it up and do its administration, and privacy, security and AI specialists from our network do the specialist work.
Ask about your situationYour own Dutch company is named in writing as your legal representative under the Digital Services Act, the GDPR, NIS2 and the Data Act, as your authorised representative under the AI Act for general-purpose models and later for high-risk systems, and as your authorised representative or importer under the Cyber Resilience Act. It is the address for the Dutch supervisors, the Authority for Consumers and Markets (ACM), the Data Protection Authority (AP), the National Cyber Security Centre (NCSC) and the AI supervisors, and it keeps the documentation the laws require.
A representative under the Digital Services Act can be held liable for your non-compliance, in addition to you (Article 13, paragraph 3). A representative under the AI Act has its own duties and its own fines. A service company that takes these roles for a fee asks for resources, indemnities and insurance, and keeps the right to end the mandate. A company inside your group keeps the risk and the records where you control them.
We set up the company, request its registrations, keep its books and file its returns and annual accounts, and keep the calendar of notifications and renewals. Privacy, security and AI specialists from our network draft the mandates and the documentation. You appoint the directors and see every price first.
Tell us what you make or sell, where your company is and what you plan in Europe. Our team looks at it and replies with the steps and the dates that apply to you.
Who does what
You own the product, the code and the data, your Dutch company holds the representative roles or becomes your EU establishment, and partners do the privacy, security and AI documentation.
Your company
- The product, the models, the code, the data and the security measures
- The decisions on where the European operation is run and by whom
- The directors of the Dutch company and its business address
The Dutch company
- The Dutch BV with the mandates, by power of attorney
- KVK, VAT, eHerkenning, the registrations at the ACM and the NCSC, and the bank file
- Bookkeeping, VAT and one-stop-shop returns, annual accounts and the calendar of notifications and renewals
Privacy, security, AI documentation
- Privacy lawyer for the GDPR mandate, the record of processing and the data protection officer
- Security specialist for the NIS2 registration and the Cyber Resilience Act reports
- AI compliance specialist for the technical documentation and the conformity assessment
Step by step
From a company that names a service representative to a company with its own EU representative company.
- Your services and your users. You describe the services, the data, the models and the EU countries, and we send a written proposal with the roles, the route and the partners.
- The company. The notary sets up the Dutch BV by power of attorney, and we request the registrations.
- The mandates. Our partners draft the written mandates under each law, and your group signs them with the Dutch company.
- The notifications. The company notifies the ACM as DSA representative, registers at the NCSC where NIS2 applies and publishes its contact details.
- The records. The company keeps the record of processing, the technical documentation and the contact points, and your legal team keeps them current.
- Every year. We keep the books, file the annual accounts and keep the calendar of notifications and renewals with you.
The representative roles, in one table
Each law has its own representative, and each mandate is a separate written document. One Dutch company can hold them all.
| Law | Who must name a representative | Where | Since | Is the representative itself liable |
|---|---|---|---|---|
| Digital Services Act, Regulation (EU) 2022/2065, Article 13 | Providers of intermediary services outside the EU, hosting, cloud, online platforms, marketplaces, app stores and search engines | A member state where the service is offered; notified to the ACM in the Netherlands | 17 February 2024 | Yes, it can be held liable for your non-compliance, in addition to you |
| GDPR, Regulation (EU) 2016/679, Article 27 | Controllers and processors outside the EU that offer goods or services to people in the EU or monitor their behaviour, unless the processing is occasional and low-risk | A member state where the people whose data you process are | 25 May 2018 | Only for its own duties, the record of processing and cooperation with the authority |
| NIS2, Directive (EU) 2022/2555, Article 26(3), and the Dutch Cybersecurity Act, Article 42 | Providers outside the EU of DNS, cloud, data centre, content delivery, managed services, marketplaces, search engines and social networks | A member state where the service is offered, which then has jurisdiction; registration at mijn.ncsc.nl | 15 August 2026 in the Netherlands | The directive is silent on it |
| Data Act, Regulation (EU) 2023/2854, Article 37(11) | Data holders and providers of data processing services outside the EU that offer connected products or services in the EU | Any member state, which then has competence | 12 September 2025 | It must cooperate and demonstrate your compliance; the law places the penalties on you |
| AI Act, Regulation (EU) 2024/1689, Article 54 | Providers outside the EU of general-purpose AI models, except free and open-source models that are free of systemic risk | The EU; the AI Office is the counterpart | 2 August 2025 | Yes, it has its own duties and must end the mandate when you breach yours |
| AI Act, Article 22 | Providers outside the EU of high-risk AI systems | The EU; the Dutch market surveillance authorities once the Dutch implementing act is in force | 2 December 2027 for Annex III systems, 2 August 2028 for AI in regulated products | Yes, with its own duties and fines |
| Cyber Resilience Act, Regulation (EU) 2024/2847, Articles 18 and 19 | Makers of hardware and software with digital elements may appoint a representative; the importer is responsible in any case | The EU; the member state of the representative decides which computer security incident response team coordinates your reports | Reporting since 11 September 2026, full application 11 December 2027 | The representative for its own tasks, the importer for the importer duties |
| Product liability, Directive (EU) 2024/2853, Articles 4 and 8 | Software counts as a product; for a maker outside the EU the importer and the authorised representative are liable with the maker | The EU | Products placed on the market after 9 December 2026 | Yes, jointly and severally with you, unlimited |
The rules per law are on our pages EU digital representative and AI Act authorised representative.
Representative or establishment
Naming a representative under the Digital Services Act leaves you outside the EU as a matter of establishment (Article 13, paragraph 5). Your company stays a company outside the EU that the authorities reach through its representative, and every member state where you offer the service can act against you. A Dutch company that itself provides the service in Europe, signs the contracts with European customers and takes the decisions about the European operation is an establishment, and the supervisors of the Netherlands then become your main counterparts under the Digital Services Act, the GDPR and NIS2.
Many software companies with a turnover of EUR 10 to 500 million choose the second route once Europe is a core market. The Dutch company invoices the European customers, employs the European sales and support staff, and holds the representative roles for the parts of the group that stay outside the EU. Which route suits you depends on where the decisions are taken and where the data is processed, and we go through that with your privacy and security advisers before the deed.
Tell us what you make or sell, where your company is and what you plan in Europe. Our team looks at it and replies with the steps and the dates that apply to you.
What the representative does every month
The representative is the address of the authorities. It receives their requests, forwards them to you, answers within the deadlines in the language of the member state, and keeps the records the laws require, the record of processing under the GDPR, the technical documentation and the declaration of conformity under the AI Act and the Cyber Resilience Act, and the contact details that the Digital Services Act requires to be public. Under the AI Act it must end the mandate and inform the authority when it considers that you breach your obligations. Under the Cyber Resilience Act the maker reports exploited vulnerabilities within 24 hours for the early warning, 72 hours for the notification and 14 days for the final report, and the member state of the representative decides which response team coordinates those reports.
The data protection board has said that the GDPR representative is a different role from the data protection officer, so your Dutch company holds the representative role and an external data protection officer comes from our partners when you need one. The registration of the company as NIS2 entity at mijn.ncsc.nl, the notification of the DSA representative to the ACM and the publication of its details on your website are done once and kept up to date.
A service representative or your own company
| A service representative | Your own Dutch company | |
|---|---|---|
| Who is liable under the Digital Services Act and the AI Act | The service company, which asks for resources, indemnities and insurance | Your Dutch company, with your group behind it |
| Can it become your EU establishment | A representative stays a representative | Yes, when it signs the contracts and takes the decisions in Europe |
| Who keeps the mandates, the registrations and the records | The service company, within its mandates | Your company, with our administration and the specialists you contract |
| Suits | A few EU users, one law, a market test | Steady EU revenue, several representative roles and an EU establishment in view |
The whole set-up is on the page your own EU company with a partner that stays.
Why a partner that stays
A representative company is as good as its records and its response times. A request from the ACM or the AP that waits, a mandate that ends with a departing provider, or a registration at the NCSC that is out of date is a finding against your company. We keep the books, file the annual accounts, maintain the registrations and keep the calendar of notifications and renewals, with a reminder to your board when a date comes up. The privacy, security and AI specialists from our network draft the mandates, the record of processing and the technical documentation under their own contracts with your company, and your legal team keeps them current. Your board decides.
The dates for software and AI companies
| Date | What applies |
|---|---|
| 2 August 2025 | Authorised representative for providers of general-purpose AI models outside the EU (AI Act, Article 54) |
| 12 September 2025 | Legal representative under the Data Act for data holders and data processing services outside the EU (Article 37) |
| 2 August 2026 | Transparency duties of the AI Act (Article 50), with a grace period until 2 December 2026 for generative systems already on the market |
| 15 August 2026 | The Dutch Cybersecurity Act applies, with the representative duty (Article 42) and registration at the NCSC (Article 44) |
| 11 September 2026 | Makers report exploited vulnerabilities and severe incidents through the single reporting platform of ENISA (Cyber Resilience Act, Article 14) |
| 2 December 2026 | New prohibited AI practices apply (AI Act, Article 5, as amended by Regulation (EU) 2026/1744), and the grace period for the transparency duties ends |
| 9 December 2026 | Software counts as a product under the new product liability directive, and the importer and the representative are liable with the maker |
| 2 December 2027 | High-risk AI systems of Annex III, with the authorised representative of Article 22 |
| 11 December 2027 | The Cyber Resilience Act applies in full |
| 2 August 2028 | High-risk AI systems embedded in regulated products (Annex I) |
All dates per rule, with their sources, are in our EU compliance calendar.
Sources: Regulation (EU) 2022/2065, Article 13; ACM, DSA annual report 2025; Regulation (EU) 2016/679, Article 27 and EDPB Guidelines 3/2018; Dutch Data Protection Authority, fine of 12 May 2021; Directive (EU) 2022/2555, Article 26; Cybersecurity Act (Cyberbeveiligingswet), Bulletin of Acts 2026, 187, in force 15 August 2026, Government of the Netherlands, 7 July 2026; AI Act, Article 22 and Article 54, Regulation (EU) 2026/1744; Regulation (EU) 2024/2847, Article 18 and European Commission on CRA reporting; Regulation (EU) 2023/2854, Article 37; Directive (EU) 2024/2853, Articles 4 and 8. Checked on 29 October 2026.
Common questions
Ask about your own situation
Tell us what you make or sell, where your company is and which countries you want to sell in. Our team replies with advice.
Related guides
The digital rules, the AI Act and the set-up.