An EU representative that can answer the regulator — not a letterbox.

Four EU regimes now require a firm with no establishment in the Union to appoint a representative inside it before it can publish ratings, place an AI system on the market, offer an intermediary service or process EU personal data. The representative is the regulator's point of contact and, under the ESG Rating Regulation and the Digital Services Act, carries exposure of its own. VieKey takes these mandates through the Luxembourg company — a legal person, as Article 12 of the ESG Rating Regulation requires — and runs them as a monitored compliance function: evidence held in Luxembourg, a review calendar, a single intake address for authority correspondence, and a written position on the principal's compliance that the representative is prepared to defend.

Who it is for

• ESG rating providers established outside the Union that need ESMA recognition under Article 12 of Regulation (EU) 2024/3005 because no equivalence decision covers their home country and the endorsement route is not available to them.
• Providers of high-risk AI systems, and of general-purpose AI models, established outside the Union, who must appoint an authorised representative under Articles 22 and 54 of Regulation (EU) 2024/1689 before placing the system or model on the EU market.
• Hosting providers, B2B platforms and marketplaces with no EU establishment that must designate a legal representative under Article 13 of Regulation (EU) 2022/2065 — accepted selectively; see client acceptance below.
• Controllers and processors outside the Union that need an Article 27 GDPR representative — offered as an add-on to one of the mandates above, not on its own.
• Counsel to any of these firms who needs a representative able to sign the adequacy and monitoring statements the application requires, rather than a forwarding address.

What you receive

• Mandate — written appointment under Luxembourg law with the authority, information rights, reporting duties, escalation and termination mechanics each regime requires, and a regime-specific annex.
• Adequacy assessment — for the ESG Rating Regulation, the representative's own assessment of the provider's organisational and transparency arrangements against Articles 15 to 27, with findings and a remediation plan, in the form ESMA's recognition file asks for; for the AI Act, verification that the EU declaration of conformity and the technical documentation exist and are complete before the system is placed on the market.
• Monitoring programme — quarterly or semi-annual review, event-driven triggers (changes, incidents, authority requests), and an annual written statement to the principal on the state of compliance.
• Evidence repository in Luxembourg — the documents an authority may request, held for the statutory period (ten years under the AI Act), with an access log and a handover protocol at the end of the mandate.
• Authority liaison — acknowledgement of supervisory correspondence within one working day; coordination of the principal's response within the authority's deadline; a log of every interaction.

How it runs

Indicatively four to eight weeks from scoping to a signed mandate; longer where the ESMA recognition file is prepared in parallel.

1. Scoping call. Regime, home jurisdiction, what is placed on the EU market, supervisory history, third-country restrictions on data access.
2. Client acceptance. KYC to Luxembourg AML standards on the principal and its owners; sector and conduct screening; conflict check. No mandate is signed before this is complete.
3. Engagement letter and mandate. Scope, reporting duties on both sides, evidence to be delivered, review calendar.
4. Onboarding. Document collection → adequacy assessment or conformity-file verification → notification to the authority where the regime requires it (DSA, GDPR) or inclusion in the application (ESG Rating Regulation, AI Act registration) → first review date set.

The regimes

ESG Rating Regulation — legal representative (Article 12)

Regulation (EU) 2024/3005 applies from 2 July 2026. A third-country provider below the Accounting Directive's small-undertaking turnover ceiling for each of the last three years may apply to ESMA for recognition instead of setting up an EU entity; it must appoint a legal representative that is a legal person established in the Union, expressly mandated to act on its behalf. The representative must be able to demonstrate to ESMA, on an ongoing basis, that the provider complies with the Regulation and is accountable to ESMA for that. ESMA's recognition file asks for the representative's own assessment of the provider's compliance measures and a description of its monitoring. ESMA's fining powers under Article 36 are framed to reach the provider or, where applicable, its legal representative. This is the mandate VieKey is built for: a regulator-facing compliance role with a defined evidence base.

AI Act — authorised representative (Articles 22 and 54)

A provider established outside the Union must appoint, by written mandate, an authorised representative in the Union before placing a high-risk AI system on the EU market or putting it into service; providers of general-purpose AI models have had the same obligation since 2 August 2025. The representative verifies that the EU declaration of conformity and the technical documentation have been drawn up and the conformity assessment carried out; keeps them at the authorities' disposal for ten years; provides information on request; cooperates on risk-reduction measures; complies with the registration obligations; and must terminate the mandate and inform the market surveillance authority if the provider acts contrary to the Regulation. Following Regulation (EU) 2026/1744, the high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products — the representative is appointed before the first placing on the market, which for most providers means during 2027.

Digital Services Act — legal representative (Article 13)

A provider of intermediary services with no EU establishment must designate a legal or natural person in a Member State where it offers services, notify the Digital Services Coordinator and publish the representative's details. The representative receives orders to act against illegal content and orders to provide information, and can be held liable for the provider's non-compliance without prejudice to the provider's own liability (Article 13(3)). VieKey accepts these mandates for hosting providers, B2B platforms and marketplaces with a clean content profile and a client-side contact available for time-critical orders. Consumer-content platforms are declined.

GDPR — representative in the Union (Article 27)

Controllers and processors outside the Union that offer goods or services to, or monitor, people in the Union must designate a representative in writing, name it in the privacy notice and mandate it to be addressed by supervisory authorities and data subjects. The representative also holds the Article 30 record of processing. VieKey takes Article 27 mandates only alongside an ESG Rating Regulation, AI Act or DSA mandate for the same principal, where the record of processing is reviewed as part of the monitoring calendar.

CBAM

VieKey does not act as authorised CBAM declarant or as indirect customs representative; those roles carry the certificate and customs-debt liability and sit with licensed customs brokers. Exposure assessment, declarant readiness, supplier data and declaration preparation are covered under CBAM and energy.

Client acceptance

The representative's name is public under the DSA and the GDPR and known to the regulator under the other two regimes, so one principal's conduct reaches every mandate. VieKey screens each principal and its ownership against Luxembourg AML standards, sanctions lists and adverse media before signature and refreshes the screening annually; adult content, gambling, anonymous hosting and principals with sanctioned or opaque ownership are outside scope. Where third-country law could prevent the representative from obtaining the documents an EU authority may demand, that question is settled, with counsel, before the mandate is signed rather than after the first request.

Where the text and practice diverge

• Article 12(3) of the ESG Rating Regulation makes the representative accountable to ESMA for demonstrating the provider's compliance. A representative that forwards correspondence cannot discharge that; the recognition file requires an assessment the representative has actually performed. This is why the market splits between law practices that price the role on hourly rates and resist the exposure, and volume providers that cannot sign the assessment.
• Under Article 22 of the AI Act the representative verifies that the conformity file exists and is complete; it does not re-perform the conformity assessment. Where an Annex III system has no notified-body or clear self-assessment track, a technical reviewer is engaged before VieKey accepts the file.
• Representative mandates are commodity products at the low end of the market — intake and forwarding, no monitoring. That model is adequate where the representative's own exposure is nil; it is not adequate under Article 13(3) DSA or Article 12 of the ESG Rating Regulation, where the representative answers for the principal's compliance with its own name.
• The seat of the representative does not need to be where the regulator sits. ESMA supervises ESG rating providers directly from Paris; for the DSA and the GDPR, any Member State where the services or data subjects are will do, and Luxembourg qualifies whenever the EU audience includes it.

Frequently asked questions

Does the representative have to be a legal person?

Under the ESG Rating Regulation, yes — Article 12(3) requires a legal person established in the Union. The AI Act, the DSA and the GDPR accept a natural or legal person. VieKey takes every mandate through Vie Key Consulting S.à r.l. so that continuity does not depend on one individual.

Can one representative cover several regimes?

Yes. A non-EU software provider will often need an AI Act representative, a DSA representative and a GDPR representative at once. VieKey uses one master mandate with a regime-specific annex for each, one evidence repository and one review calendar.

What does the principal have to provide?

A named contact with authority to answer within the regulator's deadlines; the documents listed in the mandate annex, delivered on a schedule; notification of changes, incidents and authority contacts as they happen; and access to records within days of a request. A principal that cannot commit to this should not appoint a representative that is accountable for its compliance.

What happens if the principal stops complying?

The mandate sets out escalation, a remediation period and the representative's right to resign. Under the AI Act the representative must terminate the mandate and inform the market surveillance authority; under the ESG Rating Regulation the representative's accountability to ESMA means it will not continue to represent a provider whose compliance it can no longer demonstrate.

Do you act as CBAM authorised declarant or indirect customs representative?

No. See CBAM and energy for the advisory and declaration-preparation work VieKey does carry out.

Next step

Book a 20-minute scoping call or request the document list for a representative mandate.