EU-E-Evidence: What is a Legal Representative and who needs one?
This is the first post in our series on the EU e-evidence framework, written for the service providers who actually have to make compliance happen. No legalese, just what you need to know and do.
What Does EU E-Evidence Mean for You?
The EU’s e-evidence package is at the doorstep: from 18 August 2026, law enforcement authorities across the EU (except Denmark) can send production and preservation orders for electronic evidence directly to service providers – no more routing everything through lengthy government-to-government channels. The package consists of two pieces of legislation: the e-Evidence Regulation (Regulation (EU) 2023/1543), which creates the orders themselves and is directly applicable, and the e-Evidence Directive (Directive (EU) 2023/1544), which deals with the requirements to appoint a point of contact to receive those orders. The Directive has to be transposed into the national law, and there are delays. Not all EU Member States will be ready for the 18 August 2026 deadline. Nonetheless, the Regulation already applies from 18 August 2026.
For the orders to work, every service provider needs a clear “front door” – a single point of contact that authorities can address. That front door is either a designated establishment (if you’re based in the EU) or a legal representative (if you’re not). This post explains who needs a legal representative, what it does, and – crucially – where to appoint it.
First Things First: Does E-Evidence Even Apply to You?
The scope is broad. You fall under the e-evidence framework if you offer any of the following services in the EU:
- Electronic communications services – internet access providers, telephony, messaging and email services, and other interpersonal communication services;
- Internet domain name and IP numbering services – IP address assignment, domain name registries and registrars, and related privacy and proxy services;
- Other information society services that let users communicate with each other or that store or process data on behalf of users – think social networks, online marketplaces, cloud storage and hosting providers, and many SaaS platforms.
Financial services are excluded. But if you run a communication app, a hosting platform, a marketplace, or a cloud service used by people in the EU, you should assume you’re in scope until a proper assessment says otherwise.
Another important point: “Offering services in the EU” doesn’t require an office in the EU. If you have a substantial connection to one or more Member States – for example, a significant number of users there, or you target an EU market with your language, currency, or advertising – the rules reach you, wherever your company is incorporated.
What Is a Legal Representative?
A legal representative is a natural or legal person in an EU Member State whom you appoint – and empower – to receive, respond to, and comply with e-evidence orders on your behalf. In practice, this is who the authorities will contact when they issue:
- a European Production Order (EPOC) – an order to hand over specified data, generally within 10 days, or as little as 8 hours in emergency cases; or
- a European Preservation Order (EPOC-PR) – an order to freeze specified data so it doesn’t disappear while a production request is prepared.
The representative isn’t merely a mailbox. It must have the powers and resources to actually comply with orders: access to the right people and processes on your side, the ability to act within tight deadlines, and the knowledge to spot problems (like an order that touches privileged data – more on that in a later post in this series).
And here’s the part that makes the choice serious: appointing a legal representative does not shift responsibility away from your organisation. Both the service provider and its designated establishment or legal representative may be subject to enforcement measures for non-compliance, and providers can face fines of up to 2% of their total worldwide annual turnover under the EU e‑Evidence Regulation. Poor internal coordination between a provider and its representative is unlikely to be an acceptable excuse for missing the deadline or failing to respond to an order. This is particularly important in emergency cases, where the compliance deadline is as short as 8 hours, making robust workflows, technical integration and effective case management essential.
Not Based in the EU? Here's Your To-Do List
If your company has no establishment in the EU but offers in-scope services there, you must:
- Appoint a legal representative in a Member State where you offer your services. If you are already offering services in the EU as of 18 February 2026, the deadline to have this in place is 18 August 2026. If you start offering services later, you have six months from the day you start.
- Give the representative real powers and resources – a written mandate, internal escalation paths, access to data teams, effective ways to urgently contact relevant departments and clear procedures for handling orders within the deadlines.
- Notify the central authority of the Member State where your representative resides, in writing, with the representative’s contact details, the services you offer, and the language(s) in which you accept orders. The EU has published a notification tool for this, and it asks for a surprising level of detail, including the data categories available for each of your services.
EU-based providers don’t escape either: they must designate one of their EU establishments as the addressee and complete the same notification.
Who Can Be the Legal Representative?
The Directive is flexible on form: the representative can be a natural person or a legal entity – a subsidiary, an affiliated company, or an external professional service provider. What matters is substance:
- It must be located in a Member State where you offer services;
- It must be empowered and resourced to receive orders and ensure compliance;
- It should be genuinely capable of handling the job: legal orders arrive with 10-day (or 8-hour) clocks attached, sometimes raising tricky questions about privileged data or conflicting laws.
Given the joint and several liability and the short deadlines, this is a role for someone who understands the framework – not just a registered address.
Picking a Jurisdiction (And Why It May Matter More Than You’d Think)
Legally, you can appoint your representative in any Member State where you offer services (except in Denmark, which is not part of the e-evidence package). Practically, the Member States are not equally ready. The Directive was supposed to be transposed into national law by 18 February 2026, but implementation has been slow – so slow that in March 2026 the European Commission opened infringement proceedings against 22 Member States for failing to transpose on time.
Why does this matter to you? Because in a Member State without implementing legislation, key practical questions are up in the air: which national authority is competent, how notification works. Establishing your representative there means building your compliance on sand despite the Regulation applying from 18 August 2026.
The pragmatic move is to choose a jurisdiction that has already done its homework. Even within the group of countries that have transposed the e-Evidence Directive, there are differences in operational readiness: at the time of writing, the EU’s notification tool only supports notifications to the central authorities of Germany, Italy, Slovakia and Sweden out of the 9 Member States that have already transposed the Directive.
Germany stands out as a jurisdiction of choice: its implementing law is already in force, its central authority is designated and reachable through the notification tool, and the surrounding infrastructure – including preparations for the decentralised IT system through which orders will flow – is comparatively advanced.
We Can Be Your Legal Representative
Appointing a legal representative isn’t a paperwork exercise – it’s choosing the partner who will stand between you and EU law enforcement orders. Quick assessment of the incoming orders and ability to respond within the tight deadlines will be of the essence.
We act as legal representative under the e-Evidence Directive and support service providers through the full compliance journey:
- assessing whether and how the framework applies to your services,
- handling the notification to the central authority,
- building your internal playbook for production and preservation orders, and
- assist and support you in managing incoming orders – including the hard cases involving privileges, immunities, and conflicting legal obligations – within the deadlines.
If the 18 August 2026 deadline is on your radar (and it should be), get in touch.
Frequently Asked Questions on E-Evidence Legal Representatives
Very likely, yes. If you store or process data on behalf of users in the EU, or enable them to communicate, then you fall within the scope of the services covered by the e-evidence. Because you have EU customers, provided EU customers form a significant number or if you target the EU market (one or several EU countries), then there would also be a substantial connection to the EU market. Then you’re in scope – regardless of where your servers or headquarters are. You need to appoint a legal representative in the EU.
No. They serve different laws and different purposes. The GDPR representative deals with data protection matters; the e-evidence legal representative receives and handles criminal-justice orders for data. It may be that you will use the same organisation for both roles if it’s capable of doing both but appointing one does not cover the other. We are able to provide representative services for both of these instruments, but this has to be explicitly agreed.
If you have an EU establishment, you designate an establishment rather than appointing a legal representative. Beware that an entity you pick must genuinely be able to handle orders: receive them, escalate them, and meet the deadlines. Even if you designate an establishment, you still can instruct an external counsel to assist you with the legal assessment of the orders and to provide support in navigating the procedure. We are able to assist with that, even if we are not appointed as your legal representative.
You’ll be non-compliant with the Directive as implemented in national law. You also won’t make orders go away – authorities have enforcement routes, and ignoring the framework is the worst available strategy. Penalties for non-compliance with orders can reach 2% of worldwide annual turnover.
If you are already offering services in the EU on 18 February 2026: appoint a legal representative and notify the central authority by 18 August 2026. Starting later: do the same within six months of starting to offer services.
No. One designated establishment or one legal representative in a single Member State (where you offer your services) covers you for orders from authorities across the EU. That’s exactly why the choice of jurisdiction deserves thought. However, it is not to say that you cannot, for example, decide to designate several designated establishments, for example splitting which designated establishment takes care of data in relation to certain services you provide.
