Mere conduit
Transmission of information provided by a recipient through a communication network, or provision of access to that network.
DSA LEGAL REPRESENTATIVE
DSA Legal Representative
for Non-EU Providers
Article 13 representation for providers of intermediary services that offer services in the European Union without an establishment in the Union.
OSTRAI acts as DSA Legal Representative for eligible non-EU providers, providing the formal European representative mandate, regulatory contact infrastructure, authority interface, escalation arrangements and continuing representation required for an effective Article 13 appointment.
DSA ARTICLE
EU LEGAL REPRESENTATION
Not sure whether your service is an intermediary service or whether Article 13 applies? Start with the scope assessment.
ARTICLE 13 ELIGIBILITY
The route to
Article 13 representation.
The assessment is entity-specific and service-specific.
- YES
Intermediary service?
If no: no Article 13 trigger for that service.
- YES
Offering services in the Union?
If no substantial connection to the Union: no Article 13 trigger for that service.
- NO
Does the provider have an EU establishment?
If yes: Article 13 does not require appointment on the basis of an absence of EU establishment.
IF ALL CONDITIONS ARE MET
Article 13 representative required.
ARTICLE 13
Who needs a DSA Legal Representative?
A provider of intermediary services without an establishment in the Union must designate a legal representative in writing where it offers services in the Union.
- Service
- Does the relevant service fall within the DSA's intermediary-service categories?
- EU offering
- Is there a substantial connection to the Union?
- Establishment
- Does the provider itself have an establishment in the Union?
The provider entity matters. An EU group company does not automatically resolve the position of a separate non-EU provider.
Offering services means enabling recipients in one or more Member States to use the service and having a substantial connection to the Union. Relevant indicators include significant recipient numbers relative to population or targeting activities towards one or more Member States.
Language · Currency · Local advertising · App-store availability · Local customer service
All circumstances matter. Technical accessibility alone is insufficient.
Not sure whether your service is covered?
Request an Article 13 scope assessmentSERVICE CLASSIFICATION
The DSA does not apply to every
digital service in the same way.
Caching
Transmission involving automatic, intermediate and temporary storage, solely to make onward transmission to other recipients more efficient upon their request.
Hosting
Storage of information provided by, and at the request of, a recipient of the service.
Online platforms and online search engines have additional or differentiated obligations within the DSA framework.
Not every SaaS company, website or digital business is an intermediary service. Correct service classification comes before the mandate.
CHOOSING THE REPRESENTATIVE
Where can the Article 13 representative be established?
Article 13 requires the legal representative to be established or resident in a Member State where the provider offers the relevant service.
OSTRAI Limited is established in Cyprus.
As part of onboarding, OSTRAI reviews whether the relevant service offering and jurisdictional conditions support the appointment. Where legal analysis is required, that assessment is scoped separately.
The appointment analysis is service-specific and entity-specific.
A REGULATORY ROLE
More than a contact
address in Europe.
Article 13 creates a formal regulatory interface.
Under Article 13(2), competent authorities, the European Commission and the European Board for Digital Services may address the representative, in addition to or instead of the provider, on matters necessary for the receipt of, compliance with and enforcement of DSA decisions.
The provider must give the representative the necessary powers and sufficient resources for efficient and timely cooperation and compliance with those decisions.
An effective Article 13 mandate requires an operational relationship between the provider and the representative.
ARTICLE 13(3)
The representative carries real regulatory exposure.
The legal representative can be held liable for non-compliance with DSA obligations, without prejudice to the liability of and legal actions against the provider itself.
This does not transfer the provider's underlying compliance responsibility to OSTRAI. It explains why acceptance, accurate information and a functioning escalation structure matter.
THE OSTRAI MANDATE
A defined appointment.
An operational relationship.
Subject to onboarding and satisfaction of the conditions required before the mandate begins.
Formal Article 13 appointment
Written designation of OSTRAI Limited as the provider's legal representative within the agreed mandate.
Designated regulatory channel
A designated monitored electronic channel for communications connected with the Article 13 mandate.
Designated lead
A defined OSTRAI contact coordinates the representative relationship and material escalations.
Authority communications
Receipt and routine forwarding of communications from competent authorities, the Commission and the Board.
Regulatory liaison
Routine administrative liaison and standard acknowledgements within the agreed mandate.
DSC notification
Support with the Article 13(4) representative notification to the relevant Digital Services Coordinator.
Cyprus regulatory filings
Preparation and submission of ordinary Cyprus registration / registry filings falling within the agreed mandate where applicable under Cyprus Law 122(I)/2025.
Escalation protocol
Defined provider contacts and procedures for urgent or time-sensitive regulatory communications.
Mandate maintenance
Routine updates and maintenance of the representative relationship during the term.
Need to appoint a DSA Legal Representative?
Discuss the mandate with OSTRAIAUTHORITY INTERFACE
A clear route for
regulatory communications.
ARTICLE 13 LEGAL REPRESENTATIVE
OSTRAI
Regulatory intake · Escalation
Administrative liaison · Mandate interface
REPRESENTED PROVIDER
Instructions · Information
Substantive decisions · Compliance
Authorities may address the representative in addition to or instead of the provider. The provider retains its substantive DSA obligations.
REGULATORY COMMUNICATIONS
From receipt to a
recorded response.
Receive
Log
Triage deadline & authority
Escalate
Obtain provider instructions and information
Coordinate
Relay / facilitate response
Record
OSTRAI receives and escalates communications, obtains provider instructions and information, and relays administrative or procedural communications within the agreed mandate.
The provider remains responsible for the substantive accuracy and content of its position, instructions and compliance. Substantive advice, regulatory responses, meetings and hearings may require separately scoped support.
DIGITAL SERVICES ACT
ORDERS
When an Article 9 or
Article 10 Order arrives.
9Orders to act against
Orders to act against
illegal content
10Orders to provide
Orders to provide
information
- Order
- OSTRAI
- Urgent escalation
- Provider legal / operational team
- Response / action
- Authority
OSTRAI can receive and escalate the order and facilitate the communication chain. The provider remains responsible for legal assessment, operational action, compliance, any challenge and the substantive response, unless additional support is separately agreed.
DIGITAL SERVICES ACT
CONTACT FUNCTIONS
Legal representative does not
mean every DSA contact point.
Authority point of contact
Electronic communication with authorities, the Commission and the Board.
Recipient point of contact
Direct, rapid and user-friendly communication with recipients, not solely through automated tools.
Legal representative
The statutory representative mandate for the non-EU provider.
An Article 13 appointment does not automatically include Article 11, Article 12, crisis-management or other operational contact-point services. Additional functions may be separately agreed.
THE CYPRUS FRAMEWORK
A European mandate.
A defined national interface.
OSTRAI Limited is established in Cyprus.
Under Article 56(6), the Member State where the representative resides or is established has the relevant supervisory and enforcement powers, subject to the DSA's allocation of powers to the Commission, including for very large online platforms and very large online search engines.
Cyprus Law 122(I)/2025 designates the Radiotelevision and Digital Services Authority as Digital Services Coordinator and provides for a register of intermediary service providers.
Within ordinary agreed scope, OSTRAI supports notification of the appointment, ordinary Cyprus registry / representative filings where applicable, and routine mandate amendments based on complete and accurate provider information.
The provider must keep the representative information required by Article 13(4) publicly available, easily accessible, accurate and up to date. Historic non-registration, disputed filings and contentious matters may require separate work.
CONTROLLED ACCEPTANCE
We assess the mandate
before accepting the role.
Article 13 carries direct responsibilities and exposure. Appointment is therefore subject to controlled onboarding, rather than an automated registration exercise.
Before accepting a mandate, OSTRAI reviews the provider, covered services, EU and Cyprus offering, establishment position, regulatory history and operational readiness.
Where applicability, service classification, establishment or appointment jurisdiction requires legal analysis, that assessment is scoped separately before the representative mandate.
The regulatory position and risk profile determine whether the mandate can proceed.
Discuss whether OSTRAI can accept the mandateREPRESENTATION READINESS REVIEW
The information behind
a sound appointment.
- Provider entity
- Which legal entity actually provides each covered service?
- Service classification
- Mere conduit · Caching · Hosting · Online platform / other relevant classification
- EU offering
- Does the service have a substantial connection to the Union?
- EU establishment
- Does the relevant provider have an establishment in the Union?
- Cyprus offering
- Is the relevant service offered to recipients in Cyprus?
- Regulatory history
- Existing Orders · Complaints · Investigations · Enforcement matters
- Contact structure
- Primary regulatory contact · Emergency escalation contact · Internal legal contact
- Regulatory information
- Websites · Applications · Service descriptions · Jurisdictions
- Insurance / risk
- Evidence and arrangements required before acceptance where applicable
OPERATIONAL CONTACTS
A representative needs a responsive provider behind it.
Defined regulatory escalation contacts are established during onboarding.
- Primary regulatory contact
- Secondary / emergency contact
- Internal legal contact where available
- Regulatory inbox
- Preferred correspondence language
- External counsel details where relevant
The provider must supply accurate information, instructions and resources within applicable deadlines and report material changes affecting the service, provider, regulatory position or mandate.
A CLEAR SERVICE BOUNDARY
Representation and substantive
DSA advice are distinct.
Standard representative mandate
- Formal Article 13 appointment
- Designated regulatory channel
- Authority communications
- Routine administrative liaison
- DSC / ordinary registry administration where applicable
- Escalation and mandate maintenance
Separately scoped support
- Article 13 applicability analysis
- Service classification advice
- Substantive regulatory-response work
- Article 9 / Article 10 Order analysis
- Regulatory meetings or hearings
- Historic registration remediation
- Article 11 / Article 12 contact-point services where agreed
- VLOP / VLOSE matters
- Wider DSA compliance advice
The mandate does not include monitoring the service, operating content moderation or running the provider's compliance programme. Article 18 notifications, Article 24 transparency and active-recipient obligations and VLOP / VLOSE compliance remain the provider's responsibility where applicable. A defined representative mandate can sit alongside broader support when separately required.
A SPECIALIST DIGITAL-REGULATION PRACTICE
Representation backed by substantive DSA capability.
OSTRAI's DSA Legal Representative service sits within a specialist regulatory practice with substantive legal and digital-regulation expertise.
Our wider work includes platform regulation, digital services, privacy, cybersecurity, artificial intelligence, technology products and cross-border European regulation.
This means communications reaching the representative can be understood within their wider regulatory context.
Explore Digital RegulationWHY OSTRAI
Why providers appoint OSTRAI
as DSA Legal Representative.
OSTRAI combines Article 13 representation infrastructure with regulatory judgement, controlled acceptance and direct access to the team handling the mandate.
Article 13 focus
A representative service structured around the actual statutory role.
Controlled acceptance
The provider, service and mandate are reviewed before representation begins.
Direct regulatory access
A designated OSTRAI contact and monitored representative channel.
Regulatory experience
Substantive digital-regulation and supervisory-engagement capability.
Defined escalation
Clear procedures for urgent authority and regulatory communications.
Cross-regulatory view
Ability to identify intersections with privacy, cybersecurity, AI and other European regulatory regimes.
QUESTIONS & ANSWERS
Before
appointment.
Who needs a DSA Legal Representative?
Article 13 requires a provider of intermediary services without an establishment in the Union, but offering services in the Union, to designate a legal representative in writing in a Member State where it offers those services.
Which non-EU services qualify as intermediary services under the DSA?
Article 3(g) identifies mere conduit, caching and hosting services. Classification depends on what the service actually does. Online platforms and online search engines are subject to additional or differentiated requirements within the wider DSA framework.
Does every non-EU SaaS company need a DSA Legal Representative?
No. The analysis depends on whether the relevant service is an intermediary service, whether it is offered in the Union and whether the provider has an establishment in the Union.
Can OSTRAI act as DSA Legal Representative for any non-EU provider?
Not automatically. Article 13 requires the representative to be established in a Member State where the provider offers the relevant service. OSTRAI is established in Cyprus, and the relevant jurisdictional and service-offering conditions are confirmed during onboarding before a mandate is accepted.
What does a DSA Legal Representative do?
The representative acts under mandate so that competent authorities, the Commission and the Board can address it on matters necessary for the receipt of, compliance with and enforcement of DSA decisions. The provider must give it the necessary powers and sufficient resources for that role.
Is the DSA Legal Representative the same as the Article 11 or Article 12 point of contact?
No. They are legally distinct functions. Additional contact-point services may be separately agreed where appropriate.
Can a DSA Legal Representative be held liable?
Yes. Article 13(3) expressly allows the representative to be held liable for non-compliance with DSA obligations, without prejudice to the liability of and legal actions against the provider itself. This does not transfer the provider’s underlying compliance responsibility to the representative.
Does appointing a DSA Legal Representative create an EU establishment?
No. Article 13(5) expressly provides that designation of the legal representative does not constitute establishment in the Union for the purposes of the DSA.
What happens if a provider does not appoint a DSA Legal Representative when Article 13 requires one?
Under Article 56(7), all Member States have supervisory and enforcement powers in accordance with the DSA. The Commission also has relevant powers for very large online platforms and very large online search engines, subject to the Regulation’s allocation of powers and coordination safeguards.
DSA LEGAL REPRESENTATIVE
Put the right Article 13
representation structure in place.
OSTRAI supports non-EU providers from Article 13 scope and appointment questions through onboarding, regulatory interface and continuing DSA representation in the European Union.