Any company established outside the EU that makes connected products available or provides services (related and unrelated) in the Union must designate an EU legal representative (Art. 37(11)). 

Until a representative is designated, all Member States’ authorities may exercise their competence, including the power to impose proportionate and dissuasive penalties (Art. 37(14)). 

The designation must be in place as soon as connected products or services (related or unrelated) are made available on the EU market. Operating without a representative exposes the company to enforcement by all Member States (Art. 37(11), Recital 109). 

The Data Act applies without prejudice to the GDPR. Where personal data is involved, data protection authorities remain responsible for enforcement, and GDPR obligations continue to apply alongside the Data Act.