REP27Appoint us
News

REP27›News

Eleven at night. A client in another country writes to ask whether the law applies to…

· 2 min read

Learn more →

Eleven at night. A client in another country writes to ask whether the law applies to him. Nobody is awake. The message sits there until morning, and by morning he has written to someone else.

I built the thing that answers instead. Then I spent longer deciding what it is not allowed to do.

Three settings. One of them is the whole point.

It can draft and wait for me. It can send on its own only when it is confident, and hold everything else as a draft. Or it can send directly. I choose per mailbox, and I can turn the whole thing off with one switch.

Some words stop it dead. Refund. Chargeback. Lawyer. Complaint. If one of those appears, the reply is never sent on its own — it waits for a person, and that person is me.

It does not answer instantly either, because nobody writes a considered legal answer in four seconds and clients notice. It waits half an hour, adds a few random minutes, and only writes inside working hours.

It replies in the language the client wrote in, out of eight. It ends with one useful question about that specific case, never a generic "any other questions?". And when someone says they want to proceed, it builds the real link — the prices are the ones on the website, never invented, and a second check runs before anything leaves.

Every reply it sends lands in my inbox as a hidden copy. I read them. That is not a formality: it is how I know whether to widen what it is allowed to do or narrow it.

So here is my honest question, and I would like a real answer, not a thumbs up. Would you let an AI answer your clients? And if yes, where exactly would you draw the line — price questions, legal questions, complaints?

Tell me in the comments. I read every one and I will tell you what I decided and why.

Learn more →

Keep reading

Do you actually need an EU representative?24.10.2026 · ENDo you actually need an EU representative?Article 27 GDPR requires a company established outside the EU to designate a representative in the Union only if it falls under Article 3(2) — meaning it offers goods or services to people in the EU, or monitors their behaviour. If neither condition applies, the GDPR does not apply and no representative is required. If one condition applies, failure to designate is a standalone infringement under Article 83(4)(a), carrying fines up to EUR 10 million or 2% of total worldwide annual turnover.Read the article →Two numbers sit next to each other in this market, and the gap between them is the whole…Video · 22s23.10.2026 · ENTwo numbers sit next to each other in this market, and the gap between them is the whole…The Dutch supervisory authority fined Locatefamily.com €525,000 for failing to designate an EU representative under Article 27 GDPR. A designation from Europe Services, SE costs €290 per year. Article 83(4)(a) sets the maximum at €10 million or 2% of worldwide annual turnover for this infringement alone.▶ Watch the videoMost compliance questions for a non-EU seller start in the wrong place.Video · 22s23.10.2026 · ENMost compliance questions for a non-EU seller start in the wrong place.Non-EU sellers face different EU obligations depending on what they sell, not one single rule. A smart camera with cloud connectivity requires both a Cyber Resilience Act authorised representative and an Article 27 GDPR representative. A food supplement requires neither GPSR nor a GDPR representative — it requires a food business operator established in the Union.▶ Watch the videoEU representative quotes in this market run from about €150 a year to €1,500.Video · 22s22.10.2026 · ENEU representative quotes in this market run from about €150 a year to €1,500.EU representative quotes run from roughly €150 to €1,500 a year for the same legal role: one named contact point in the Union under Article 27 GDPR. The price gap reflects six operational differences — designation document format, public verification, per-request charges, language coverage, Article 30 record-keeping and turnaround time — none of which are defined by the regulation itself.▶ Watch the videoNo EU office? You still need a name here.22.10.2026 · ENNo EU office? You still need a name here.Article 27 GDPR requires any controller or processor established outside the EU to designate a representative in the Union in writing if it processes personal data of EU residents under Article 3(2) GDPR. Failure to designate is a standalone infringement under Article 83(4)(a), carrying a fine of up to EUR 10 million or 2% of total worldwide annual turnover. The Dutch supervisory authority fined Locatefamily.com EUR 525,000 solely for the absence of that designation.Read the article →400 boxes printed, all to be relabelled.22.10.2026 · EN400 boxes printed, all to be relabelled.Regulation (EU) 2023/988 (GPSR), which has applied since 13 December 2024, requires every product placed on the EU market to carry a product identifier, the manufacturer's name and postal address, an email address, and — for manufacturers established outside the EU — the name and address of an EU responsible person. Missing any one of these elements makes the label non-compliant, regardless of how the product looks.Read the article →I didn't know my website needed an accessibility statement until a customer asked for it.21.10.2026 · ENI didn't know my website needed an accessibility statement until a customer asked for it.Since 28 June 2025, the European Accessibility Act (Directive 2019/882) applies to online shops, booking sites, banking services and ticketing platforms across the EU. Micro-businesses — defined as fewer than 10 staff and under €2 million annual turnover — are often exempt from the service requirements. If your business falls outside that threshold, an accessibility statement is required.Read the article →You appoint an EU representative on a Monday.Video · 24s20.10.2026 · ENYou appoint an EU representative on a Monday.You appoint an EU representative on a Monday. By Friday nothing has happened. No email from Brussels, no request from a data subject, no authority asking…▶ Watch the videoIf you make connected devices or software sold in the EU, this changed on 11 September…20.10.2026 · ENIf you make connected devices or software sold in the EU, this changed on 11 September…From 11 September 2026, the Cyber Resilience Act requires manufacturers of connected devices and embedded software sold in the EU to report actively exploited vulnerabilities within 24 hours — to ENISA and the relevant CSIRT. The obligation applies to products already on the market, not only to new ones.Read the article →
All newsRSS