Organisational mandates

A mandate is the answer to the question every counterparty eventually asks: on what basis is this person acting for that organisation? EU law now gives that question digital infrastructure from three directions at once — register-published representation, a harmonised cross-border power of attorney, and wallet-carried attestations of authority — and this section maps how the pieces relate.

Who this section is for

Anyone who has to decide whether a person (or a system) genuinely acts for an organisation: relying parties, registers, notaries, compliance teams — and the engineers who have to encode the decision.

The three layers

1. Original authority: who may bind the company. Every company has persons authorised to represent it "in dealings with third parties and in legal proceedings" — a matter of national company law, disclosed in business registers, and now stated cross-border in the EU Company Certificate, including whether representatives act alone or jointly [Directive (EU) 2025/25, Art. 16b(2)(j)]. Covered in Who may act for a company.

2. Conferred authority: the power of attorney. Original representatives can authorise someone else for specific procedures. For cross-border company-law procedures, Directive (EU) 2025/25 harmonises that instrument as the digital EU power of attorney — granted under national requirements, verified by courts, notaries or competent authorities, and accepted as evidence of authority "as specified in the document" [Directive (EU) 2025/25, Art. 16c(1)–(2)].

3. Attested authority: mandates as wallet cargo. The eIDAS 2 framework treats "powers and mandates to represent or act on behalf of natural or legal persons" as attributes that trust service providers can attest electronically [Regulation (EU) 2024/1183 (eIDAS 2), recital 55], and puts "Powers and mandates to represent natural or legal persons" on the minimum list of attributes Member States must make verifiable against authentic sources [Regulation (EU) 2024/1183 (eIDAS 2), Annex VI, point 9]. What relying parties must do with wallet-presented evidence is covered in Relying parties and Relying-party registration.

Where it gets hard

The law defines instruments; operating them raises questions the instruments do not answer — how scope is checked at the moment of action, how revocation reaches the relying party in time, and what happens when software rather than a person is doing the acting. Two pages in this section are implementation notes — labelled engineering experience, not law:

• The mandate object — what a mandate has to look like as data before any of the checks can be automated.
• Agents and systems acting under mandates — why a valid token is not the same thing as an allowed action.

In this section

• Who may act for a company
• Relying parties
• The mandate object — implementation note
• Agents and systems acting under mandates — implementation note