ITMR Compliance Radar
Which digital regulation affects your business?
This compliance check shows which digital laws apply to your business model. The Compliance Radar gives a provisional risk level and concrete measures. The Compliance Radar shows which digital regulation affects your business. Start right here.
Who is this checker for?
The checker is designed for businesses, start-ups, agencies, platform operators, SaaS/cloud providers, e-commerce providers, manufacturers of digital products and decision-makers who want to know which regulatory topics should be reviewed first. It does not replace legal advice, but it helps with initial structuring and preparing a mandate.
Open the radarVisual radar
Digital regulation as a clickable compliance radar
Choose a company profile or click a radar node directly. The focus area updates typical affected parties, review points, documents and matching ITMR follow-up checks. The radar is visibly animated on desktop and mobile: rotating sweep, pulsing rings, moving nodes and active review fields.
Compliance
AI Act / AI compliance
Typically affected
First review points
Typical documents
Orientation
How the classification works
Define the business model
Websites, shops, SaaS, platforms, AI, cloud, software products and connected products are regulated differently.
Record the risk drivers
Data, tracking, AI, consumer journeys, platform functions, claims, security, open source or product obligations increase the depth of review.
Map the regulations
The checker links your answers to typical areas such as the GDPR, AI Act, Data Act, DSA, NIS2, CRA, BFSG, GPSR, UWG and IP.
Derive the priority
Acute deadlines, incidents, contact with authorities, warning letters, launch pressure or customer audits lead to a higher priority.
Prepare a roadmap
The result lists review points, documents, deadline notes and follow-up checks for further work.
Classification
What this check does
Digital business models often trigger several areas of law at once. An AI-supported SaaS product can involve data protection, the AI Act, contract law, open source, the Data Act and cybersecurity. A marketplace can additionally touch the DSA, consumer, product and advertising law. The Compliance Radar therefore does not show an isolated single obligation, but a prioritised review of the interfaces.
Regulatory mapping
Mapping of typical obligations by business model, data processing, user roles, product reference, platform function and proximity of deadlines.
Risk and priority logic
Assessment by acute signals, proximity of harm, implementation pressure, documentation needs and regulatory complexity.
Mandate preparation
Automatically generated short overview with risk level, review fields, reasons, measures and documents.
Scope of the Compliance Radar
It covers typical digital business models such as websites, online shops, apps, SaaS, cloud, platforms, marketplaces, AI applications, software products, IoT, agency services, data-driven services and international providers with an EU/German connection.
When is the classification particularly relevant?
The check is particularly relevant before a product launch, relaunch, investor or customer audit, new use of AI, cloud migration, tracking change, platform function, marketing campaign, contact with authorities, data protection incident, security incident or warning letter.
How should deadlines and new developments be understood?
Fixed deadlines are shown as such. The Digital Omnibus on AI has applied since 27.07.2026 (Regulation (EU) 2026/1744). Planned changes or changes not yet finally consolidated, such as the Digital Omnibus on data, the GDPR and cookies, the implementation of the Data Act or authority guidelines, should be finally reviewed in the mandate and treated as a monitoring point.
Limits of the initial orientation
Specific applicability, national implementation, authority practice, the contractual situation and technical design depend on the individual case. The checker does not replace a legal review.
Starting points
Select typical concerns
Optionally choose a starting point. The answers in the questionnaire are preselected and can be adjusted afterwards.
Interactive questionnaire
Classify your compliance risk in four steps
Answer the following questions. The checker uses them to calculate a provisional risk level, typical review fields, reasons, measures and documents to prepare.
Provisional result
Your compliance classification
Likely classification
Risk level
Risk level
Priority
Next focus
Relevant review fields
Reasons
Recommended next review points
Documents worth preparing
Deadlines, risks, measures
Typical compliance matrix for digital business models
| Area | Typical trigger | Risk | First measure |
|---|---|---|---|
| GDPR / TDDDG | Tracking, customer data, HR, newsletter, data protection incident | Risk of fines, damages, warning letters and lack of evidence; data breaches can trigger a 72-hour review. | Review the RoPA, legal bases, DPA, TOMs, consent, transfers, DPIA and breach process. |
| AI Act | AI tools, AI products, HR AI, chatbots, generative content | Role, risk, transparency, AI literacy and governance obligations can vary considerably depending on use; plan for the deadlines under Regulation (EU) 2026/1744 (Annex III from 02.12.2027, Annex I from 02.08.2028). | Create an AI inventory, role matrix, prohibition screening, AI policy, training and vendor review. |
| Data Act | IoT, product data, related services, API, cloud switching | Data access, data sharing, contract clauses, trade secrets and cloud switching can shape products and contracts. | Review the data inventory, request process, interfaces, contract clauses and GDPR gates. |
| DSA | Platform, hosting, marketplace, UGC, moderation, ranking | Points of contact, notice and action, complaints, statements of reasons, transparency and marketplace obligations are relevant depending on the role. | Review the DSA role memo, moderation workflow, complaint process, takedown log and transparency obligations. |
| NIS2 / BSIG | Security-relevant sector, cloud, MSP, critical customers, incident | Applicability, management responsibility, risk management, supply chain and reporting channels can create high implementation pressure. | Prepare a sector/size review, control register, management resolution, supplier clauses and incident runbook. |
| CRA / software product | Software, hardware, IoT, digital elements, open source | Secure by design, vulnerability handling, SBOM, technical documentation, updates and conformity become central; reporting processes should be testable before 2026. | Set up a secure SDLC gap analysis, SBOM, OSS scan, VDP/PSIRT, update policy and product file. |
| BFSG / accessibility | Shop, app, portal, digital consumer service, self-service | Accessibility requirements can become relevant for market surveillance and warning letters in digital consumer offerings. | Review the scope, carry out an accessibility audit, create an accessibility statement, feedback channel and action plan. |
| E-Commerce / UWG | Checkout, subscription, price advertising, reviews, green claims, influencers | The button solution, cancellation button, withdrawal, price information and claims are often critical for warning letters and conversion. | Audit the order process, cancellation process, consumer information, claim dossier and review logic. |
Follow-up reviews
Sensible next steps
Related ITMR checkers and follow-up reviews
Have the Compliance Radar results reviewed in legal depth
If several regulations may apply at the same time, a prioritised review is often more economical than isolated individual measures. ITMR can legally classify applicability, roles, deadlines, documents, contracts, technical processes and evidence and turn them into an actionable roadmap.
Ask ITMR about the Compliance RadarLegal orientation note: this checker offers an initial legal orientation for digital business models. It does not replace legal advice in the individual case. Scope, deadlines, national implementation, authority practice, the contractual situation and technical design must be reviewed specifically. How we build compliance structures is described in the section IT compliance; for an overview of the EU digital laws, see our EU Digital Acts Audit.