ITMR Contract Radar
What risks are hidden in your IT or SaaS contract?
The contract radar classifies contract type, role, clause risks, regulatory interfaces and project phase. The result is a structured initial orientation on risk level, negotiation focus, documents and next review points. This shows you which contract risks are hidden in your IT, SaaS or digital contract.
What the check is for
A contract X-ray for digital business models
Digital contracts are rarely just "terms and conditions". Services, rights, data protection, security, SLA, support, subcontractors, fees, termination, data export and liability are intertwined. The check makes these interfaces visible and helps you prioritise the most important review areas before negotiation, signature, renewal or escalation.
Interactive visualisation
Contract X-ray: clauses, data and exit as a risk constellation
The graphic responds to your answers: the more a topic is affected, the more clearly it appears in the contract radar.
Identify the contract type
Distinguish between SaaS, software development, platform, licence, agency, data protection annex or AI/data contract.
Clarify the role
Providers, customers, platform operators, subcontractors and investors have different negotiation and evidence interests.
Prioritise clause risks
Scope, change requests, rights, liability, SLA, data protection, security and exit are condensed into a negotiation agenda.
Check regulatory interfaces
GDPR, Data Act, AI Act, DSA, NIS2/BSIG, CRA, BFSG (German Accessibility Act) and product liability can directly shape contract clauses.
Prepare documents
Contract, annexes, SLA, DPA, TOMs, service description, offers, tickets and versions determine the depth of the review.
What this check does
Pre-review instead of gut feeling
The contract radar does not replace a review of the actual contract text. It does show where legal, commercial and operational risks typically arise and which documents ITMR usually needs for a quick assessment.
When is the contract radar useful?
Before contract negotiations, shortly before signing, at renewal, when switching providers, during due diligence or when a project is already in dispute, delay or escalation.
Which contract topics are particularly relevant?
The service description, change requests, acceptance, SLA, rights of use, open source, data protection, third-country transfers, security, liability, termination, exit and data export are particularly often decisive.
What are the limits of the check?
The assessment remains preliminary because it does not replace the full contract, annexes, negotiation history, actual service practice and commercial context. Uncertain or planned legal changes should be treated as monitoring items.
Interactive questionnaire
Select contract, role and risk signals
Answer the following steps. At least one selection is required per step.
Preliminary result
Evaluating your contract risks
Likely classification: —
Risk level: —
Priority: —
Next focus: —
Reasons
Recommended next review points
Documents worth preparing
Copyable short summary
Deadlines, risks and contract measures
Typical contract and compliance interfaces
| Topic | Why it matters in the contract | Typical review point |
|---|---|---|
| GDPR / DPA / TDDDG | Data protection roles, TOMs, subprocessors, third-country access, data breaches and data subject rights must be reflected in the contract and annexes. | DPA, TOMs, transfer documents, deletion and support rules. |
| Data Act | Relevant since 12.09.2025 for data access, cloud switching, connected services and unfair data contract terms; check design obligations for new connected products/related services since 12.09.2026. | Data inventory, portability, access interfaces, cloud exit and trade secret protection. |
| NIS2 / BSIG / DORA | Cybersecurity and incident obligations can shape the security annex, supplier clauses, audit rights and reporting processes. | Applicability check, incident runbook, management and supply chain obligations. |
| CRA / product liability / SBOM | For products with digital elements, the security lifecycle, vulnerability handling, documentation and update policy become relevant to contracts and liability; prepare for CRA reporting obligations since 11.09.2026 and main obligations from 11.12.2027. | SBOM, secure SDLC, VDP/PSIRT, technical documentation, liability files. |
| AI Act / AI governance | AI contracts need roles, transparency, output rules, training/use limits, vendor clauses and data protection/IP interfaces; prepare supply chain obligations under Art. 25 AI Act as amended by Regulation (EU) 2026/1744 in the contract. | AI system register, role/risk classification, vendor addendum, training records. |
| B2C / BFSG / buttons | For B2C, digital products, subscriptions and e-commerce, information duties, the button solution, cancellation button, withdrawal, updates and accessibility can be critical for launch. | Checkout flow, cancellation flow, T&Cs, withdrawal, accessibility documents. |
Sensible next steps
Related ITMR checkers and follow-up reviews
Have your contract reviewed in a structured way
If you already have the contract text, annexes, comments or deadlines, ITMR can assess the risks in a targeted way, prioritise red flags and prepare wording or negotiation options.
Request a contract review from ITMRNote: This contract radar is a structured initial orientation for digital contracts. It does not replace a legal review of the specific case. Whether individual obligations, deadlines, sanctions or contract clauses apply depends on the contract text, role, business model, data flows, product function, negotiating position and current legal developments. Our pages explain how we provide ongoing support for IT and platform contracts: Contract management and IT outsourcing contract.