5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Cross-border advice on EU market entry
GDPR, DSA, AI Act and contracts at a glance
Do you serve EU users from the USA, Asia, Switzerland or elsewhere? We clarify which EU rules apply to your offering and what needs to be in place before market entry.
Please enter a short description first.
The first contact is free of charge. If costs arise, we will tell you expressly in advance.
Response within 24 hours on working days
As of: 23 October 2026
Before market entry1 of 5
- ApplicabilityPresent
- Representative in the EUCheck
- Data transfersCheck
- Contracts and termsCheck
- Decision on launchYou decideMissing
Point of review: Do you need a representative in the EU?
- 1Send enquiryProduct and markets
- 2Clarify obligationsRules and representative
- 3ImplementDocuments and contracts
Schematic illustration. Simplified example.
We advise on EU market entry
- SaaS providers
- Platforms
- Online retailers
- AI providers
- Start-ups
Key points at a glance
- Many EU rules also apply to companies without an establishment in the EU as soon as they serve EU users.
- These include the GDPR, Digital Services Act, Digital Markets Act and AI Act.
- Before market entry, ITMR clarifies which obligations apply and whether a representative in the EU is required.
- Fines are decided by the supervisory authorities.
- Your contact is Jean Paul Bohne and his team. He is a specialist lawyer for IT law and for copyright and media law. Response on working days within 24 hours.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
- DSA
- Digital Services Act. EU regulation with obligations for online platforms and intermediary services.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- Data Act
- EU data regulation. It governs access to data from connected products and services.
Starting position
Does EU law apply even without an establishment in the EU?
Yes, in many cases. What matters is whether you specifically target EU users.
Clarifying obligations before launch avoids rebuilding under time pressure.
The GDPR covers providers who offer goods or services to people in the EU or monitor their behaviour.
The Digital Services Act regulates intermediary services and platforms with users in the EU.
The AI Act concerns providers whose AI systems are placed on the market or used in the EU.
In addition, there are distribution law, contracts, trade marks and data transfers out of the EU.
- For whom
- Companies outside the EU
- Trigger
- Planned or ongoing EU market entry
- Core
- GDPR, DSA, AI Act, contracts
- Decision
- You decide on launch and scope
We advise companies from the USA, Asia and Switzerland on which EU rules apply to their specific offering. The regulations interlock and should be considered together.
There are separate service packages for individual topics, for example on data transfers, the DSA or the AI Act. This page is the starting point when several rules apply at once.
Describe your product and target markets using the form. We will get back to you on working days within 24 hours.
Process
How do we prepare market entry?
From enquiry to implementation in three steps.
01
Send enquiry Describe your product, business model, target markets and planned launch.
02
Clarify obligations We check which EU rules apply, whether a representative in the EU is required and where the priorities lie.
03
Implement We implement data protection documents, transfer mechanisms, terms and conditions, contracts and trade marks by priority.
Four questions before launch
- 1
Which rules apply? We map the GDPR, DSA, DMA, AI Act and Data Act to your offering.
- 2
Who represents you in the EU? We check whether the GDPR, DSA or AI Act requires a representative or authorised representative.
- 3
How does the data flow? We clarify transfers between the EU and third countries and the appropriate mechanisms.
- 4
What applies to distribution? We review terms and conditions, distribution rules, licences and trade marks for the target markets.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service
What does cross-border advice include?
Service package: cross-border advice
Applicability Which EU rules apply to your offering.
Data protection GDPR, standard contractual clauses and transfer assessments.
Platforms and AI Classifying obligations under the DSA, DMA and AI Act.
Contracts and trade marks Terms and conditions, licence agreements and trade mark filings with the EUIPO.
- For whom
- Companies outside the EU
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Services of a representative in the EU provided by service providers. You commission these separately if needed.
Who delivers what and who decides
- Description of product and business model
- Target markets and timetable
- Existing contracts and privacy texts
- Information on data flows
- Applicability review
- Prioritised list of obligations
- Documents and contracts
- Support with authority enquiries
- You decide on launch and scope
- Supervisory authorities decide on fines
How does the engagement work?
- 1
First assessment You describe your project using the form. We assess which rules apply. The first contact is free of charge.
- 2
Offer Before we start, we tell you the scope and costs transparently.
- 3
Court steps separately We agree authority proceedings, court proceedings and representation separately.
Topics
Which EU topics do we review?
Six fields that come together at market entry.
Standard contractual clauses, binding corporate rules and transfer assessments.
Transparency on platforms, handling illegal content, representative in the EU.
Classification of AI systems, documentation and transparency.
NIS2 obligations and plans for security incidents.
Terms and conditions for B2B and B2C, licences and payment services.
Filings with the EUIPO and defence against imitators.
Legal framework
Which rules reach beyond the EU?
Under Art. 3(2) GDPR, the GDPR also applies to controllers outside the EU who offer goods or services to people in the EU. Art. 27 GDPR then usually requires a representative in the EU.
Under Art. 13 DSA, intermediary services without an establishment in the EU must designate a legal representative.
Under Art. 22 AI Act, providers of high-risk AI systems from third countries appoint an authorised representative in the EU.
Transfers of personal data to third countries are governed by Art. 44 to 49 GDPR.
- DSGVO Art. 3, 27, 44 to 49 GDPR.
- Digital Services Act Art. 13 DSA.
- AI Act Art. 22 AI Act.
Limits
What does the advice not cover?
Clear limits protect your planning.
- 1
No promise of outcome Fines and proceedings are decided by the supervisory authorities.
- 2
No law outside the EU The law of your home country is reviewed by local law firms.
- 3
No representative service The role of representative in the EU is taken on separately by service providers.
- 4
The decision remains yours When and how you launch is your decision.
What you can expect as a result
- An overview of the EU rules for your offering.
- A prioritised list of obligations before launch.
- An assessment of whether a representative in the EU is required.
Your contact
Lawyer and mediator · Partner · Specialist lawyer for IT law · Specialist lawyer for copyright and media law
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
TOP lawyer 2027 · Business lawyers · Intellectual property
F.A.Z.-Institut and QuantiQuest. Based on recommendations from peers and assessments by in-house counsel. Source (opens in a new tab)
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Mr Bohne convinced me with his uncomplicated manner, fast way of working and great competence. Working together was always pleasant and I felt very well advised. I would use his services again at any time.” (translated from German)
“Very good advice from Mr Bohne on a contract issue in copyright law, thorough engagement with the subject and the specific case, targeted and practical advice on how to proceed, concise and understandable explanations of the legal position, overall excellent cooperation. …” (translated from German)
“… Mr Bohne really responded to all our ideas and expectations and guided us through this media/copyright jungle. He drafted an adaptable freelancer contract, a non-disclosure agreement and a data protection document for us. We are very satisfied with the result and the cooperation. …” (translated from German)
FAQ
What do companies ask before EU market entry?
Does the GDPR apply without an establishment in the EU?
Yes, if you offer goods or services to people in the EU or monitor their behaviour. This is governed by Art. 3(2) GDPR.
Do I need a representative in the EU?
That depends on the offering. The GDPR, DSA and AI Act each have their own rules. We check which apply to you.
How do I transfer data out of the EU?
Through adequacy decisions, standard contractual clauses or binding corporate rules. For the USA, the Data Privacy Framework may be an option.
Does the AI Act affect me?
If your AI system is placed on the market or used in the EU. The obligations depend on the risk level.
Can I start with a partial review?
Yes. We start with applicability and then prioritise the obligations.
Do you also advise in English?
Yes. We advise in German and English.
Next step
Which EU rules apply to your offering?
Describe your project. We clarify what needs to be in place before market entry.
Helpful for your enquiry
- Description of the product
- Target markets and timetable
- Existing privacy texts
- Overview of data flows
State the planned launch date.
Have your EU market entry reviewed
For companies outside the EU with products or services for EU users.
Briefly describe product, target markets and planned launch.
Related services
Data transfer Transfers to third countries.Digital Acts DSA, DMA, Data Act, AI Act.EU representative under Art. 27 GDPR For companies without an EU seat.Terms and conditions Terms and conditions for shops and SaaS.Service packages All packages.