5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
EU Digital Acts audit for digital business models
First the map, then the implementation
DSA, Data Act, AI Act, NIS2 and CRA do not hit companies as a list of provisions. We check whether your product, platform, AI tool or data model triggers obligations and clarify which regimes apply and what to do first.
Please enter a short description first.
The first contact is free of charge. We will inform you expressly before any costs arise for you.
Response within 24 hours on working days
As of: 23 October 2026
Regime stack2 of 5
- AI Act: role and risk classPresent
- GDPR: roles and legal basesPresent
- Data Act: data access and cloud switchingCheck
- NIS2: exposure by sector and sizeCheck
- DSA: user contentnot applicableMissing
Point of review: Which regime leads the implementation?
- 1Capture the modelRoles and triggers
- 2Classify regimesPrioritise obligations
- 3Receive the mapMeasures and route
Schematic illustration. Simplified example.
We audit for
- SaaS and cloud providers
- Platforms
- AI providers
- IoT manufacturers
- IT service providers
Key points at a glance
- Whether an EU digital law applies depends on the function of your business model, not on your size alone.
- The audit clarifies which regimes apply, what role you have and which obligations are already running.
- You receive an obligations map with priorities, immediate measures and the appropriate specialist route.
- On request, ITMR handles the full implementation of individual regimes as its own, separately agreed package.
- Your contact is Jean Paul Bohne and his team. He is a specialist lawyer for IT law and for copyright and media law. Response on working days within 24 hours.
- DSA
- Digital Services Act. EU regulation with obligations for online platforms and intermediary services.
- Data Act
- EU data regulation. It governs access to data from connected products and services.
- KI-Verordnung
- EU regulation on artificial intelligence, also called the AI Act. It sets obligations according to risk classes.
- NIS2
- EU directive on cybersecurity. It obliges many companies to carry out risk management and reporting.
Starting position
When is a Digital Acts audit worthwhile?
When a business decision is pending and several EU regimes are in play.
The trigger is rarely a law. A product is to go live, a customer asks about compliance or an investor demands documents.
At launch or scaling, a platform, app, SaaS solution, AI tool, connected product or data-driven service is to be approved, sold or rolled out internationally. Clarity about the obligations is needed beforehand.
With customer, group or investor questions, enterprise customers, procurement, investors or auditors want to see evidence on the DSA, Data Act, AI Act, NIS2, CRA, data protection and roles.
If the obligations are unclear, several sets of rules could apply. You do not need a loose list of provisions, but a decision on what really has to be implemented.
In such situations, we often see no clear internal line between legal, product, IT, data protection and management. The audit creates it.
- For whom
- Companies with digital products and services
- Regime
- DSA, Data Act, AI Act, NIS2, CRA, GDPR
- Result
- Obligations map with priorities
- Follow-up
- Specialist route per regime, separate
EU digital regulation becomes risky when it is reviewed in isolation. The DSA, Data Act, AI Act, NIS2, CRA and data protection intersect at data flows, product functions, platform roles, AI components, contract chains and security requirements.
Our Compliance Radar is available for an initial self-assessment. The regulatory timeline shows which deadlines are coming up in the next few months. Anyone who wants their situation clarified bindingly can then have us review it.
Typical misconception number one is that you are not Big Tech and therefore not affected. Many obligations are not linked to market power, but to the type of service, data access, AI role, product function, sector or company size.
Equally risky is the assumption that data protection already covers it or that it is purely an IT topic. Data protection replaces neither data access rights nor AI classification. Technology alone does not replace roles, approvals, contracts and evidence.
Anyone who only reviews at the implementation stage risks blockages in product design, customer communication, contract negotiation, enterprise sales, investor review and audit readiness.
Describe your business model using the form. We will get back to you on working days within 24 hours.
Process
How does the Digital Acts audit work?
In three steps from the business model to the obligations map.
01
Capture the model You describe the product, platform, data flows, AI use, user roles, markets, company size and the occasion. That can be a launch, an audit, a customer question, a due diligence or a management decision.
02
Classify regimes We check whether and how the DSA, Data Act, AI Act, NIS2, DMA, DGA, CRA, GDPR or related rules apply. In doing so, we distinguish between provider, deployer, platform, manufacturer, data holder and service provider.
03
Receive the map You receive a legal assessment with a scope decision, risk points, implementation priorities and a recommendation on which specialist route follows.
What happens internally in the audit
- 1
Identify triggers AI, platform, data access, cloud, security, product component, tracking and supply chain are assigned to the business model.
- 2
Create the obligations picture For each regime, we record what is a priority, open, secondary or to be reviewed in depth. We make interfaces between the regimes visible.
- 3
Derive the route of measures Responsible persons, evidence, immediate measures and implementation sequence are set. So your team knows what comes first.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service
What does the audit clarify and what not?
Service package: EU Digital Acts audit
Relevant regimes Which EU digital laws actually apply to your company and which remain secondary.
Your role Provider, deployer, intermediary service, platform, manufacturer, data holder, business user or entity concerned. The role determines the obligations.
Ongoing obligations Which obligations already apply, which transitions are coming up and where documentation is missing.
Multiple exposure Which regime leads, which interface blocks implementation and which measure reduces the greatest risk first.
Immediate measures First steps per situation, such as recording AI use cases, mapping data types or clarifying NIS2 exposure.
Specialist route Recommendation as to whether the AI Act, Data Act, DSA, NIS2, CRA, data protection, contract architecture or IT compliance should be examined in depth.
- For whom
- Companies with digital products, platforms, data or AI
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Full implementation of individual regimes, technical certification and pure checklist compliance. Implementation on request as a separate package.
Who delivers what and who decides
- Product or service description
- Data flows and AI components
- Contracts, T&Cs, DPA and policies
- Specific customer or audit questions
- Role and trigger analysis
- Obligations map with priorities
- Immediate measures and specialist route
- Assessment for management
- Your management decides on implementation and sequence
- In a dispute, the authority or court
How does the engagement work?
- 1
First assessment You describe your business model using the form. We assess which scope of review fits. The first contact is free of charge.
- 2
Offer Before we start, we tell you the scope and costs transparently.
- 3
Court steps separately We agree administrative proceedings and court action separately.
Regime comparison
Which regime asks which question?
The map decides which regime leads. The specialist pages take over implementation.
| Criterion | Leading question | Typical relevance |
|---|---|---|
| AI Act | Which AI role and risk class applies? | AI providers, AI deployers, HR, customer service, scoring, content. |
| Data Act | Who may use, demand or restrict which data? | IoT, connected products, related services, SaaS, cloud, B2B data contracts. |
| DSA | Is there an intermediary, hosting or platform service? | Platforms, marketplaces, apps with user content. |
| NIS2 | Does the company fall within scope by sector, size or service? | IT service providers, digital infrastructure, important or essential entities. |
| CRA | Does the product contain digital elements? | Software, connected hardware, manufacturers, importers, distributors. |
| GDPR and IT contract law | Which data, roles, contracts and evidence support implementation? | Almost all data-driven business models. |
Trigger matrix
Which trigger leads to which regime?
The first question is not which law applies, but which function your business model performs.
| Trigger | Possible regimes | Immediate measure |
|---|---|---|
| AI system in use | AI Act, GDPR, copyright | Record AI use cases, provider or deployer role and approval process. |
| Users upload content | DSA, GDPR, media and competition law | Determine the type of service, reporting channels and moderation rules. |
| Minors use the service | Art. 28 DSA, Youth Protection Act, GDPR, in future the EU KIDS Act | Check accessibility for minors and the small business exemption. |
| Data from connected products | Data Act, GDPR, CRA, contract law | Map data types, access rights, trade secrets and contractual position. |
| NIS2 sector | NIS2, BSIG, GDPR | Check exposure, type of entity, registration and reporting chain. |
| Cloud or SaaS contract with exit questions | Data Act, GDPR, IT contract law | Structure clauses, roles, SLA, exit and sub-processors. |
| Reporting security incidents | NIS2, CRA, GDPR | Set incident categories, responsibilities and escalation paths. |
| Personalised advertising | GDPR, DSA, competition law, AI Act | Check tracking set-up, labelling, platform roles and approvals. |
| Product with digital elements | CRA, Data Act, product safety | Include the life cycle, vulnerability process and data access in the roadmap. |
Types of company
Which companies should have a review?
The preliminary review is relevant for business models with a data, AI, platform or security dimension.
AI is developed, distributed or used in HR, customer service, scoring or content.
Intermediation, user content, traders, reviews or complaint mechanisms.
The product generates usage, operating or product data.
Data processing, IT security, switching and exit questions and customer contracts.
Tracking, targeting, influencers, AI content or campaign automation.
If a regime is already settled and only needs to be implemented. Then the specialist page takes you further directly.
Specialist routes
Which specialist page takes you further afterwards?
If one regime is in the foreground, the specialist page takes over the in-depth implementation as a separate package.
Classification, provider and deployer roles, governance, transparency, documentation and proximity to high risk.
Data access, connected products, related services, cloud switching and B2B data contracts.
Sector review, type of entity, registration, risk management, reporting channels and management obligations.
Intermediary services, hosting, marketplaces, reporting channels, transparency, complaints and moderation.
SaaS, cloud, SLA, exit, sub-processors and chains of title.
Legal bases, processing structures, DPIA, incident processes, product security and technical evidence.
Legal framework
Which provisions is the review based on?
The AI Act (EU) 2024/1689 applies in stages. Art. 3 defines providers and deployers, Art. 6 governs classification as a high-risk system and Art. 50 the transparency obligations.
The Data Act (EU) 2023/2854 has applied since 12.09.2025. Art. 3 and 4 govern data access for connected products, Art. 23 et seq. the switching of data processing services.
The DSA (EU) 2022/2065 requires hosting services to have notice and action mechanisms under Art. 16. Art. 28 protects minors on online platforms.
NIS2 is implemented in the BSIG. Section 28 BSIG determines the entities concerned, Section 30 the risk management measures and Section 32 the reporting obligations. Under Art. 14, the CRA (EU) 2024/2847 requires reporting of actively exploited vulnerabilities.
- AI Act (EU) 2024/1689 Art. 3, 6, 50.
- Data Act (EU) 2023/2854 Art. 3, 4, 23 et seq.
- DSA (EU) 2022/2065 Art. 16, 28.
- Cyber Resilience Act (EU) 2024/2847 Art. 13, 14.
- Section 28 BSIG Entities concerned under the NIS2 implementation.
- BSI on NIS2 implementation Types of entity, registration, reporting channels.
Alternatives
Which confusions lead to wrong decisions?
Four distinctions we clarify early.
- 1
The AI Act is not data protection law AI obligations stand alongside GDPR obligations. We review roles, risk classes and governance independently.
- 2
The Data Act goes beyond data licences It is also about product data, related services, access, sharing, cloud switching and the protection of trade secrets.
- 3
NIS2 also concerns management Management, risk management, reporting channels, supply chain and evidence belong in the same review.
- 4
The DSA requires more than platform T&Cs Reporting channels, transparency, complaints, moderation, user communication and the protection of minors are central.
What you can expect as a result
- A clear scope decision on which regime leads and which is secondary.
- Visible interfaces between the AI Act, GDPR, Data Act, DSA, NIS2, CRA and contracts.
- A short map that sales, legal and management can use towards customers and auditors.
Your contact
Lawyer and mediator · Partner · Specialist lawyer for IT law · Specialist lawyer for copyright and media law
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
TOP lawyer 2027 · Business lawyers · Intellectual property
F.A.Z.-Institut and QuantiQuest. Based on recommendations from peers and assessments by in-house counsel. Source (opens in a new tab)
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“I am overwhelmed, I did not expect such outstanding service! Mr Bohne really took our small company by the hand. We're staying here!” (translated from German)
“I can recommend the firm without reservation. Mr Bohne in particular helped me with my legal matter quickly, competently and without complications. Many thanks for that!” (translated from German)
“Mr Bohne convinced me with his uncomplicated manner, fast way of working and great competence. Working together was always pleasant and I felt very well advised. I would use his services again at any time.” (translated from German)
FAQ
What do companies ask about the Digital Acts audit?
What are the EU Digital Acts?
This means EU regimes for digital business models such as the AI Act, Data Act, DSA, DMA and CRA, as well as related data protection and cybersecurity obligations. We check which of them your business model triggers.
What distinguishes the audit from the specialist pages?
The audit clarifies which regimes are likely to apply and what makes sense first. The specialist packages on the AI Act, Data Act, NIS2 and DSA then take over the in-depth implementation of one regime.
Can a company be affected by several regimes at once?
Yes. A SaaS provider with an AI function, user data and cloud contracts may have to check the AI Act, GDPR, Data Act, IT contract law and, depending on the sector, NIS2 at the same time. The audit sorts out precisely this overlap.
Which documents help for the first review?
Helpful are a product description, target groups, markets, data flows, AI use cases, platform functions, cloud and SaaS contracts, security concept, policies and specific customer, investor or audit questions.
What is the first step if exposure is unclear?
First, we sort out the business model, roles and triggers. This results in a scope decision with the leading regime, interfaces, open points, an immediate measure and the appropriate specialist route.
Why is it not enough to review just one law?
Many models combine AI, data, contracts, platform functions, data protection and security. An isolated review easily overlooks data flows in AI, contractual rights under the Data Act or reporting channels under NIS2.
Next step
Should your exposure be clarified reliably?
If several EU digital regimes are in play, the first decision should not be to implement everything in parallel. Better is a map that shows what applies, what is secondary and which specialist route makes economic sense.
Helpful for your enquiry
- Product or service description
- Markets and user groups affected
- Data flows, AI or platform functions
- Existing contracts and reason for the review
You can also submit documents after our first response.
Have your Digital Acts situation reviewed
For companies with digital products, platforms, data or AI.
Describe the business model, clarify the leading regime.
Related services
Implementing the AI Act AI roles and obligations.Implement the Data Act Data access and contracts.Implement NIS2 Cybersecurity obligations.Implement the DSA Platform obligations.TK-Anbieter-Compliance TKG obligations for providers.Risk management Assess risks.Service packages All packages.
From our blog: Digital Omnibus on AI · Report a cyber incident