ITMR Industry Radar
Classify digital law risks by industry and project phase
The Industry Radar helps companies, start-ups, agencies, platform operators, SaaS/cloud providers, e-commerce offerings, digital product teams and public figures prioritise the legal fields that really matter for their model: data protection, AI Act, Data Act, DSA, NIS-2/BSIG, CRA, BFSG, e-commerce, advertising law, IP, contracts, cybersecurity and reputation. This lets you classify digital law risks by industry and project phase in a targeted way.
The checker does not replace an individual review. It does, however, show which areas of law should typically be reviewed first for a digital business model, which documents are worth preparing and which ITMR follow-up review fits the starting situation.
Interactive sector map
Live radar for industry-specific legal loads
The visualisation updates with every selection. Large orange nodes mark the currently strongest review areas; the bars below show the prioritised review route.
Orientation
How the Industry Radar reads your business model
The starting sector sets the typical legal fields, such as SaaS, platform, AI, e-commerce, agency, IoT, HR tech, health, fintech or reputation.
B2B, B2C, subscription, marketplace, user content, API or hardware involvement shift the focus significantly.
Personal data, sensitive data, AI, tracking, cloud, third-country involvement, open source and security raise different review areas.
EU reach, minors, employees, public-sector clients or regulated industries change obligations and priority.
Pre-launch, live operation, scale, audit or crisis determine whether design, documentation, incident response or defence comes first.
What this check delivers
Industry-specific initial prioritisation instead of an abstract list of legal areas
Many digital business models are not just relevant under “data protection law” or “contract law”. They combine product, data, platform logic, advertising, security, consumer law and reputation. The Industry Radar translates this combination into an initial review route.
The score is a structured orientation. It takes typical industry patterns into account and amplifies review areas when additional risk signals are selected. For critical or high-priority results, the legal architecture of the model should be reviewed, not just a single document.
Which legal fields does the Industry Radar cover?
The radar covers data protection/GDPR/TDDDG, DPA, third-country transfers, AI Act, Data Act, DSA/platform regulation, NIS-2/BSIG, Cyber Resilience Act, BFSG, e-commerce, IT and SaaS contracts, cybersecurity, IP/content, marketing/claims, product safety, open source/SBOM, media law and litigation readiness.
Why is the industry so important for the legal review?
The industry shows which regulatory logic typically applies first. For a marketplace, the DSA, product safety, consumer information and reviews are closer than for a pure B2B SaaS. For an AI product, the AI Act, data protection, IP, contracts and governance come together early.
What are the limits of the evaluation?
The check works with typical risk signals. It does not review the specific website, app, contract chain, data flows, AI systems, communication with authorities or technical implementation. A reliable individual review depends on the product, countries, roles, users, contracts, data types and actual implementation.
Which developments are particularly critical for updates?
The Digital Omnibus on AI has applied since 27.07.2026 (Regulation (EU) 2026/1744). Data Act implementation, national NIS-2/BSIG specifics, CRA guidelines, Green Claims developments and authority practice should be monitored continuously. Political agreements, drafts or monitoring points must not be equated with law that is finally in force.
Interactive questionnaire
Create an industry profile
Answer the five steps. The results section then shows the legal load, risk level, focus areas, review points and documents for an initial engagement briefing.
Preliminary result
Your industry profile
The evaluation is shown after the questionnaire.
Reasons for the classification
Recommended next review points
Documents worth preparing
Copyable summary for your enquiry
Deadlines, risks, measures
Typical digital law fields compared across industries
The table is an orientation for digital business models. Whether a field applies in an individual case depends on role, product, users, data flows, countries and specific implementation.
| Field | Typical trigger | Status / deadline proximity | First measure |
|---|---|---|---|
| GDPR / TDDDG | Personal data, tracking, cookies, cloud, data breaches | Ongoing; data breaches usually to be assessed within 72h | Review records of processing, DPA, TOMs, privacy notices, consent and breach process |
| AI Act | AI systems, HR AI, scoring, chatbots, deepfakes, GPAI | Phased; prohibited practices and AI literacy already relevant; high-risk AI under Reg. (EU) 2026/1744 from 02.12.2027 or 02.08.2028 | Build an AI system register, role and risk classification, training records |
| Data Act | IoT, connected products, related services, cloud switching, data access | Largely applicable since 12.09.2025; data by design for new connected products since 12.09.2026 | Define data inventory, access concept, trade secret and GDPR gates |
| DSA / platform | Hosting, platform, marketplace, user content, moderation, advertising | Generally applicable since 17.02.2024 | Review role analysis, notice and action, complaints process and transparency obligations |
| NIS-2 / BSIG | Essential or important entities, sector involvement, supply chains, critical services | German implementation since 06.12.2025; keep reviewing national details | Prepare scoping assessment, management resolution, risk management and incident process |
| Cyber Resilience Act | Products with digital elements, software, hardware, OSS components | Reporting obligations since 11.09.2026; main obligations from 11.12.2027 | Build secure SDLC, SBOM, vulnerability disclosure and technical file |
| BFSG / Accessibility | E-commerce, apps, digital services, e-books, banking/telecom services, certain hardware | Applicable since 28.06.2025 | Set up accessibility audit, statement, complaints process and release gate |
| E-commerce / UWG | Checkout, subscription, cancellation button, withdrawal, prices, rankings, reviews, newsletters | Relevant immediately; EmpCo rules in the UWG apply since 27.09.2026 | Run shop/subscription legal QA with screenshots, button texts, price and cancellation logic |
| IP / Content / Reputation | Trademark, image, AI asset, UGC, press, reviews, social media, public visibility | Ongoing and often event-driven | Prepare chains of title, trademark/domain strategy, takedown and reputation plan |
Sensible next steps
Related ITMR checkers and follow-up reviews
Have your industry profile legally assessed
If several review areas carry high weight or a launch, audit, investor process, contact with authorities, platform conflict or reputational risk is coming up, ITMR can assess the specific review route on the basis of documents, data flows, contracts and goals.
Legal notice: this Industry Radar offers a structured initial orientation. It is not legal advice and does not replace a review of the specific individual case. Binding deadlines, obligations and measures must be reviewed on the basis of the current legal situation, the specific product, roles, data flows, contracts, countries and actual implementation. You can find an overview of our advice in the area IT law & digitalisation; cross-industry obligations are bundled in our EU Digital Acts Audit.