IT law & digitalisation: all practice areas at a glance
For companies in digital transformation – keeping IT projects, contracts and digital regulation in view. Your lawyer for IT law & digitalisation at ITMR supports IT projects, contracts and regulation.
IT law & digitalisation for companies with digital business models
ITMR Rechtsanwälte classifies digital projects once a project has become legally relevant but it is still open which focus actually drives the case.
In practice, the right route is usually decided between contract, AI, data protection, data law, cybersecurity, compliance, open source or e-commerce.
- Software, SaaS, cloud and platforms
- AI, automation and AI Act pressure
- Data access, GDPR and governance
- IT security, NIS2 and incident response
Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)
Quick start: what is your matter about?
The most important routes
Contract, AI, data, security, distribution.
Typical mandates
Where digital mandates begin.
Clarify the direction of the case
IT law, data law, AI, cybersecurity.
Implementation routes
Directly to the appropriate deep dive.
Your contact: Jean Paul P. Bohne, LL.M., MM
Partner, certified specialist lawyer for IT law and for copyright and media law (Fachanwalt für IT-Recht, Fachanwalt für Urheber- und Medienrecht).
What happens after your enquiry?
After your enquiry, we get back to you within 24 hours on working days. The first contact is free of charge. You will be informed explicitly before any costs are incurred.
- A short description is enough. Describe the project, schedule and systems affected. Contracts, data flows and deadlines are helpful.
- Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
- Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.
Typical cases from our practice
The following scenarios are abstracted and simplified. Which solution holds up always depends on the specific facts and the contractual situation.
Go-liveSaaS or platform launches
- Starting point
- A product is to go live. Customer contracts, AGB (general terms and conditions) and privacy notices must be in place for the launch.
- Key difficulty
- Contracts and data protection are open. It is often unclear whether contract law, data protection or e-commerce drives the case.
- Our work
- We clarify the leading route. We then review the contracts and deliver a prioritised list of redlines.
- Work result
- A robust go-live with AGB ready for approval and notes on integration into the website and checkout.
Simplified example.
IncidentSecurity incident
- Starting point
- An incident is noticed. Systems or personal data could be affected.
- Key difficulty
- The reporting deadlines are running: 72 hours for reporting the data breach to the supervisory authority, and for NIS2 entities the reports to the BSI (Federal Office for Information Security) under Section 32 BSIG (24 hours, 72 hours, one month).
- Our work
- We manage cybersecurity and data protection. We coordinate service providers, insurers and customers and prepare the reports.
- Work result
- An orderly response: a documented situation report, reports filed on time and a basis for later recourse questions.
Simplified example.
Typical constellation from practice
Approving an AI feature
- A typical scenario:
- An AI feature is to go into operation.
- The critical point:
- Roles under the AI Act are unclear.
- Our work:
- We classify AI law and implementation.
- Result for the business:
- A documented approval.
Typical scenario for illustration, not a specific mandate.
What you will have at the end
| Service | Concrete result | Next step |
|---|---|---|
| Contract: software, SaaS, cloud | Prioritised list of redlines; clarity on liability, security and exit | Send contract drafts |
| AI: AI law and AI Act | Basis for measures, responsibilities, AI governance and evidence | Describe the intended use |
| Data: GDPR and data law | Audit findings, risk assessment and action plan | Outline the data flows |
| Security: cybersecurity and NIS2 | Management memo and registration; in the event of an incident, a documented situation report and reports to authorities on time | State the incident and its time |
| Distribution: e-commerce | AGB ready for approval with notes on integration into the website and checkout | Send the shop and any Abmahnung (formal warning letter) |
The most important routes in the main area
Classification of the main area
Digital mandates often start broadly but must quickly be handled precisely. What matters is therefore which legal question sets the pace commercially and operationally.
The right route for software contracts, SaaS, cloud, IT projects, provider changes, outsourcing and project-related escalations.
When AI systems, the AI Act, governance, questions of roles, liability, training, outputs or product-related AI decisions are the focus.
For the GDPR, data subject rights, dealings with authorities, data breaches, processing on behalf, DPIAs and operational data protection organisation.
When data access, data use, cloud switching, contractual fairness, IoT and platform data or the Data Act form the commercial core.
For IT security, incident response, security organisation, liability, reporting channels and organisationally complex crisis situations.
When governance, legal registers, audit readiness, evidence logic and management responsibility tie several digital topics together.
Further reading:
Check your situation yourself first
With these checks (in German) you can assess your situation yourself in advance. The result does not replace legal advice, but it shows where you should take a closer look.
AI Act initial check
Classify your AI systems by risk, role and obligations under the AI Act.
AVV/DPA check
Check whether your data processing on behalf (AVV, data processing agreement) is properly regulated by contract.
NIS2 check
Check whether you are affected, your registration and your obligations under NIS2.
The basics explained clearly
These articles (in German) explain the basic concepts of this area and remain valid beyond individual decisions.
AI Regulation (AI Act): what you need to know
You receive an overview of the structure, risk classes and obligations of the AI Regulation.
The Digital Services Act
The article explains who the DSA covers and which obligations apply to online services.
The Digital Markets Act
This is about what the DMA requires of gatekeepers and what this means for business customers.
Contact forms and the GDPR: obtaining consent correctly
It shows when a contact form requires consent and what the notice text and mandatory fields should look like.
Reporting a cyber incident: deadlines under NIS2, GDPR, DORA + CRA
The comparison shows who must report an incident, when and to whom.
When you need us
Typical concerns
Which practice area drives your case? The six most common starting situations:
Contract & product
Software, SaaS, cloud or IT project
Contracts, acceptance, SLA, project disputes → IT law
AI & automation
AI feature or AI product
Roles under the AI Act, approval, liability → AI law
Data & GDPR
Personal data
GDPR, access requests, AVV (data processing agreement), third countries → Data protection law
Data Act & governance
Data access and the Data Act
IoT data, cloud switching → Data law
Security & crisis
Security incident or NIS2
Reporting obligations, management liability → Cybersecurity
Distribution & market
Shop and platform distribution
AGB, checkout, risk of Abmahnungen → E-commerce
Where interfaces help decide the direction of a case
Typical misallocations
Digital mandates rarely lose momentum because of a single open legal question. More often, a wrong focus slows them down. That is exactly why it pays to distinguish neighbouring routes early.
IT law is not automatically data protection law
Many projects process personal data without the GDPR forming the commercial core. Only when legal bases, data subject rights, supervision, data breaches or processing structures dominate does the case belong primarily under data protection law.
Data law is not just data protection in new clothes
Data Act questions concern data access, sharing, contractual fairness, exit mechanisms, platform and product data. Those who treat this level hastily as a mere GDPR question often classify the case too narrowly. In that case, data law will help further.
AI law is more than just the AI Act
Contracts, data, open source, copyright, advertising claims and product liability can also form the core of a project. Artificial intelligence is therefore the overarching route. Implementing the AI Act / AI Regulation is the narrower implementation route.
Cybersecurity is not just technology
With security incidents, service provider chains, duties of corporate bodies, audit readiness or registration obligations, IT security becomes a governance question. In that case, cybersecurity, IT compliance and, where applicable, NIS2 implementation should be considered together.
Important specialist routes and implementation routes
Deep-dive paths
Not every mandate needs a broad classification. If the case has already been narrowed down, the direct route to the more precise page usually saves time, friction and unnecessary rounds of coordination.
Overview
IT contract / software contract
For contractual classification when it is not yet clear whether development, licence, SaaS, maintenance or outsourcing is the focus.
When licence chains, GPL, AGPL or MIT questions, chain of title, notices, recourse and due diligence are decisive.
For auditable approvals, evidence logic, SBOM-related questions and operational compliance structures in software companies.
When the question of principle has already turned into concrete pressure to act in contracts, access concepts, product logic or exit structures.
EU Digital Acts Audit
When the AI Act, Data Act, DSA, DMA, DGA (opens in a new tab) or other digital laws need to be classified and prioritised as an overall scope.
For contentious GDPR situations, damages, pressure from authorities and court disputes relating to data protection.
For liability for defective software and digital products, the new EU Product Liability Directive, recalls and recourse.
Why early classification is commercially decisive in a digital mandate
Strategic benefit
The earlier the legally decisive focus is clearly established, the better loss of time, duplicate loops and unnecessary project costs can be avoided.
- Contracts become more precise when it is clear whether primarily performance, data access, AI governance, security or distribution must be regulated.
- Companies avoid friction between product, IT, purchasing, compliance, data protection, legal and management.
- Narrower specialist routes can be activated in a targeted way without the case initially remaining too broadly framed.
- In digital business models, the right route often prevents the most expensive loop: the late correction of a wrong initial classification.
Further reading:
Official reference points for key digital rules
External orientation
Those who want to classify the basics of a digital mandate using reliable primary sources will find useful official entry points here. These links do not replace an examination of the case, but they help with initial orientation.
AI Regulation / AI Act
Official text of the regulation on EUR-Lex on roles, obligations, high-risk and transparency questions.
GDPR
Official entry point for legal bases, data subject rights, processing on behalf, transfers and data protection organisation.
Data Act
Official information page of the European Commission on data access, data use, contractual fairness and cloud switching.
BSI on NIS2
Official entry point of the BSI (Federal Office for Information Security, in German) on whether you are affected, organisational obligations, registration and security requirements.
Your contacts for digital law
Trust & specialisation
For IT contracts and IT projects, our Fachanwälte für IT-Recht (certified specialist lawyers for IT law) are available to you. More on the IT law page.
Data law, digital regulation, IT compliance
Fachanwalt für IT-Recht · Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for IT law · for copyright and media law)
Data protection law, e-commerce
Partner · Fachanwalt für IT-Recht
Cybersecurity, NIS2
Partner · Fachanwalt für IT-Recht
AI law, AI Act
Rechtsanwältin (attorney) · AI law
Key terms
- IT law (IT-Recht)
- The law of software, contracts and digital products.
- Data law
- The law of data access and data use, for example under the Data Act.
- AI Act
- EU regulation on artificial intelligence.
- NIS2
- EU rules on the cybersecurity of entities.
These terms explain the language used on this page. What matters is always the specific individual case.
Provisions and reliable sources
The following statutory provisions and regulations are cited on this page.
| Provision | Content | Practical significance |
|---|---|---|
| Implementing the AI Act: advice | EU regulation | Roles, obligations, high risk and transparency. |
| GDPR | General Data Protection Regulation (DSGVO) | Legal bases, data subject rights, transfers. |
| Data Act | EU Data Regulation | Data access, contractual fairness, cloud switching. |
| NIS2 | EU directive on cybersecurity | Organisational obligations and registration. |
Articles on IT law and digitalisation
These articles (in German) explore topics that currently shape digital projects in companies.
Drafting contracts in IT law – what needs to be considered?
The article shows what matters in IT contracts, from the service description to liability and rights of use.
Access by design: design obligation under the Data Act
It explains the Data Act's design obligation for connected devices, which has applied since 12 September 2026.
New Product Liability Act: software, SaaS, AI from 9 December 2026
This is about the fact that software, SaaS and AI systems count as products from 9 December 2026 and providers can be liable regardless of fault.
Cyber Resilience Act: reporting obligations under the CRA from 11 September 2026
The article classifies the reporting obligations of the Cyber Resilience Act for manufacturers of digital products from 11 September 2026.
Frequently asked questions about IT law & digitalisation
Short answers
The most common misconception is that digital projects can be clearly assigned to a single area of law from the outset. In practice, the actual clarification often begins at precisely this point.
Who is this page for?
For companies whose digital project touches several areas of law. Here you will find the right practice area.
I need a Fachanwalt für IT-Recht (certified specialist lawyer for IT law). Am I in the right place?
For software, SaaS and IT project contracts as well as disputes in IT projects, go directly to IT law.
Is data law the same as data protection law?
No. Data protection law concerns personal data under the GDPR. Data law concerns data access and data use under the Data Act.
When should I go directly to a service package?
When the task is clear, e.g. implementing the AI Act, the Data Act or NIS2. In that case, the service package gets you there faster.
The earlier the legal focus is clear, the sooner go-live, audit, tool use or a crisis can be managed reliably
If your mandate is digital in nature and decisions on contract, AI, data, security, compliance or distribution are now pending, the leading route should be clarified first. This creates clarity for the next steps and prevents a relevant project from being handled under the wrong heading for too long.
ITMR Rechtsanwälte PartGmbB, Düsseldorf & Hamburg
Legal status: 23 October 2026. This overview provides initial orientation and does not replace a review of the specific case.
Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)