5,0/5 Google · 167 reviewsPeriod: October 2016 to date · As of: 28 October 2026

Legal risk assessment for digital projects

Decide before customers or authorities ask

AI feature, SaaS model, data access, service provider chain and contract architecture interlock? We assess the risks as lawyers and organise scope, priorities, red lines and evidence for your decision.

Enquire without details

The first contact is free of charge. We will expressly inform you in advance of any costs.

Response within 24 hours on working days

As of: 23 October 2026

Risk assessment · AI featureReviewedUnder review

Risk line3 of 5

Scope and role determined
Present
Risk axes separated
Present
Red lines marked
Check
Evidence for customer and audit
Present
Implementation in a specialist reviewseparate mandate
Missing

Point of review: Which regime sets the focus?

1Describe the triggerProject and decision
2Classify risksAxes and priorities
3Receive the planMatrix and measures

Schematic illustration. Simplified example.

We assess risks for

SaaS providers
Platforms
IoT manufacturers
IT service providers
Corporate groups

Key points at a glance

A legal risk assessment should enable a decision and put risks in order.
ITMR assesses digital projects, products, data models and contracts across IT law, data protection, AI, data law and cybersecurity.
You receive scope, risk matrix, priorities, red lines, line of evidence and action plan.
If the focus is already clear, we recommend the appropriate specialist review straight away.
Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.

SaaS: Software as a Service. Software used over the internet rather than installed.
DSGVO: The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
NIS2: EU directive on cybersecurity. It obliges many companies to carry out risk management and reporting.
Data Act: EU data regulation. It governs access to data from connected products and services.

Starting position

When does a risk assessment become necessary?

When a digital project has to be approved, negotiated, stopped or justified to third parties.

Risk questions arise when a decision has to be made and justified to a customer, investor, auditor, supervisory authority or management.

An AI tool, SaaS offering, platform process, data model or connected product is to go live, scale or be offered externally.

Enterprise customers, investors, auditors or procurement demand robust statements on risk, compliance, contracts, security and evidence.

AI, GDPR, NIS2, Data Act, DSA, contract risks and service provider management come together. Legal, data protection, IT and product assess the same facts differently.

A security incident, data breach, complaint or authority enquiry makes previous assumptions vulnerable.

For whom: Management, legal, data protection, IT, product
Subject: Projects, products, data flows, contracts
Result: Matrix, priorities, action plan
Implementation: Specialist review separately

Management needs a documented basis. Should the risk be accepted, reduced, allocated by contract, secured technically or should the project path be changed?

This means a lawyer's assessment of legal risks. General enterprise risk management, insurance questions, ESG reports or purely financial risk models are not included.

The IT compliance page is a better fit when roles, a map of duties, controls and permanent management are the focus. Risk management starts from the specific occasion.

Quick classification

Describe your project and decision using the form. We will get back to you on working days within 24 hours.

Process

How does the risk assessment work?

In three steps from the trigger to the action plan.

01
Describe the trigger
You describe the project, product, tool, contract, customer requirement, audit question, incident or decision. A short description of the situation is enough to get started.
02
Classify risks
We check which areas of law shape the case, such as IT law, data protection, AI, data law, cybersecurity, platform regulation or contracts.
03
Receive the plan
You receive an assessment of scope, risks, red lines, priorities, evidence and next steps, with a recommendation for a specialist review.

Which questions we clarify first

1What triggers the review?
Launch, customer evidence, due diligence, audit, incident, contact with authorities or contract negotiations create different risk profiles.
2What role does your company have?
Provider, deployer, platform, manufacturer, data holder, service provider or purchaser do not have the same duties.
3Which evidence is missing?
We see gaps in role decisions, approvals, contract annexes, service provider information and review records.
4Which points are critical?
What matters is external impact, deadlines, likelihood, extent of damage, feasibility, proximity to liability and provability.

How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.

Service

What do you have in hand at the end?

Service package: risk assessment

Scope decision
Which company, product, data flow, contract or process is the subject of the assessment?
Risk matrix
Which risks exist, how serious and how likely are they, and which assumptions underlie them?
Priority list
What must be clarified before approval, signing, a customer response, an audit or a management decision?
Red lines
Which constellations are legally untenable, tenable only with safeguards, or negotiable?
Line of evidence
Which documents should be ready for the customer, audit, investor, management or supervisory authority?
Action plan
Which contractual, organisational, documentary or technical steps take priority?

For whom: Companies with digital projects
First response: within 24 hours on working days
Costs: We tell you the costs transparently before you instruct us.
Not included: Implementation in specialist reviews, contract negotiations and administrative proceedings. On request, we take these on as a separate mandate.

Classify your risk question

Who delivers what and who decides

What you provide

Project, product or tool description
Data types and data flows
Contracts, T&Cs, DPA, SLA
Customer, audit or authority questions

What we take on

Scope and role determination
Risk matrix with priorities
Red lines and line of evidence
Action plan as a memo

Who decides

Your management decides on approval and risk acceptance
In a dispute, the supervisory authority or court

How does the engagement work?

1
First assessment
You describe your project and decision using the form. We assess which scope fits. The first contact is free of charge.
2
Offer
Before we start, we tell you the scope and costs transparently.
3
Court steps separately
We agree court proceedings, administrative proceedings and representation separately.

Risk areas

Where do the greatest risks arise?

At the interfaces between product, contract, data, security and liability.

Risk area	Typical occasion	What needs to be clarified
AI and automation	Tool approval, AI feature, enterprise customer	Classification, roles, transparency, human oversight, line of liability
Data protection and DPIA	Profiling, new technology, sensitive data	Legal basis, risk mitigation, technical and organisational measures, DPIA obligation
Cybersecurity and NIS2	Sector review, supply chain, incident	Applicability, responsibilities, security measures, reporting channels
Data Act and data models	Connected products, cloud switching, data access	Data types, access rights, trade secrets, contract clauses
Platforms and DSA	Hosting, marketplace, user content	Type of service, notice and complaint channels, moderation, transparency
IT contracts and service providers	SaaS, cloud, development, outsourcing	Service specification, SLA, audit rights, subcontractors, exit, liability

Typical mistakes

Where do companies build up unnecessary risk?

Four patterns we see in practice.

Pigeonholed too early

An AI project is treated only as a data protection issue, a SaaS risk only as a procurement question. Contract and liability questions remain open.

Assessment without a decision

Risks are collected but not prioritised. It remains unclear what is really needed before approval or an audit.

Evidence is created too late

Documentation only starts when a customer, auditor or authority asks. By then the line is harder to prove.

Contract and operations diverge

Commitments, service provider chains, data flows and security measures do not fit together.

Specialist pages

When is a specialist review a better fit?

If the focus is clear, a specialist page leads to implementation faster.

IT-Compliance

For roles, approvals, map of duties, audit readiness and ongoing management.

EU digital acts

For the scope review of the DSA, Data Act, AI Act, NIS2 and CRA.

Implementing the AI Act

For classification, provider and deployer roles, transparency and proximity to high risk.

NIS2-Betroffenheit

For sector review, entity type, management duties and reporting channels.

IT-Vertrag

For SaaS, cloud, development, outsourcing, SLA, audit rights and exit.

Data protection law

For DPIA, processing on behalf, transfers, data breaches and supervisory proceedings.

Legal framework

Which provisions require a risk assessment?

Under Art. 35 GDPR, a data protection impact assessment must be carried out if processing is likely to result in a high risk to data subjects. Art. 32 GDPR requires a level of security appropriate to the risk.

Under Section 30 BSIG, particularly important and important entities must take risk management measures. Under Section 38 BSIG, management is responsible for implementing and monitoring them.

The AI Act (EU) 2024/1689 links obligations to the risk class and the role as provider or deployer. Art. 6 governs classification as a high-risk AI system.

Under Section 1 StaRUG, managing directors must continuously monitor developments that could jeopardise the company's continued existence.

Sources

Art. 35 GDPR Data protection impact assessment.
Section 30 BSIG Risk management measures.
Section 38 BSIG Duties of management.
AI Act (EU) 2024/1689 Art. 6 high-risk classification.
Data Act (EU) 2023/2854 Data access and cloud switching.
Section 1 StaRUG Early crisis detection.

Limits

What does the assessment not cover?

Clear boundaries keep assessment and implementation apart.

1
No specialist review
If the focus is clear, a specialist review is faster. We agree this separately.
2
No management consulting
Financial risk models, insurance and ESG reports are not included.
3
No promise of outcome
We assess risks. How an authority or court decides remains open.
4
The decision remains yours
Your management decides on risk acceptance.

Key question for your company

Can you explain to a customer, auditor, investor, court or supervisory authority why this risk was accepted, reduced or allocated by contract?
The same tool must be assessed differently depending on role, data relevance, user group and contract situation.
The more clearly these points are visible, the more robustly risks can be prioritised.

Your contact

Dominik Skornia, LL.B.

Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer

View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124

At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.

Reviews

What clients say

5,0 von 5 · 167 Google reviewsPeriod: October 2016 to date · As of: 28 October 2026

5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026

“Clear and fast communication. My enquiry was answered quickly and competently, very professional manner, I can recommend without reservation.” (translated from German)

A. V. · anwalt.de (opens in a new tab) · 28.08.2020 · “Great lawyer! Excellent legal advice.” (translated from German)

“Fast response. I got an initial consultation at an extremely fair price with well-founded answers. For me, this was enough to continue confidently on my own. Excellent.” (translated from German)

Gudrun Brauer · Google

“Excellent advice & implementation in data protection and AI - highly recommended for startups.” (translated from German)

Matthias Frisch · Google

FAQ

What do companies ask about risk assessment?

When is a legal risk assessment by a lawyer useful?

When a decision has to be prepared, such as approval, launch, signing a contract, a customer response, an audit, due diligence or incident response. Especially when several areas of law may be affected.

How does risk assessment differ from IT compliance?

The risk assessment clarifies the specific case and what needs to be done now. IT compliance describes the permanent organisation of roles, duties, controls and evidence.

Do we receive a concrete risk matrix?

Depending on the mandate, we prepare the result as a risk matrix, priority list, management memo or action plan. What matters is that it can be used internally.

Can several regimes be reviewed together?

Yes. We separate which regime sets the focus and which points need to be considered alongside it.

Does the assessment help with customer or investor questions?

Yes. If an enterprise customer, investor or auditor demands robust statements, we prepare the answer so that it is legally sound and commercially tenable.

Do you also support implementation?

Yes, on request as a separate mandate, for example contract amendments, DPIA, AI Act, NIS2, Data Act or ongoing support.