Skip to content
DEEN

ITMR Risk Cockpit

Interactive risk matrix for digital legal risks

The Risk Cockpit helps companies classify digital legal risks in a structured way: business model, regulatory pressure, deadlines, evidence, control maturity and acute escalation signals are condensed into a preliminary priority.

Start check

GDPR / TDDDG AI Act Data Act NIS2 / CRA DSA / platforms E-Commerce

What this cockpit is for

The check is suitable for SaaS, cloud, platform, AI, e-commerce, software, app, IoT and data-driven business models. It does not replace an individual review, but shows where evidence should be secured, deadlines checked, documents prepared or governance measures prioritised immediately.

Visual classification

Risk heatmap with clickable and draggable priority marker

Click directly in the matrix or drag the marker. The manual position is used as likelihood and impact in the evaluation. Alternatively, the marker moves automatically based on your answers in the questionnaire.

Monitor Plan Prioritise Review immediately Impact / business and legal significance Likelihood / proximity to escalation low critical rare acute 0 Score 0 · Start

Process

How the risk matrix works

  1. 1
    Record the business model

    Define SaaS, cloud, AI, platform, shop, app, IoT or marketing model.

  2. 2
    Bundle areas of law

    Data protection, cybersecurity, AI, data access, consumer law, content and product compliance are considered together.

  3. 3
    Check proximity to escalation

    Running deadlines, contact with authorities, incidents, launches or audits change the priority significantly.

  4. 4
    Assess control maturity

    Documented processes, owners, evidence and technical controls reduce the residual risk.

  5. 5
    Derive next steps

    The result prioritises measures, documents and the appropriate reason to get in touch.

Initial orientation

What this check does

The Risk Cockpit is a structured preliminary review for digital business models. It condenses typical risk drivers from data protection, AI, Data Act, DSA, NIS2/BSIG, CRA, BFSG, product safety, e-commerce, advertising, content, IP and litigation readiness into a prioritised recommendation.

When is the Risk Cockpit useful?

It is useful when a digital product, platform, AI tool, shop, SaaS offering or data/cloud process needs legal prioritisation, especially before a launch, after an incident, on contact with authorities, during an investor/customer audit or when responsibilities are unclear.

What are the limits of the matrix?

The matrix does not replace an individual review. It only assesses typical risk signals. Whether a specific obligation applies depends on role, business model, target group, contractual situation, data flows, technical implementation and current practice of authorities and courts.

How are uncertain regulatory developments handled?

The Digital Omnibus on AI has applied since 27.07.2026 (Regulation (EU) 2026/1744). Update-critical points such as the Digital Omnibus on data and the GDPR, Data Act implementation, green claims developments or technical CRA guidelines are treated as monitoring topics. Binding deadlines are only presented as certain where they are reliable.

Interactive check

Select risk signals and calculate the priority

Answer the following steps. At least one selection is required per step. Multiple selections increase the score when several risk drivers apply at the same time. The matrix can also be set directly by clicking or dragging.

Step 1 of 5
Which digital business model should be classified?

Multiple selection is possible if several models coincide.

Deadlines and measures

Typical risk areas for digital business models

The matrix names standard deadlines only cautiously and always depending on the specific scope. For political agreements, drafts or developments not yet finally consolidated, monitoring is required.

Risk area Typical trigger Deadline / status First measure
GDPR data breach Personal data affected, security incident, misdirected mail, unauthorised access Supervisory notification usually to be checked within 72 hours; informing data subjects depends on the case Secure incident timeline, systems, data categories, number of data subjects, TOMs and service provider roles
Data subject rights / data protection requests Access, erasure, objection, data copy or complaint Response usually to be checked within 1 month Document identity, deadline, data sources, recipients, grounds for erasure and exceptions
AI Act / AI governance AI tool, chatbot, HR AI, scoring, deepfake, GPAI integration or provider role AI literacy and prohibited practices relevant since 02.02.2025; further obligations depend on role Start AI inventory, role definition, prohibition screening, data/copyright/GDPR review
Data Act Connected product, related service, cloud switching, data access or B2B data contract Generally since 12.09.2025; design requirements for new connected products since 12.09.2026 Set up data inventory, interfaces, contract clauses, trade secret and GDPR gates
NIS2 / BSIG and CRA SaaS, cloud, critical sectors, software product, vulnerability, security audit NIS2/BSIG in Germany since 06.12.2025; CRA reporting obligations since 11.09.2026, main obligations from 11.12.2027 Check applicability, incident runbook, SBOM, VDP, secure SDLC and management responsibility
E-commerce / BFSG / claims Shop, app, subscription, checkout, cancellation button, accessibility, advertising, green claims BFSG since 28.06.2025; EmpCo applies since 27.09.2026; consumer obligations ongoing Check checkout, cancellation button, legal texts, accessibility statement, claim dossier and evidence

Follow-up reviews

Sensible next steps

Related ITMR checkers and follow-up reviews for a more in-depth assessment.

Compliance RadarKeep track of regulatory obligations on an ongoing basis and structure responsibilities. Regulatory timelineClassify deadlines, start of application and monitoring topics for digital business models. Digital Business Model MapperMap business model, roles, data flows and legal interfaces cleanly. Legal Readiness ScoreAssess the maturity of documentation, contracts, processes and evidence. Document dossier builderSystematically prepare documents for a lawyer, audit, authority, customer or investor. Mandate navigatorDerive the appropriate next legal step from the risk result.

Have your risk prioritised

If deadlines are running, data is affected, a launch is imminent, customers or investors demand evidence or it is unclear which regulation applies, the assessment should not remain abstract. Send ITMR a short description, existing documents and the generated summary.

Get in touch

This checker provides structured initial legal orientation. It does not replace a review of the specific case, binding legal advice or a technical security review. Deadlines, obligations and risk levels may differ depending on role, business model, contractual situation, data flows, product architecture and current practice of authorities and courts. How we turn the risk assessment into a robust management tool is described on our page Risk management; further topics can be found under IT compliance.