IT Compliance
We help IT, SaaS and technology companies identify which obligations actually apply to them, what needs fixing, and how to demonstrate compliance to investors, customers or regulators.
Where to start
The initial call is free. A standalone legal task starts from CZK 5,000 excl. VAT; for AI Act / NIS2 audits we agree scope, deliverables and price before we begin.
Typical situations
You use AI in your own product, internal workflow or customer service. You need to distinguish between an ordinary tool, a GPAI model and a high-risk system.
In a tender, due diligence or enterprise sale you need to demonstrate security, incident response, supplier management and management accountability.
A data breach, ransomware attack or service availability failure has occurred. You need to know who to report to, by when, and what to communicate.
You supply ICT services to a financial institution, or you fall within a regulated environment yourself. Outsourcing contracts and audit rights must comply with DORA.
Training data, prompt logs, DPIAs, transfers outside the EU and processor roles start to converge. You need documentation that will stand up to scrutiny.
Compliance is not just a technical checklist. For NIS2, incidents and security measures we also address the liability of the statutory body.
Practice
AI Act audit and AI system classification
NIS2 gap analysis and management accountability
DORA and ICT outsourcing contracts
DPIA, data transfers and advanced GDPR
Incident response and regulatory reporting
Compliance documentation for due diligence
The goal is not to create a folder full of paperwork. The goal is to know what you need to do, what to document, and where the real legal risk lies.
Process
We map the product, data flows, suppliers and regulatory triggers. We separate the obligations that are real from those that do not apply to you.
We list specific gaps: contracts, internal policies, documentation, DPIA, incident response, responsibilities and approval processes.
We prepare contract amendments, policies, decision records and client-ready deliverables for investors, enterprise customers or regulators.
From practice
AI Act
A technology firm wanted to deploy an AI module in its customer workflow. The question was not academic — it was whether the product would pass enterprise procurement. The output was a classification, a map of obligations and a list of documentation changes.
NIS2 / incident
The company had a technical incident response plan but lacked a legal decision point. We defined responsibilities, escalation rules and contractual communication with key customers.
Let’s solve it
Call or write to us. The first conversation is always about understanding your situation — not about selling.
Our legal services are governed by our general terms and conditions unless otherwise agreed.