Early problem detection
Internal reports enable violations to be identified at an early stage and countermeasures to be taken.
Reputation and trust
Companies that actively protect whistleblowers are perceived as responsible and enjoy greater trust among employees, customers, and business partners.
Reduction of liability risks
Proactive measures help avoid administrative fines, penalties, and damage to your image.
Open corporate culture
A whistleblower protection system creates transparency and promotes a culture of open communication.
Your advantages with our whistleblower protection system HintPilot
Our law firm offers you a comprehensive whistleblower protection system that meets all legal requirements and can be seamlessly integrated into your corporate structure. With our secure reporting channel HintPilot, we enable simple, confidential, and efficient processing of reports.
Lawfulness, fairness, transparency:
The processing of personal data must have a legal basis and be comprehensible to the data subjects.
Purpose limitation
Personal data may only be collected and processed for specified, explicit, and legitimate purposes.
Data minimization
Companies should only collect as much data as is necessary for the purpose for which it is intended.
Accuracy
Personal data must be accurate and kept up to date.
Storage limitation
Personal data must not be stored for longer than necessary.
Integrity and confidentiality
Companies must take appropriate security measures to protect personal data.
A central element of the AI Actis the risk-based approach, which classifies AI systems into different categories:
Unacceptable risk
AI systems that pose a threat to safety or fundamental rights are prohibited.
High risk
These systems are permitted but subject to strict requirements.
Specific AI systems
AI systems subject to special transparency requirements.
Your authorized representatives pursuant to Articles 22 and 54 of the AI Regulation
Secure access to the EU market. Minimize risks. Build trust.
Why is an authorized representative indispensable?
For providers based outside the EU – whether for a high-risk AI system or a general-purpose AI model – the appointment of a representative established in the EU is required by law in order to operate on the EU market. Without this key role, lawful market access is often not possible.
Our expertise for your safety
Authorized representative for providers of high-risk AI systems
As your company’s authorized representative, we take on all the tasks required by law, e.g.:
- Checking whether the EU declaration of conformity and technical documentation have been prepared
- Keeping contact details, declaration of conformity, documentation, and, where applicable, certificates – 10 years after placing on the market/putting into service
- Providing all information required for proof of conformity and automatically generated logs upon request by authorities
- Cooperating with authorities to minimise risk
- Acting as a contact person for authorities in all matters relating to ensuring compliance with the AI Act
Authorised representatives for general-purpose AI models
For providers of such models, we take on all tasks specified by EU legislators, e.g.:
- Checking whether the technical documentation has been created and whether the legal obligations are being complied with
- Keeping documentation and contact details – 10 years after placing on the market
- Providing all information required for proof of conformity to the AI Office or competent authorities upon specific request
- Cooperating with regulatory measures, even if your model is integrated into AI systems
- Acting as a contact person for authorities in all matters relating to ensuring compliance with the AI Act
The Data Act – A new legal framework for data access
With the Data Act, the European Union has set a milestone: From September 2025, far-reaching obligations regarding access to, use, and sharing of data will gradually come into effect. The aim is to make data more usable for innovation and competition – especially in the area of connected products and digital services.
For companies, this means new opportunities for data-driven business models, but also significant legal risks if requirements are not met.
The central challenge of implementation lies in the interplay between the Data Act and other legal acts of recent years, including the GDPR. The Data Act covers both personal data and non-personal data.
Resolving this conflict poses enormous challenges for those affected by this legal act in times of complex data structures:
- What precautions must controllers take to enable the transfer of data?
- What technical and legal foundations must be in place before customers and other third parties can assert their rights?
- How can controllers themselves benefit from the Data Act?
What companies should do now
Implementing the Data Act requires more than just reviewing individual legal cases. Holistic strategies are needed that bring together technology, contracts, and other essential components of implementation. These include:
- Establishing secure interfaces for data use and transfer
- Adapting contractual clauses in light of new fairness requirements
- Developing integrated compliance concepts that combine the GDPR and the Data Act
- Identifying opportunities for new data-driven business models
NIS2 – Are you well prepared?
The EU Directive NIS2 (Network and Information Security Directive) is on everyone’s lips – and with good reason. It will reshape the rules for cybersecurity across Europe, aiming to strengthen resilience and safeguard digital infrastructures. Germany missed the implementation deadline in October 2024. However, following the government draft resolution in July 2025, the NIS2 Implementation Act (NIS2UmsuCG) is expected to come into force at the end of 2025 or beginning of 2026.
IS2 will apply to far more companies and public bodies than before, requiring strict compliance with binding minimum standards for IT security, risk management, and incident reporting.
At the very least, organizations should promptly assess whether they fall within the scope of NIS2. Given the complexity of the new obligations, entities likely to be affected are strongly advised to conduct a gap analysis well before the NIS2UmsuCG comes into force – and to initiate necessary measures early to meet the heightened requirements.
