Legal basis
Art. 6 GDPR
Which one carries this processing, and can you state it in one sentence without looking anything up?
Late-night thoughts · Free checklist
DSGVO,
a lovely thing.
Most AI projects in Europe don't fail on the technology. They fail on the paperwork. The widget works. Then someone asks the legal questions six weeks after launch, and it all goes quiet.
Twenty-five questions, five areas. The ones I work through before I build anything. Updated for Art. 50 of the EU AI Act, which applies from 2 August 2026.
Get the checklist →What's in it
Five areas, five questions each. Every question is one you should be able to answer out loud, from memory, without opening a document. That constraint is the point. Each area ends with what a "no" actually costs you and a ten-minute first fix.
Terminal equipment
§ 25 TDDDG
Anything stored on or read from a visitor's device needs consent unless it's strictly necessary. Analytics and marketing tracking are not.
Processors
AVV / DPA
Every tool touching personal data needs a contract behind it, and you need to know which country the data sits in.
Transparency
Privacy notice
It has to describe what actually runs today, not what ran when the site launched.
Risk assessment
Art. 35 GDPR · DSFA
Mandatory wherever processing is likely to be high risk, and AI projects hit those triggers more often than not.
What it isn't
It isn't legal advice, and it doesn't pretend to be. It's the set of questions I ask from the builder's side of the table, before code gets written, because the expensive version of this conversation is the one that happens after launch.
Get the checklist
Here it is.
No email, no form, no funnel. Yours to print and mark up. If it saves you an awkward conversation later, tell me, and I will know it was worth writing.
Nothing is collected here. No address, no account, no tracking and no cookie for this download. That seemed like the right way round for a checklist about exactly that. What the site does store is in the Datenschutzerklärung.
Not sure where yours stands? Cheaper to ask now than to rebuild later.
Start the conversation