Sub-Practice Regulatory &
Compliance.

It depends on what your business does, not its size. A DPO is mandatory where core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special categories of data such as health or biometric information — public authorities also require one regardless of scale. Many businesses that fall short of the mandatory threshold still benefit from appointing one, or from an external, part-time equivalent, because it gives the Hellenic Data Protection Authority a documented contact point and signals a functioning compliance programme. We assess the requirement against your actual data processing activities rather than a generic checklist.

The AI Act applies broadly to anyone who develops, deploys or distributes AI systems used in the EU, with obligations that scale with the system's risk classification. Prohibited practices are already banned. Obligations for high-risk AI systems and for general-purpose AI models are phasing in on a fixed timetable running through 2026 and beyond. Many businesses are surprised to learn a tool they use for recruitment screening, credit scoring or biometric identification qualifies as high-risk. We classify your specific use cases against the Act's categories rather than assuming a blanket answer.

NIS2 significantly widens the net. The original NIS Directive mainly targeted core infrastructure — energy, transport, banking and similar operators. NIS2 extends mandatory cybersecurity risk-management and incident-reporting obligations to a much broader list of sectors, including digital providers, manufacturing, postal services, waste management and public administration, categorised as "essential" or "important" entities depending on sector and size. A company that was comfortably outside scope under the old regime may now be squarely inside it. We run the sector-and-size assessment against the current thresholds rather than relying on how the business was classified before.

The Digital Services Act applies tiered obligations to intermediary services, hosting services, online platforms and online marketplaces operating in the EU — the specific duties that apply depend on which category your service falls into and its user base, not only whether you are a "Very Large" platform. Marketplaces carry additional trader-traceability and product-safety-related duties. If your business operates any kind of online platform, marketplace or hosting service reaching EU users, it is worth confirming exactly which DSA obligations apply rather than assuming the rules are only for the largest tech companies.

For most clients, it sits naturally within the Outsourced General Counsel retainer. Because our technology law expertise already covers EU AI Act, NIS2, DSA and emerging regulation, regulatory compliance advice is integrated into the ongoing retainer rather than treated as a separate engagement — the same way commercial contracts or employment questions are handled as they arise. Larger, standalone projects — a full GDPR compliance programme build-out, or a NIS2 gap assessment across multiple entities — are usually scoped and quoted separately given the volume of work involved, but the ongoing maintenance of that programme then folds back into the retainer.