The regulatory environment for digital services in the EU has undergone a fundamental transformation in recent years. GDPR, the AI Act, the Data Act, Data Governance Act, DSA, DMA, and NIS2 form a dense web of obligations that affect virtually every company working with data, algorithmic decision-making, or an online platform. Our role is to help clients navigate this web and make business decisions with full awareness of legal risk.
The practice is led by Marek Poloni, who, alongside transactional law, has long focused on data and AI law. He regularly lectures on the AI Act and its impact on Czech business for companies, professional associations, and internal client training. As a result, he can explain regulation to non-technical audiences and operationalize it into concrete steps.
For clients we follow three typical steps: (1) risk classification and gap analysis — what you specifically must comply with and what you don't, (2) operationalization — contracts, internal policies, records of processing, DPIA, (3) roll-out and training — so that people in the company know what to do. We use this approach for both GDPR and the AI Act.
For AI development agreements and data licensing, we address sensitive questions: who owns the training data, who owns the outputs, who's liable for model errors, how to set SLAs for probabilistic systems. We also guide clients through standards in areas like fine-tuning, RAG architectures, open-source models, or use of third-party foundation models.
Practice led by
Marek Poloni · partner