- Home
- Suite features
- Quick check (self-assessment)
The quick check: a structured self-assessment, regime by regime
For US and other non-EU companies, the quick check opens the Regingada Compliance Suite: an EU compliance self-assessment of thirteen questions on the Digital Services Act (DSA), the AI Act and the GDPR about your role, establishment and features. It records the facts and indicates the provisions they point to; it does not apply the law to your case.
- DSA · 5 questions
- AI Act · 3 questions
- GDPR · 5 questions
- NIS2 · DMA · Data Act · PIPL · no quick check
- Art. 3(2) GDPR · not tested
What should an EU compliance self-assessment capture?
For a company outside the Union, three facts carry most of the weight: the role you play, whether you are established in the EU (an office, branch or subsidiary, for example), and what your service or system does. The quick check asks for those facts per regime, in the statute's vocabulary, and keeps them as a profile the rest of the suite reads.
A regulatory scoping questionnaire in a spreadsheet stops at the answers. Here each answer is tied to provisions (nodes) of the EU digital law map and fills the per-regime obligation lists the suite calls cockpits.
From the legal notice to a saved profile
Open /suite/. On a first visit:
- Accept the legal notice. 'Legal Notice & Disclaimer (Step 1: Orientation)' states that the suite gives no legal advice. Tick the box, then 'Accept & Continue'.
- Choose a regime card. On the welcome screen, DSA, AI Act and GDPR open their quick check; DMA and NIS2 open their cockpit directly. The Data Act card does not respond: pick another card, then use the sidebar.
- Answer step by step. The dialog counts 'Step 1 of 3', and tooltips name the article behind each legal term.
- Save. 'Save profile ✓' on the last step writes the profile. Closing it earlier (×, Esc, a click outside) returns you to Home and keeps the answers for that tab.
- Add the other regimes. The saved answers build what the suite calls your Digital Twin. In the sidebar, an unanswered 'DSA Twin', 'AI Act Twin' or 'GDPR Twin' opens its quick check; once one regime is saved, #dsa, #ai-act and #gdpr work as deep links.
What the answers produce, regime by regime
| Quick check | Articles the questions draw on | What the answers produce |
|---|---|---|
| DSA self-assessment · 5 questions | Art. 2(1), 3-6, 13, 26-28, 30-33 DSA | One service in the DSA portfolio with a tier (none if you answer 'No' on EU users); the Art. 13 section follows the establishment answer |
| AI Act self-assessment · 3 questions | Art. 3(3)-(4), 5, 6(1)-(2), 50, 51, Annex I and III AI Act | One portfolio system per ticked type except 'minors as target group', each with a tier chip |
| GDPR self-assessment questionnaire · 5 questions | Art. 4(1), 6(1)(a), 7, 9, 22, 27 GDPR | Flags that bring obligation items into the GDPR cockpit |
| Map footprint | Curated DSA, AI Act and GDPR provisions | Up to 38 DSA, 46 AI Act and 91 GDPR nodes highlighted in a twin's 'Graph' or 'Split' tab |
Establishment does the most work
For a company outside the EU, the establishment answers reach three appointment regimes: Art. 13 DSA, Art. 27 GDPR and the AI Act authorised representative — Art. 54 for general-purpose AI models since 2 August 2025, Art. 22 for high-risk systems from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Regulation (EU) 2026/1744.
What does 'Unsure' do to the result?
'Unsure' is saved as an open answer, and the suite reads it in a fixed way: no map node, the related GDPR obligation items shown, an unsure AI Act role counted as provider, an unsure establishment hiding the representative items. 'Theo' in the label 'Unsure — Theo will clarify under engagement' refers to the law firm Theo Funk.
- GDPR Art. 9, Art. 22, consentRead conservatively: the related obligation items appear, and with Art. 9 or Art. 22 GDPR the data protection impact assessment (DPIA, Art. 35 GDPR) too.
- EstablishmentCounts as EU in the DSA and the AI Act; sets no Art. 27 GDPR item.
- DSA service typeNot read conservatively: it can seed the lowest tier, mere conduit.
- AfterwardsFor the AI Act and the GDPR, the German-language email draft to the law firm that the Client Workflow opens in your mail program lists it as 'unsicher'; it leaves your device only if you send it. DSA answers are not copied. The obligation applicability statement marks each obligation that turns on it 'unclear'.
A hypothetical US hiring-software company
Company H is hypothetical: a US company with no EU office that sells hiring software to employers in Germany and France, with its own ranking model and an applicant chatbot.
AI Act. Provider; outside the EU; 'Annex III high-risk area' and 'Chatbot / human-AI interaction'. The portfolio gains a High-Risk and a Limited-Risk (Art. 50) system, the map marks 25 nodes, and a banner 'Authorised Representative required (Art. 22 AI Act)' appears, worded in the present tense: under Regulation (EU) 2026/1744, Art. 22 AI Act applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
GDPR. Personal data: yes. Special categories and automated decisions: Unsure. Established outside the EU with EU-market processing: yes. Consent: no. The cockpit lists Art. 9 and Art. 22 GDPR, the Art. 35 DPIA item and the Art. 27 GDPR representative item; the map marks 76 nodes, none from the open answers.
DSA. Whether storing applicants' CVs for employers is hosting under Art. 3(g)(iii) DSA is a question the service-type step lets Company H answer 'Unsure' — and then the seeded service sits in the lowest tier.
Not settled by any of this: whether the Art. 27(2) GDPR exemption fits, and whether the ranking model falls under Annex III point 4(a) and, if so, whether the Art. 6(3) AI Act derogation takes it out of the high-risk category. Complete fictional profiles are in the model cases.
The limits, stated plainly
- 'Hosting service' or 'Unsure' on the DSA service-type step, without the 'User uploads' or 'Marketplace' feature, seeds mere conduit (Art. 4 DSA), so Art. 16 and 17 DSA do not show; only the sector 'Cloud / storage' in the DSA portfolio gives the Hosting tier.
- 'Other role' (importers, distributors) fires no role-specific AI Act duty — not Art. 23 or 24, nor the provider or deployer duties — yet the seeded systems display 'Provider'.
- 'Unsure' is not offered everywhere: the personal-data question has none, the platform threshold offers 'Unknown', and the DSA feature and AI Act system steps require a tick, with no 'none of these'.
- No question on transfers under Art. 44 et seq. GDPR.
- '45 million or more' for a platform seeds it as designated, although designation is a Commission decision under Art. 33(4) DSA.
Frequently asked questions
What questions are in the compliance self-assessment questionnaire?
Thirteen. DSA: EU users, establishment, service type, the Art. 33(1) threshold of 45 million average monthly active recipients, nine features. AI Act: role, establishment, twelve AI-system types. GDPR: personal data, Art. 9 special categories, Art. 22 automated decisions, the Art. 27 establishment question, consent as a legal basis. None asks for a name or an email address.
Does a self-assessment replace a legal review?
No. The quick check records facts and indicates the provisions they point to; whether a provision applies to you turns on legal questions it does not answer, and the dialog's own notice says legal advice comes separately. The law firm Theo Funk can assess your case under a separate mandate; for a range of internal effort, use the EU exposure estimate.
Where are my quick-check answers stored?
In this browser only: the quick check writes your answers to local storage, sends nothing to a server and needs no account. Clearing the site's data removes them. What other parts of the suite can transmit, and when, is set out in the Trust Center.
Can I change or delete my profile later?
You can delete it; changing a saved answer means deleting and starting again. Settings → 'Manage profile' → 'Delete profile' removes, after confirmation, the profile, the portfolios, open drafts and your acceptance of the legal notice. 'Edit profile' reopens the welcome screen, where only an unanswered regime opens a quick check. Systems and services can still be added or removed by hand in the AI Act and DSA cockpits.
Why is there no quick check for NIS2, the DMA or the Data Act?
They are scoped inside their cockpits instead: NIS2, the EU cybersecurity directive, in an entity portfolio read against Art. 3 NIS2; the Digital Markets Act (DMA) in a portfolio of core platform services read against Art. 3 DMA; the Data Act and PIPL, China's Personal Information Protection Law, in an actor portfolio. The DMA and NIS2 welcome cards open their cockpit; the Data Act and PIPL open from the sidebar once you are past the welcome screen.
The facts are yours, the reading is a lawyer's
An EU compliance self-assessment stops at the facts. The quick check cannot say whether selling to people in the Union is offering goods or services under Art. 3(2)(a) GDPR, or whether putting your name on, substantially modifying or repurposing a bought-in AI system makes you the provider of a high-risk system under Art. 25(1) AI Act. The law firm Theo Funk can assess that reading, and any 'Unsure' that turns on a legal question, under a separate mandate.
Where the profile flags a possible appointment duty, Regingada UG (haftungsbeschränkt) can hold the representative role under its own contract; it builds the software, is not a law firm and gives no legal advice. See EU representative for US companies and the representative fees. Neither contract requires the other.