Checklists
Auditable step-by-step checklists for compliance and delivery — each with a clear section on what it does not cover.
EU AI Act conformity: a checklist for the first pass
A workable first pass through the EU AI Act has six parts: know which AI runs in the business, determine your role for each system, classify under Article 6, check transparency duties separately, ensure AI literacy, and file everything so it can be found under scrutiny.
7 items
High risk or not: reasoning an Annex III classification properly
High-risk classification follows a fixed order: first the deployment area under Annex III, then whether the system plays a substantive role in the decision, then the exemption in Article 6(3). Each of those steps has to be documented with reasoning.
7 items
AI literacy under Article 4: from intention to evidence that holds
Article 4 asks for measures to support AI literacy, measured against role, context and the people affected. It becomes workable in four moves: form roles, set a depth per role, train accordingly, and record attendance with date, content and the link to the role.
7 items
GDPR for SaaS: what has to stand before your first enterprise customer
Six areas are unavoidable for a SaaS product: a legal basis per processing activity, a maintained processing register, data subject rights implemented in the system, a deletion concept that actually works, clean sub-processor chains, and a demonstrable statement on data residency.
7 items
Reviewing a data processing agreement: what to look for before signing
Six points decide a DPA review: subject matter and instruction binding, the sub-processor chain and your right to object, place of processing, assistance with data subject rights, the breach notification route, and what happens to the data when the contract ends.
7 items
Technical due diligence: what can be established in a few days
Technical due diligence under time pressure concentrates on six questions: does the architecture carry the planned growth path, how large is the technical debt, does the system depend on individuals, how do security and licensing stand, and can operations be handed over.
7 items
Technical SEO review: the points that actually block indexing
Most technical SEO problems trace back to a handful of causes: pages are not indexable, canonicals point elsewhere, the sitemap lists pages that should not be indexed, hreflang is not reciprocal, or pages carry almost no internal links.
8 items
Visibility in AI answers: a checklist for being citable
Being citable in AI answers rests on a few properties: a short self-contained answer near the top, unambiguous statements instead of marketing language, verifiable claims with a date and an author, clean access for AI crawlers, and identifiable authorship.
8 items
MVP launch: what has to stand before your first paying customer
Five things have to stand before an MVP launch: a working payment path, a data model that permits later change, a route to delete accounts, a way to learn that something has broken, and basic legal documents. Everything else can wait.
7 items
Preparing a cloud migration: the questions before anything moves
Cloud migrations rarely fail on technology; they fail on preparation. Unknown dependencies, unresolved data classification, a cost model that only becomes visible after the move, and missing acceptance criteria against which success could be measured at all.
8 items
Replacing a legacy system: the groundwork that decides the outcome
Legacy replacements usually fail on three things: undocumented business logic nobody understands any more, data quality that only surfaces during migration, and a missing switch-off date, which leaves both systems running in parallel indefinitely.
7 items
Choosing a software partner: what to settle before you commission
Choosing a software partner is decided less by references than by four contractual points: who owns the result, who holds access to the systems, what a handover looks like, and what happens when the engagement ends.
8 items
Website relaunch checklist: protect your visibility
A relaunch without ranking loss takes seven steps: a URL inventory from Search Console and a crawl, a redirect plan per URL, a locked staging environment, carrying over ranking content, clean canonicals and structured data, a controlled go-live, and follow-up checks over several weeks.
7 items
revFADP checklist for Swiss SMEs
A Swiss SME implements the revFADP in eight steps: capture data flows, determine obligations, review providers and contracts, safeguard international transfers, align the privacy policy with reality, define data security, and rehearse procedures for data breaches and access requests.
8 items
Checklist: reporting to the Swiss transparency register (TJPG)
A TJPG report works in eight steps: confirm the reporting duty per entity, establish the applicable deadline, derive beneficial owners under Article 4 TJPG, verify their identity, document the derivation, file via EasyGov, define triggers for change reports and reconcile the register report with bank and company records.
8 items
Checklist: Swiss AMLA coverage for advisers since 1 October 2026
Advisers settle AMLA coverage in eight steps: map activities with a concrete legal transaction, assess coverage with reasons, secure deadlines, choose an SRO and read its regulations, define a risk method, turn due diligence duties into processes, set up filing and an audit trail, and train staff.
8 items
Checklist: making an LLM feature production-ready
An LLM feature is production-ready when error costs are known, an evaluation set measures quality, the architecture limits prompt injection, data flows are contractually secured, a fallback exists, cost per use is capped, monitoring runs, human oversight is defined and the AI Act classification is documented.
8 items
Checklist: data breach — the first 72 hours
After a data breach: contain immediately, secure facts and timing, form a decision team, assess the risk to data subjects, notify the FDPIC as soon as possible where risk is high and, under the GDPR, the supervisory authority within 72 hours, inform data subjects where needed, involve processors and document everything.
8 items
Checklist: security before a SaaS launch
Before launching a SaaS product, eight points must hold: tested tenant isolation at data level, secure authentication with multi-factor, secrets outside the code, up-to-date dependencies, backups with tested restoration, logging of security events, abuse protection and a prepared process for security incidents.
8 items
Checklist: an AI usage policy that people actually follow
An effective AI usage policy sets out, briefly and clearly: which tools are approved, which data may go into them and which may not, that people check and own outputs, when AI use is disclosed, how new tools are approved, what training exists, how incidents are reported and when the policy is reviewed.
8 items
Checklist: vetting AI vendors and AI features before use
Before using an AI service, clarify ten questions: is your data used for training, where is data processed, how long are inputs stored, is there a data processing agreement, how is security evidenced, what is your role under the AI Act, what documentation does the vendor provide, how are model changes announced, how are costs capped and how do you exit.
8 items
Checklist: using AI safely in law firms and fiduciary offices
AI can save law firms and fiduciary offices a lot of time but touches professional secrecy and data protection directly. Use becomes safe with clarified secrecy duties, tools with a contract and no training on client data, minimised data, checking of every statement and citation, transparency towards clients, and a policy with training.
8 items
Checklist: website relaunch for law firms and fiduciaries
A law firm relaunch succeeds when practice areas and people are clearly structured, old addresses are cleanly redirected, content is factual under professional rules, the contact form is designed for confidentiality, structured data and local details are correct, and indexing and enquiries are measured after launch.
8 items