Launch in the EU — and hold up when customers, regulators and investors check.

I advise on GDPR and EU regulatory compliance as a compliance consultant with CIPP/E certification and years of hands-on EU privacy work for international companies. This work doesn't require admission to an EU bar. For matters that do — litigation, formal legal opinions for regulators — I bring in local counsel from my network and coordinate the process.

If you have users in the EU — yes. GDPR applies to anyone offering services to people in the EU (Art. 3(2)), and the AI Act follows the same logic for AI systems whose output is used there. Where you're incorporated doesn't shield you.

Most don't fit perfectly. Book a call — I'll scope it and give you a fixed quote within a day.

That's good — most of my clients do too. I usually come in for the EU-specific layer (GDPR, AI Act) that general counsel often outsources anyway. A second pair of senior eyes on EU compliance is cheap insurance.

My AI Act work is focused on Article 50 — the transparency, marking, and disclosure duties for AI-generated content that apply from 2 August 2026. That's what most SaaS and GenAI products actually face right now, and I've handled it hands-on. High-risk system classification and conformity assessments are a different discipline: if that's your situation, I'll say so on the intro call and can bring in a specialist from my network rather than learn on your budget.

Yes. Diia City residency requires a Ukrainian legal entity, but its founders and beneficiaries can be foreign — setting up the entity is part of the scope. The regime offers 9% tax on distributed profit and flexible gig contracts with IP assignment built in. If you're weighing it as part of your setup, we'll cover it on the intro call.

Start with the free interactive GDPR self-check — 40 items across 10 areas, from scope and ROPA to transfers and DPIA. Mark what's in place, export the summary, and you'll see your gaps in about 15 minutes. If the red column worries you, that's exactly what the GDPR Compliance Audit turns into a prioritized remediation plan.

No — by design. The audit determines whether any of your processing operations require a Data Protection Impact Assessment; the DPIA itself is a separate, fixed-price piece of work (from $900). That keeps the audit price honest for the majority of companies that don't need one.

Each base price covers a defined scope, described in the service itself. If your situation adds scope — extra products, B2C consumer law, cross-border transfers needing SCCs — the quote goes up, and the proposal lists exactly which factors shaped it. You always get a fixed number before work starts, never an hourly meter.

Fair question. The practice runs cloud-first: documents, communication, and files live in redundant cloud services, with backup power and connectivity at the workplace. Deadlines are agreed in writing before work starts and are treated as contractual. In 7+ years of in-house work through 2022–2026, client deadlines were kept — that standard carries over here.

Yes. Procurement questionnaires and investor due diligence often ask for a Code of Conduct, anti-bribery and whistleblowing policies, an information security policy, or a data retention policy. This isn't a fixed package — the right set depends on your headcount, market and who is asking, so it's scoped individually after a call. Bring the questionnaire you were sent and we'll work from it.

Fixed fee agreed upfront. Smaller projects are paid on signing; larger ones split 50% to start, 50% on delivery. Retainers are billed monthly in advance. Invoices in USD or EUR.