IT compliance: assigning responsibility

On this page

Published by horak. Attorneys at law / Patent attorneys

Archive · First published 2018-08-23. Editorial revision: 12 November 2026. The original date is retained; the text below distinguishes historical context from present-day application.

A technology compliance programme should identify the rules that apply to the particular business and assign responsibility for implementing them. Management decisions need an appropriate factual and legal basis.

How to use this archived article

The earlier text contained a broad claim concerning certification under IDW PS 980. That claim is not repeated here. Legal advice, implementation support and an independent assurance or certification engagement are distinct services.

Questions for a current matter

Which contractual version and legal regime apply? What happened, when did the parties become aware of it, and which documents preserve the relevant facts? Identify the desired outcome and any procedural deadline before choosing a response.

Four practical examples

Illustrative scenarios, not reports of client mandates. The appropriate response depends on the facts and applicable law.

Fintech infrastructure

A provider supplies critical software to a financial institution. We assess contractual demands arising from the customer’s operational-resilience duties.

Digital-health launch

An app adds diagnostic functionality. We assess whether the change requires a different regulatory classification and supporting advice.

Technology acquisition

A buyer finds unclear software rights and data permissions. We prioritise diligence findings, remediation and transaction protections.

Connected-product expansion

A manufacturer enters several EU markets. We map product, data, security and consumer requirements before release.

Current guidance

Digital regulation, compliance & sector rules