Review checklist for the DPO and counsel ​
Status: Template — to be reviewed by the controller's DPO / counsel. Draft of 2026-10-13; not reviewed yet.
All points in this pack that need a decision. Nothing here has been decided or reviewed. A DPO or legal reviewer has not been named yet.
Decisions for Quavon UG (haftungsbeschränkt) ​
| # | Point | Document | Default until decided |
|---|---|---|---|
| Q1 | Support period per major line and the versioning scheme | cra/support-period.md | Only main is supported (pre-release) |
| Q2 | Audit-log retention and pseudonymisation on erasure requests | gdpr/data-subject-rights.md, gdpr/dpa-art28.md | Retained, reported as retained |
| Q3 | Analytics defaults: no per-person view except the self view, k = 5, cost metrics exempt from k but administrator-only; whether a self view should exist in employment contexts | gdpr/dpia-analytics.md | As stated |
| Q4 | Machine-readable AI marker in published texts; fixed part of the visible notice | ai-act/art50-transparency.md | Visible notice and idempotency marker only |
| Q5 | Enforced EU-only routing switch for model providers | gdpr/subprocessors.md | Configuration by the tenant administrator |
| Q6 | Container registry and 10-year availability of updates and SBOMs | cra/sbom-delivery.md | None chosen |
| Q7 | Backups and restore before the hosted edition starts | gdpr/toms.md | Hosted edition not operated |
| Q8 | Appointment or confirmation of a DPO for Quavon UG (haftungsbeschränkt) | gdpr/ropa.md Part B | Open |
| Q9 | ENISA SRP registration of the PSIRT lead and a deputy | ../security/psirt.md | Open |
Questions for counsel ​
| # | Question | Document |
|---|---|---|
| L1 | Legal basis for employee data per activity (Art. 6(1)(b)/(f), Art. 88 GDPR, § 26 BDSG after C-34/21) | gdpr/ropa.md |
| L2 | DPA: own template or Commission SCCs (2021/915); notice periods, audit frequency, emergency access | gdpr/dpa-art28.md |
| L3 | Qualification of model providers as the tenant's own processors (the hosted edition is always bring your own key) and transfer safeguards per route | gdpr/subprocessors.md |
| L4 | Whether a DPIA is required for team-level analytics | gdpr/dpia-analytics.md |
| L5 | Art. 50(1) for review comments; 50(2) marking of text and code; 50(4) for public issue replies; configurable notice and 50(5) | ai-act/art50-transparency.md |
| L6 | Final wording of Art. 4 after Regulation (EU) 2026/1744 (reported change to "take measures to support" is unverified) | ai-act/art4-ai-literacy.md |
| L7 | Provider role for both editions; when a customer becomes provider (Art. 25); whether analytics is an AI system | ai-act/roles.md |
| L8 | Assignment questions Q1–Q14 | ../legal/assignment-assessment.md |
| L9 | CRA scope of the hosted edition; commercial activity for the Apache-2.0 distribution; update model per supported line | cra/support-period.md |
| L10 | Publishing SBOMs to all users; VEX documents | cra/sbom-delivery.md |
| L11 | CRA dates and Art. 13/14 wording checked here against an unofficial consolidation; confirm against the Official Journal text | cra/vulnerability-handling.md |
| L12 | Works-agreement annex: wording of the evidence-use prohibition (4.3), competent works council for multi-site tenants, whether automatic assignment should ever be offered | betrvg/betriebsvereinbarung-anlage.md |
| L13 | ISO/IEC 27001 scope and Statement of Applicability for the hosted edition | iso27001/annex-a.md |
| L14 | Final license terms of the proprietary hosted edition (hosted/LICENSE is a placeholder) and its effect on the Apache-2.0 open core | ADR-0015 |
Verified facts used in the pack (as of 2026-10-13) ​
| Fact | Source |
|---|---|
| CRA Art. 14 applies from 11 September 2026; the regulation applies from 11 December 2027; Chapter IV from 11 June 2026 (Art. 71(2)) | Unofficial consolidation of Regulation (EU) 2024/2847; Official Journal check pending |
| CRA reporting deadlines 24 h / 72 h / 14 days after a measure is available (vulnerabilities) / one month after the notification (severe incidents); user information under Art. 14(8) | as above |
| CRA support period at least five years unless expected use is shorter (Art. 13(8)); updates available at least 10 years (Art. 13(9)); SBOM covering at least top-level dependencies (Annex I Part II(1)) | as above |
| ENISA Single Reporting Platform launched on 11 September 2026; no API at this stage | ENISA announcement and secondary sources |
| GDPR Art. 28(3)(a)–(h), Art. 30(1)(a)–(g) and (2)(a)–(d), Art. 35(7)(a)–(d) content lists | gdpr-info.eu reproduction of the GDPR text |
| AI Act Art. 50(1), (2), (4), (5) wording and exceptions | artificialintelligenceact.eu reproduction |
| OWASP LLM Top 10: genai.owasp.org lists the 2025 edition; the 2026 numbering is reported only by secondary sources and is unverified | genai.owasp.org, secondary sources |
| GitHub repository security advisory endpoints, roles and classic token scopes; the fine-grained permission name is not stated | docs.github.com REST reference |