Initiative · Problem
Meeting new regulatory requirements
Legally clear doesn't mean implemented. The work lies in between.
Translating requirements such as e-invoicing, NIS2, the AI Act, supply chain due diligence, accessibility or pay transparency into processes and systems.
The situation
“A new regulation applies to us and we don't know where to start.”
A circular from your trade association, a note from your tax advisory firm, a question in a customer audit: suddenly there's a new obligation on the table. At first glance it's unclear what exactly it requires.
The only clear thing is that it affects several departments: IT, accounting, perhaps purchasing. Nobody feels responsible, and the deadline keeps getting closer. Meanwhile, the first vendors are already selling the matching software before anyone knows what's needed.
Where it often goes wrong.
-
Waiting until it gets serious
Many obligations come with long transition periods. Let them slip by, and you end up implementing under time pressure and paying for every rush job.
-
One department on its own
E-invoicing sounds like accounting, NIS2 like IT. Usually several areas are affected, and the gaps open up at the handovers.
-
Done, but not documented
Audits don't just ask about measures, they ask for evidence. If nothing is documented, you do the work a second time.
-
A separate project for every rule
NIS2, the AI Act and data protection need similar foundations: risks, responsibilities, documentation. Tackle each obligation separately, and you build the same structures several times.
-
Implementing everything to be safe
When in doubt, every recommendation found anywhere gets implemented. That costs time and money, and the actual obligations get lost in the pile.
Which disciplines work together here.
5 of 13 disciplines, one team, one point of contact. Every service has a clear role, and you decide which ones we take on.
-
D04 Consulting
-
Sets up responsibilities, controls and documentation and coordinates the legal assessment by a law firm.
-
Gathers emissions and sustainability data for reporting and prepares the audit firm's review.
-
-
D09 IT & Digital
-
Implements the NIS2 security requirements and prepares certification by accredited bodies.
-
Inventories your AI systems, prepares their risk rating and documents them for the AI Act.
-
Makes your website and shop accessible, following the technical criteria of WCAG.
-
-
D11 Finance & Accounting
-
Switches incoming and outgoing invoices to e-invoicing, including software and process.
-
-
D06 Procurement & Supply Chain
-
Sets up risk analysis and supplier assessment for supply chain due diligence duties.
-
-
D08 HR & Recruiting
-
Analyses pay structures and prepares the disclosure and reporting duties on pay transparency.
-
You decide the scope.
Most begin with a review: what's already in place, and what's missing? After that, hand over a single obligation, such as e-invoicing, or all of them at once.
Law firms and certification bodies join from the start. That way, assessment and implementation fit together.
Good questions. Straight answers.
Can we work with our own law firm?
Yes, gladly. Legal advice and certification come from licensed law firms and accredited bodies that we appoint on your behalf. If you already have a law firm, we work with them.
We translate their assessment into processes and systems and make sure the evidence is in place at the end.
Does implementation bring more than ticked boxes?
Often, yes. An e-invoice that flows through without retyping saves work every month. And if security and suppliers are under control, customer audits are easier to pass.
So we implement obligations in a way that also helps day to day.
Does it have to end with a certificate?
Not necessarily. Many regulations require measures and evidence, not a certificate. Some customer contracts ask for one anyway, for example under ISO 27001.
Then we prepare the certification, which an accredited body carries out. We plan the route there so that it covers the legal obligations as well.
Can we still make the deadline?
Not always. It depends on how much is already in place and how quickly decisions are made. We plan backwards from the deadline and tell you early and honestly if time runs short.
How much leeway you have is one of the first questions in the free Initiative Check.
Is the job done after the first audit?
Rarely. Regulations get tightened, systems and suppliers change, and every change can open a new gap.
We keep documentation, controls and evidence up to date, or hand them over cleanly to your team.
Proof first. Contract second.
In the free Initiative Check, we listen for 45 minutes and ask the questions that usually only come up after the contract is signed. Then you get a short written assessment: what we see, how we would go about it and roughly what it would take.
No obligation. And if we're not the right fit, we'll tell you.
Or write to us at hello@intoops.com.