Legal advice on AI, data protection, cybersecurity and technology, for companies that build, buy or run digital systems.
You do not need to know in advance which piece of work you need; the first conversation will show it. No fee arises until we have agreed it in writing, in advance.
If a deadline is already running (an incident, a request from an authority, a dispute): write to my Taylor Wessing address directly
Image: AI-generated (ChatGPT), 2026
In practice, one system, contract or decision raises data protection, AI, cybersecurity and contractual questions at the same time, so I advise on them together.
When you deploy, buy or build AI and need to know which rules apply and who answers for it.
Further reading: The regulatory sandwich effect
AI Act · GDPR · employment law · product liability
When a new processing operation starts, an authority asks questions, or the operation no longer matches the privacy notice.
Further reading: Your transfers rest on an agency’s independence
GDPR · ePrivacy · Data Act
When NIS2 (in Hungary, Act LXIX of 2024), DORA or the Cyber Resilience Act applies to you, or an incident starts several notification clocks at once.
Further reading: “The Hungarian NIS2 audit is done.” What headquarters still needs to ask · One framework, finally: the EU’s cyber + AI action plan
NIS2 · DORA · CRA
When you take a digital product, platform or online service to market in Hungary or the European Union.
When you buy, sell or license software, data or AI services, or need to protect your brand and your code.
When the question is no longer theoretical: an authority investigates, a fine looms, or a counterparty disputes performance.
Types of work, not references: I do not disclose client names or outcomes.
Bringing AI-based products and platforms to market: GDPR, AI Act, consumer rules and the contract framework
Data protection impact assessments, with transfer impact and legitimate interest assessments, for international technology companies
NIS2: audit preparation, coordination of multi-country compliance projects, management responsibility
Data protection and cybersecurity due diligence in acquisitions
Employee monitoring: cameras, vehicle tracking and company IT
Handling personal data breaches and assessing notification duties
Connected products and industrial data: Data Act readiness and data sharing
Health and research data: operating models before ethics committees and authorities
Online platforms: DSA and accessibility obligations
Fine exposure and routes to challenge in proceedings before the Hungarian data protection authority (NAIH)
Trade mark filings and opposition settlements for technology companies
technology and SaaS, AI development, life sciences and healthcare, financial services, manufacturing and industry, energy, automotive and mobility, telecommunications, retail and e-commerce, logistics, digital platforms, video games
For international groups I often work between the Hungarian subsidiary and headquarters, in English and Hungarian. Law firms outside Hungary that need Hungarian counsel on an AI, data or cyber matter are welcome to write to me at Taylor Wessing.
Four forms of work, the first free of charge; for the rest, the proposal fixes the fee in advance.
If a deadline is already running (an incident, a letter from an authority, a dispute), do not wait for a slot: write directly to j.kopasz@taylorwessing.com.
We talk about one specific system, procurement or question, in English or Hungarian, at Taylor Wessing’s office in the Gerbeaud House or by Teams call.
We establish where your organisation stands and where the first resources should go.
Available for AI, workplace AI, industrial health and safety technology, and NIS2.
A clearly scoped piece of work in any of the six areas, such as an impact assessment, a contract pack, a response to an authority or a pre-launch review. It ends with a document, a decision or a working process in your hands. Typical tools: an architecture workshop with your developers, a decision-ready group matrix, a prioritised roadmap.
Five ready-made packages for AI and the CRAFor teams that lack the in-house capacity for this work, or whose capacity is stretched.
Each can be commissioned on its own. The scope and fee are set in advance in a written offer from Taylor Wessing’s Budapest office; the package names describe my own way of working. For anything else in the six areas, you receive a tailored offer.
For companies that deploy or buy AI.
For companies, start-ups and scale-ups that build AI.
For manufacturers and suppliers of products with digital elements.
For industrial manufacturers introducing camera-based safety monitoring, wearables or fatigue monitoring.
For organisations where an AI agent completes tasks on its own.
Further reading: The Accountability Gap
An annual programme for management boards, boards of directors and supervisory boards.
Further reading: The relief is premature: what 2 August actually switches on
For executives, HR, health and safety, developers, procurement and data protection officers.
Every fee is agreed in writing before the work begins.
When: A deliverable that can be defined in advance: a classification record, a board briefing, a checklist of minimum contract terms, an AI literacy session.
Fixed in advance: the total fee The whole fee for a defined scope. If the scope changes, we agree the change in writing before I continue.
When: The scope is broadly known and the details emerge as we work: an impact assessment, vendor due diligence, a reply to an authority.
Fixed in advance: the rate and the cap The hourly rate and the ceiling. I will tell you before the ceiling is reached, and you decide whether to continue.
When: Larger work where the first phase decides the next: inventory, then classification, then the 90-day plan.
Fixed in advance: the fee for each phase The fee for each phase, fixed or capped. At the end of each phase you decide whether to continue, change course or stop; if we stop, you pay only for the work done to that point.
When: Several live systems, frequent change, regular board reporting.
Fixed in advance: the period and what it covers The monthly or quarterly fee and what it covers, for example a quarterly review and ad hoc questions up to an allowance; the rate for work beyond the allowance is set in advance.
When: One question, one contract clause, one letter from an authority.
Fixed in advance: the hourly rate The hourly rate, before the advice starts; the fee follows the time spent.
The question is rarely whether something is allowed. It is on what terms, at what risk and for how long it holds. I give an answer the leadership can decide on, and that nobody has to translate again at the next meeting.
I do not stop at today’s compliance: the next deadline, the next audit and the product’s next version are part of the view. A good solution still stands under next year’s rule and leaves room to grow.
I look at the data protection, AI, cybersecurity and contract questions together, because they meet in the same system. A decision rarely touches only one of them.
Where technical depth is needed, I bring in AI and IT developers, development firms, system integrators and IT auditors under their own contracts, and coordinate their work with mine. With the company’s own teams, legal, IT, security, HR and product, I work in one process rather than alongside them.
All legal work is covered by the lawyer’s duty of professional secrecy. What I deliver is written down and traceable, so it can be used before an authority, a counterparty or a court.
I personally lead the matters I take on, in English or Hungarian. The proposal sets out the team and who does what, with Taylor Wessing’s international network behind the work.
“someone who can connect complex regulations with real business decisions”Bring your question: an AI system, a processing operation, a procurement or a contract. In thirty minutes we see together which legal questions it raises and how I could help. If it turns into joint work, we agree its terms in writing first.
A free orientation conversation at Taylor Wessing’s Budapest office or by Teams call. Its purpose is to understand the question and the possible scope of work; it gives no legal assessment of your matter and creates no engagement. Any further work requires a written engagement with Taylor Wessing’s Budapest office. What you share is covered by the lawyer’s duty of professional secrecy, even if no engagement follows. When booking, please name your organisation and, for a procurement, the vendor, to allow a conflict check; do not send confidential documents in advance. Bookings are made on an external Google page. Privacy notice
The obligations for high-risk AI systems have been postponed; the rest of the AI Act largely has not. The GDPR, employment law and existing contracts already apply.
Add the calendar to yours (.ics)
EU DORA applies to the financial sector.
EU The AI Act prohibitions and the AI literacy obligation (Article 4) apply.
Hungary The first Hungarian NIS2 cybersecurity audit deadline passes.
Sector Deadline for credit institutions’ first AI sub-strategy (MNB Recommendation 13/2025, point 28).
EU The Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force.
EU The AI Act applies generally, including the transparency rules (Article 50); the Commission can fine providers of general-purpose AI models.
Hungary The Hungarian provision on the AI regulatory sandbox enters into force (Act LXXV of 2025, s. 10).
EU The Cyber Resilience Act reporting obligations apply to manufacturers of products with digital elements.
EU Two new prohibitions apply (Article 5(1)(ba) and (bb)); generative systems placed on the market before 2 August 2026 must meet the marking rule (Article 50(2)); the transposition deadline of the Platform Work Directive passes.
EU The transposition deadline of the new Product Liability Directive passes; it applies to products, software included, placed on the market after this date.
Hungary A chief executive appointed before 31 December 2025 generally needs eight hours of cybersecurity training by this date (training regulation).
EU Obligations for Annex III high-risk AI systems apply, including Articles 26 and 27.
EU The main obligations of the Cyber Resilience Act apply.
EU Obligations apply to high-risk AI systems in products covered by Annex I, for example medical devices.
As at 22 October 2026