---
title: "Business and regulationWavect"
canonical: https://wavect.io/blog/topics/business-regulation/
language: en
description: "Buying software, funding delivery and navigating governance, contracts and regulation."
image: "https://wavect.io/img/general/bak/open_graph_preview.jpg"
---

Topic

# Business and regulation

Buying software, funding delivery and navigating governance, contracts and regulation.

## Focused clusters

### [AI governance and regulation](/blog/clusters/ai-governance/)

Security, policy, compliance and operating controls for responsible AI adoption.

### [Software buying and funding](/blog/clusters/software-buying-funding/)

Agency selection, contracts, pricing, grants and the commercial mechanics of delivery.

## Start with the cornerstone

- [**Software Agency Proposal Teardown: 12 Clauses That Change Price, Scope and Ownership**A clause-by-clause teardown of a fictional EUR 96k software proposal: acceptance, IP, changes, warranty, dependencies, hosting, licences, handover, termination, security, subcontractors and done, with a downloadable 24-point review rubric.](/blog/software-agency-proposal-teardown/)
- [**EU AI Act Cost for a 5-Person Startup**Line-item EUR 30 to 80k breakdown. Legal review, risk classification, technical documentation, conformity assessment, data governance, post-market monitoring.](/blog/eu-ai-act-compliance-cost-startup/)

## Latest in this collection

### [Cyber Resilience Act Reporting: 24-Hour Playbook](/blog/cyber-resilience-act-reporting-playbook-2026/)

- **Details:** Business & Regulation · 24 Aug 2026

Build the evidence pipeline, decision rights, and incident workflow needed when CRA reporting starts on 11 September 2026.

### [EU Product Liability for Software: Evidence Checklist](/blog/eu-product-liability-software-evidence-2026/)

- **Details:** Business & Regulation · 24 Aug 2026

Build the release, test, incident, and update evidence chain needed for software placed on the EU market after 9 December 2026.

### [AI Bill of Materials: CycloneDX vs SPDX](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/)

- **Details:** Business & Regulation · 24 Aug 2026

Choose an AIBOM format, define model and dataset provenance, and generate signed inventory from the release pipeline.

### [LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?](/blog/llm-pseudonymization-gateway-gdpr-2026/)

- **Details:** Business & Regulation · 18 Aug 2026

Platforms in this category promise that pseudonymizing a prompt makes a hosted model safe to use. The 2025 CJEU ruling and the EDPB guidance say something narrower. Here is the evidence a buyer actually has to collect.

### [Semantica Review 2026: Can It Explain Every AI Agent Decision?](/blog/semantica-ai-agent-decision-provenance/)

- **Details:** Business & Regulation · 14 Aug 2026

A buyer-focused review of Semantica for decision provenance, policy gates and regulated AI audit trails, including security limits and a two-week pilot scorecard.

### [Software Project Takeover: A 30-Day Provider Change Plan](/blog/software-project-takeover-provider-change/)

- **Details:** Business & Regulation · 13 Aug 2026

Changing the team behind a live product is not a repository transfer. Use this 30-day plan to regain control, prove releases and recovery, and select a provider that can inherit before it rebuilds.

## Complete article directory

1. [Cyber Resilience Act Reporting: 24-Hour Playbook](/blog/cyber-resilience-act-reporting-playbook-2026/) 24 Aug 2026
2. [EU Product Liability for Software: Evidence Checklist](/blog/eu-product-liability-software-evidence-2026/) 24 Aug 2026
3. [AI Bill of Materials: CycloneDX vs SPDX](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/) 24 Aug 2026
4. [LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?](/blog/llm-pseudonymization-gateway-gdpr-2026/) 18 Aug 2026
5. [Semantica Review 2026: Can It Explain Every AI Agent Decision?](/blog/semantica-ai-agent-decision-provenance/) 14 Aug 2026
6. [Software Project Takeover: A 30-Day Provider Change Plan](/blog/software-project-takeover-provider-change/) 13 Aug 2026
7. [AI Agent Contract Signing: eIDAS QES Integration Guide](/blog/ai-agent-eidas-signature-integration/) 13 Aug 2026
8. [What "Dienstleister" Commits Your Vendor To](/blog/werkvertrag-vs-dienstvertrag-software-austria/) 9 Aug 2026
9. [Terafab: Who Controls the AI Stack From Silicon to Orbit?](/blog/terafab-vertical-integration-ai-stack/) 7 Aug 2026
10. [Can AI Create Viruses? What Stanford Actually Proved](/blog/ai-designed-viruses-stanford-biosecurity/) 7 Aug 2026
11. [Stripe Billing and E-Invoicing 2027](/blog/stripe-billing-e-invoicing-2027/) 4 Aug 2026
12. [EU AI Act Article 50 Checklist for SaaS and AI Agents](/blog/eu-ai-act-article-50-checklist/) 23 Jul 2026
13. [Software Agencies in Tyrol Compared 2026](/blog/software-agencies-tyrol-comparison-2026/) 19 Jul 2026
14. [AI Agent SLA Template: Accuracy, Latency, Human Handoff and Auditability](/blog/ai-agent-sla-template/) 19 Jul 2026
15. [EU AI Vendor Security Questionnaire: 45 Questions Before You Sign](/blog/ai-vendor-security-questionnaire-eu/) 17 Jul 2026
16. [DACH AI Adoption Benchmark 2026: What SMEs Put Into Production](/blog/dach-ai-adoption-benchmark-2026/) 17 Jul 2026
17. [Software Agency Proposal Teardown: 12 Clauses That Change Price, Scope and Ownership](/blog/software-agency-proposal-teardown/) 13 Jul 2026
18. [AI Consulting in Austria 2026: An Honest Guide for SMEs](/blog/ai-consulting-austria-2026/) 24 Jun 2026
19. [EU Data Residency for AI APIs in 2026: Provider Guide](/blog/eu-data-residency-ai-apps-2026/) 21 Jun 2026
20. [AI Funding in Austria 2026: aws, FFG, Premium, KMU.DIGITAL](/blog/ai-funding-austria-2026/) 19 Jun 2026
21. [The One-Page AI Policy for a DACH Company](/blog/ai-policy-one-page-dach/) 15 Jun 2026
22. [MVP Development for Startups in Austria: Agencies, Cost and Selection 2026](/blog/best-software-agencies-austria-ai-mvp/) 8 Jun 2026
23. [When Not to Hire Wavect](/blog/when-not-to-hire-wavect/) 8 Jun 2026
24. [Can a Software Studio Claim Austria's Forschungsprämie?](/blog/forschungspraemie-software-development-austria/) 2 Jun 2026
25. [How Austrian Startup Funding Actually Stacks](/blog/austrian-startup-funding-stacking-aws-ffg/) 30 May 2026
26. [EU AI Act Cost for a 5-Person Startup](/blog/eu-ai-act-compliance-cost-startup/) 26 May 2026
27. [Werkvertrag vs T&M for Austrian SaaS](/blog/werkvertrag-vs-time-material-austrian-saas/) 26 May 2026
28. [Scope-Creep Rates. Our Numbers](/blog/fixed-price-vs-tm-scope-creep-rates/) 26 May 2026
29. [MiCA + FMA Reality Austria 2026](/blog/mica-fma-crypto-licensing-austria-2026/) 26 May 2026
30. [GDPR + EU AI Act for DACH SaaS](/blog/gdpr-ai-act-stacking-dach-saas/) 26 May 2026
31. [Why People think Agencies suck](/blog/why-agencies-are-bad/) 7 Jun 2024
32. [Pricing Software Projects the Right Way](/blog/agile-fixed-pricing/) 2 Jun 2024

## Structured Data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@id": "https://wavect.io/#organization",
      "@type": [
        "Organization",
        "ProfessionalService",
        "LocalBusiness"
      ],
      "employee": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "founder": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "legalRepresentative": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "name": "Wavect GmbH",
      "subjectOf": {
        "@id": "https://wavect.io/verified-claims.json#dataset",
        "@type": "Dataset",
        "creator": {
          "@id": "https://wavect.io/#organization",
          "@type": [
            "Organization",
            "ProfessionalService",
            "LocalBusiness"
          ]
        },
        "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.",
        "inLanguage": "en",
        "isAccessibleForFree": true,
        "license": "https://creativecommons.org/licenses/by/4.0/",
        "name": "Wavect verified publication claims",
        "url": "https://wavect.io/verified-claims.json"
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/team/kevin-riedl/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Kevin Riedl",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796365",
        "https://www.linkedin.com/in/wsdt",
        "https://github.com/wsdt"
      ],
      "url": "https://wavect.io/team/kevin-riedl/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/team/christof-jori/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Christof Jori",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796367",
        "https://www.linkedin.com/in/jocr77/",
        "https://github.com/jo-chris"
      ],
      "url": "https://wavect.io/team/christof-jori/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/#website",
      "@type": "WebSite",
      "inLanguage": [
        "en",
        "de",
        "es",
        "zh"
      ],
      "name": "Wavect",
      "potentialAction": {
        "@type": "SearchAction",
        "query-input": "required name=search_term_string",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://wavect.io/search/?q={search_term_string}"
        }
      },
      "publisher": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/blog/topics/business-regulation/#webpage",
      "@type": "WebPage",
      "dateModified": "2026-08-05",
      "inLanguage": "en",
      "isPartOf": {
        "@id": "https://wavect.io/#website",
        "@type": "WebSite"
      },
      "lastReviewed": "2026-08-05",
      "url": "https://wavect.io/blog/topics/business-regulation/"
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "item": "https://wavect.io/",
      "name": "Home",
      "position": 1
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/overview/",
      "name": "Blog",
      "position": 2
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/topics/business-regulation/",
      "name": "Business and regulation",
      "position": 3
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "CollectionPage",
  "about": "Business and regulation",
  "description": "Buying software, funding delivery and navigating governance, contracts and regulation.",
  "mainEntity": {
    "@type": "ItemList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "name": "Cyber Resilience Act Reporting: 24-Hour Playbook",
        "position": 1,
        "url": "https://wavect.io/blog/cyber-resilience-act-reporting-playbook-2026/"
      },
      {
        "@type": "ListItem",
        "name": "EU Product Liability for Software: Evidence Checklist",
        "position": 2,
        "url": "https://wavect.io/blog/eu-product-liability-software-evidence-2026/"
      },
      {
        "@type": "ListItem",
        "name": "AI Bill of Materials: CycloneDX vs SPDX",
        "position": 3,
        "url": "https://wavect.io/blog/ai-bill-of-materials-cyclonedx-spdx-2026/"
      },
      {
        "@type": "ListItem",
        "name": "LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?",
        "position": 4,
        "url": "https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/"
      },
      {
        "@type": "ListItem",
        "name": "Semantica Review 2026: Can It Explain Every AI Agent Decision?",
        "position": 5,
        "url": "https://wavect.io/blog/semantica-ai-agent-decision-provenance/"
      },
      {
        "@type": "ListItem",
        "name": "Software Project Takeover: A 30-Day Provider Change Plan",
        "position": 6,
        "url": "https://wavect.io/blog/software-project-takeover-provider-change/"
      },
      {
        "@type": "ListItem",
        "name": "AI Agent Contract Signing: eIDAS QES Integration Guide",
        "position": 7,
        "url": "https://wavect.io/blog/ai-agent-eidas-signature-integration/"
      },
      {
        "@type": "ListItem",
        "name": "What \"Dienstleister\" Commits Your Vendor To",
        "position": 8,
        "url": "https://wavect.io/blog/werkvertrag-vs-dienstvertrag-software-austria/"
      },
      {
        "@type": "ListItem",
        "name": "Terafab: Who Controls the AI Stack From Silicon to Orbit?",
        "position": 9,
        "url": "https://wavect.io/blog/terafab-vertical-integration-ai-stack/"
      },
      {
        "@type": "ListItem",
        "name": "Can AI Create Viruses? What Stanford Actually Proved",
        "position": 10,
        "url": "https://wavect.io/blog/ai-designed-viruses-stanford-biosecurity/"
      },
      {
        "@type": "ListItem",
        "name": "Stripe Billing and E-Invoicing 2027",
        "position": 11,
        "url": "https://wavect.io/blog/stripe-billing-e-invoicing-2027/"
      },
      {
        "@type": "ListItem",
        "name": "EU AI Act Article 50 Checklist for SaaS and AI Agents",
        "position": 12,
        "url": "https://wavect.io/blog/eu-ai-act-article-50-checklist/"
      },
      {
        "@type": "ListItem",
        "name": "Software Agencies in Tyrol Compared 2026",
        "position": 13,
        "url": "https://wavect.io/blog/software-agencies-tyrol-comparison-2026/"
      },
      {
        "@type": "ListItem",
        "name": "AI Agent SLA Template: Accuracy, Latency, Human Handoff and Auditability",
        "position": 14,
        "url": "https://wavect.io/blog/ai-agent-sla-template/"
      },
      {
        "@type": "ListItem",
        "name": "EU AI Vendor Security Questionnaire: 45 Questions Before You Sign",
        "position": 15,
        "url": "https://wavect.io/blog/ai-vendor-security-questionnaire-eu/"
      },
      {
        "@type": "ListItem",
        "name": "DACH AI Adoption Benchmark 2026: What SMEs Put Into Production",
        "position": 16,
        "url": "https://wavect.io/blog/dach-ai-adoption-benchmark-2026/"
      },
      {
        "@type": "ListItem",
        "name": "Software Agency Proposal Teardown: 12 Clauses That Change Price, Scope and Ownership",
        "position": 17,
        "url": "https://wavect.io/blog/software-agency-proposal-teardown/"
      },
      {
        "@type": "ListItem",
        "name": "AI Consulting in Austria 2026: An Honest Guide for SMEs",
        "position": 18,
        "url": "https://wavect.io/blog/ai-consulting-austria-2026/"
      },
      {
        "@type": "ListItem",
        "name": "EU Data Residency for AI APIs in 2026: Provider Guide",
        "position": 19,
        "url": "https://wavect.io/blog/eu-data-residency-ai-apps-2026/"
      },
      {
        "@type": "ListItem",
        "name": "AI Funding in Austria 2026: aws, FFG, Premium, KMU.DIGITAL",
        "position": 20,
        "url": "https://wavect.io/blog/ai-funding-austria-2026/"
      },
      {
        "@type": "ListItem",
        "name": "The One-Page AI Policy for a DACH Company",
        "position": 21,
        "url": "https://wavect.io/blog/ai-policy-one-page-dach/"
      },
      {
        "@type": "ListItem",
        "name": "MVP Development for Startups in Austria: Agencies, Cost and Selection 2026",
        "position": 22,
        "url": "https://wavect.io/blog/best-software-agencies-austria-ai-mvp/"
      },
      {
        "@type": "ListItem",
        "name": "When Not to Hire Wavect",
        "position": 23,
        "url": "https://wavect.io/blog/when-not-to-hire-wavect/"
      },
      {
        "@type": "ListItem",
        "name": "Can a Software Studio Claim Austria's Forschungsprämie?",
        "position": 24,
        "url": "https://wavect.io/blog/forschungspraemie-software-development-austria/"
      },
      {
        "@type": "ListItem",
        "name": "How Austrian Startup Funding Actually Stacks",
        "position": 25,
        "url": "https://wavect.io/blog/austrian-startup-funding-stacking-aws-ffg/"
      },
      {
        "@type": "ListItem",
        "name": "EU AI Act Cost for a 5-Person Startup",
        "position": 26,
        "url": "https://wavect.io/blog/eu-ai-act-compliance-cost-startup/"
      },
      {
        "@type": "ListItem",
        "name": "Werkvertrag vs T&M for Austrian SaaS",
        "position": 27,
        "url": "https://wavect.io/blog/werkvertrag-vs-time-material-austrian-saas/"
      },
      {
        "@type": "ListItem",
        "name": "Scope-Creep Rates. Our Numbers",
        "position": 28,
        "url": "https://wavect.io/blog/fixed-price-vs-tm-scope-creep-rates/"
      },
      {
        "@type": "ListItem",
        "name": "MiCA + FMA Reality Austria 2026",
        "position": 29,
        "url": "https://wavect.io/blog/mica-fma-crypto-licensing-austria-2026/"
      },
      {
        "@type": "ListItem",
        "name": "GDPR + EU AI Act for DACH SaaS",
        "position": 30,
        "url": "https://wavect.io/blog/gdpr-ai-act-stacking-dach-saas/"
      },
      {
        "@type": "ListItem",
        "name": "Why People think Agencies suck",
        "position": 31,
        "url": "https://wavect.io/blog/why-agencies-are-bad/"
      },
      {
        "@type": "ListItem",
        "name": "Pricing Software Projects the Right Way",
        "position": 32,
        "url": "https://wavect.io/blog/agile-fixed-pricing/"
      }
    ],
    "numberOfItems": 32
  },
  "name": "Business and regulation",
  "url": "https://wavect.io/blog/topics/business-regulation/"
}
```