Developing and implementing business software: what role does the law play?

The European Union (EU) leads the way in regulating advanced technologies, and high fines for non-compliance call for particular care from businesses that use business software, whether SAP, Oracle or Odoo. Growing reliance on centralised databases and artificial intelligence (AI) raises new questions about data protection, system security and ethical implications, and increases the risk of privacy breaches, information leaks and inadequate oversight.
The legislative landscape in the Western Balkans is also becoming more complex. Serbia adopted its Law on Personal Data Protection several years ago, while Bosnia and Herzegovina (BiH) followed in February of this year, when the new Law on the Protection of Personal Data entered into force. Although both clearly correspond to the General Data Protection Regulation (GDPR), practice shows that applying the GDPR opens the door to numerous court cases and further interpretations. This points to the need for more precise guidelines, which legislation in the Western Balkans does not yet fully cover.
On the other hand, for businesses from the EU, the gradual alignment of legislation in BiH and Serbia with European standards is an important signal of legal predictability and reliability. Such a framework helps build trust and makes it easier to work with partners from the Balkans, especially in data processing, the provision of digital services and joint participation in the EU Digital Single Market. Software solutions such as Odoo All-in-One can help significantly in meeting regulatory requirements. Odoo SA, as a company offering cloud hosting services, continuously develops its systems and tools to maintain a secure platform and apply best practices in privacy and security.
It is important to note that even when business software supports numerous regulatory requirements, responsibility for full compliance always lies with the end user — the business that uses the software. Implementing any advanced technology solution therefore requires meeting compliance requirements, defined internal procedures, properly formulated business and privacy policies, and employee training.
Odoo is one example of business software on the market where law and ethics have to keep pace with technology. For a business to be truly compliant with the legal framework, every implementation of business software must be accompanied by a precise legal analysis and technical localisation.

Key EU regulations for business software, including Odoo

Since software solutions alone are often not enough, real compliance when digitalising and optimising a business with advanced technology also means adopting internal policies, training staff regularly, and having clear protocols for managing personal data and handling data subject rights. Transparency is therefore key in business processes that involve personal data or AI-based tools.

The GDPR is the EU's fundamental regulation protecting the personal data of EU citizens. Its rules dictate how the personal data of EU citizens may be processed by businesses that operate on the EU market or use such data in their business outside the EU. As all-in-one business software, Odoo offers a range of features in this respect. However, even when implementing such a software solution, a legal review is necessary to check whether the system has been implemented in a way that complies with the legal requirements of the GDPR.

The EU AI Act, the new regulatory framework for artificial intelligence, introduces additional obligations for businesses operating in the EU. For example, Odoo uses AI to automate and personalise processes (e.g. sales forecasting, CRM segmentation), which requires a risk classification and possibly additional measures in line with the AI Act. The AI Act requires transparency, human oversight and explainability of decisions – especially for high-risk systems, and the software user must ensure this in accordance with the law. These AI Act requirements must therefore be taken into account when implementing business software.

The wider regulatory framework: related EU rules relevant to business software, including Odoo

Besides the GDPR and the AI Act, the EU has a set of legal frameworks relevant to the development and implementation of business software that must be observed if a business operates in the EU or uses the data of EU citizens.

Cookies and electronic communications fall under the ePrivacy Directive, which regulates this area. In the Odoo context, this directive matters in particular for the website modules and CRM.

The EU Digital Services Act (DSA) introduced obligations for platforms that offer services to end users. For Odoo, the DSA is relevant to modules such as eCommerce, Forum or the customer portal.

Security requirements for software systems in healthcare, education and finance fall under the NIS2 Directive.

Additional protection for the end customers of Odoo users is governed by the consumer rights package (CRD, Omnibus). These legal frameworks regulate prices, personalised offers and the transparency of reviews, which is key for the Odoo Sales module.

In the context of business software, including Odoo, the European Accessibility Act is also relevant. It requires businesses to make software and web content accessible to people with disabilities.

Finally, the scope of EU regulation depends on the sector — the more regulated the sector, the more complex the legal framework for developing software solutions.

What do EU regulations mean for businesses from BiH or Serbia that digitalise their operations and do business in the EU?

For businesses from BiH or Serbia that operate in the EU by providing services or goods there, complying with EU regulations is not a matter of choice but a legal obligation.
For example, under the GDPR the rules apply not only to businesses registered in the EU, but also to all entities outside the EU that process the data of EU citizens or offer goods and services on that market. Non-compliance with European standards can have serious consequences – from high fines and restrictions on business to the loss of trust of customers and business partners.
Compliance with regulations such as the GDPR, the AI Act and other EU legal frameworks allows businesses from BiH to operate with legal certainty and transparency and to participate on equal terms in the EU Digital Single Market.

Why is it important to consult a technical and a legal team when digitalising a business?

Digitalisation with advanced tools such as Odoo requires legal and technical experts to be involved in good time. Otherwise, gaps open up between what the software does and the actual legal obligations the user has to meet. Below we briefly present two examples that show directly why cooperation between legal and technical experts matters when developing and implementing software solutions.

1. Automated decision-making and customer profiling

In this example, if business software offers an algorithm for customer profiling or automated decision-making (e.g. offering a specific product), the legal obligations for automated decisions or profiling must be taken into account. For example, Article 22 of the GDPR provides that individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The article also provides for exceptions. Automated decision-making or profiling is permitted if the personal data were obtained with explicit consent or if it results from a contractual relationship.
The article sets out additional conditions, such as meaningful human intervention in relation to the automated decision or profiling. To put it more concretely, imagine a business that collects, processes and uses personal data for personalised advertising, on the assumption that a particular service or product could become the subject of business with the person whose data it uses.
Technically, business software, Odoo included, can provide the functionality to collect data and run such processes. However, no software can obtain the user's explicit consent for such processing or guarantee meaningful human intervention, both of which are necessary to avoid breaching Article 22 of the GDPR. The software can automatically segment customers based on their purchases and automatically send them personalised offers. If such profiling and automated decisions significantly affect the customer (e.g. prevent them from receiving a certain service or classify them as a risky customer without human review), the business using such solutions must ensure a legal basis (such as explicit consent) and provide a mechanism for meaningful human intervention, an explanation of the logic behind the decision, and a way to contest it.
So although business software is technically capable of automated decisions or profiling, it does not by itself provide all the procedural and ethical safeguards that are essential for compliance with Article 22 of the GDPR. The business must therefore define internal processes, privacy and data protection policies, complaint mechanisms and employee training to close this "compliance gap".

2. Compliance of business websites in Bosnia and Herzegovina

We analysed a significant number of businesses in BiH and their business websites with online shops. Since the new Law on the Protection of Personal Data in BiH has entered into force and largely follows the principles of the GDPR, this analysis was key to assessing how ready the BiH market is. The detailed analysis showed that many publicly available websites with online shops of businesses registered in BiH do not comply with the regulations in force in BiH. In addition, most businesses registered in BiH do not comply with EU standards either, even though they also offer their goods and services online in the EU.
The key shortcomings found on these business websites mostly concern a lack of transparency in privacy and data protection policies.
Visiting these business websites, one can see:
• That the data controller and data processor are not clearly named.
• That there is no description of the purpose and legal basis of data processing.
• That users' rights are not clearly defined and the mechanisms for exercising them are not explained.
• That information is missing about third parties with whom data is shared and about any international data transfers.
• That no data retention periods or adequate protection measures are defined.
• That cookies are not disclosed and that mechanisms for user consent (cookie consent banner) are missing.
This clearly shows the urgent need for a carefully drafted and implemented privacy and personal data protection policy that includes all key legally required elements adapted to the specifics of the new BiH law, as well as internal business policies in line with the other laws in force in BiH.
If a business operates in the EU, these same policies and documents must be aligned with EU standards and made transparent on the business website. Compliance with EU regulations is key not only to avoid high fines, but also to strengthen the business portfolio and the trust of partners and customers on the EU market, which is especially important for businesses operating beyond the borders of BiH.

What is the conclusion?

Digitalising a business without adequate legal and technical support is a serious risk for businesses operating in the EU, BiH or Serbia. Business software such as Odoo can offer powerful features, but real compliance only begins where technology meets law and ethics. That is why interdisciplinary cooperation between different teams, from the technical team to the legal and ethics team, is crucial when developing, implementing or upgrading software.

Wolfinne.com is available for comprehensive support with audits and legal and ethical advice, so that your digital transformation fully complies with all relevant regulations and best practices.