Compliance & Documentation Support

When Compliance Becomes Paperwork

Most compliance work is not a legal question — it is a paperwork problem. A customer asks for a completed supplier questionnaire by Friday. An auditor requests a folder of evidence in two weeks. A new EU regulation lands and your team needs the right templates, records, and registers in place.

For companies without a dedicated compliance team, this work piles up quickly. Deadlines slip. Inconsistent documents go out to different customers. Audits find gaps that were never substantive — just disorganized.

We solve this layer.

What We Do

We provide structured, project-based and ongoing operational support across compliance documentation tasks. Specifically:

Supplier and customer questionnaire response. We receive your customer's compliance, security, ESG, or due-diligence questionnaires, populate them with your existing documentation, identify the gaps, and return a clean, consistent submission.

Compliance documentation preparation and maintenance. We draft, structure, and maintain working documents such as records of processing activities, supplier registers, internal compliance manuals, and policy templates — based on your existing practices and the applicable framework.

Audit and certification preparation. We organize evidence and supporting documentation ahead of internal audits, customer audits, ISO certification cycles, or regulatory inspections. We do not perform the audit; we prepare the file.

Regulatory filings and submission packages. Where a regulation requires a structured submission (registers, declarations, transparency reports, periodic filings), we assemble the package, validate the data, and deliver it in the required format for your team or your legal advisor to file.

Ongoing documentation support. For clients with recurring needs, we maintain your compliance documentation library, update it as regulations evolve, and keep your supplier-questionnaire response set current.

How We Work

Project-based engagements. A defined scope, a fixed quote, and a clear timeline. Suitable for one-off needs such as preparing for a specific audit or responding to a major customer questionnaire.

Retainer engagements. A monthly engagement with a defined volume of documentation work. Suitable for clients with recurring requests, multiple customer questionnaires per quarter, or evolving regulatory obligations.

Combined with our other services. Many clients combine this work with EUDR documentation, carbon reporting, or EU representation. Cross-service work is scoped together to avoid duplication.

What We Do Not Do

We do not:

• Provide legal advice on whether your practices meet a regulatory standard
• Certify, audit, or assure your compliance posture
• Make business or operational decisions on your behalf
• Sign legally binding declarations on your behalf
• Replace your legal counsel, your auditor, or your certifying body

When a documentation task requires a substantive judgment that is your team's or your lawyer's to make, we flag it clearly and route it to the right party. We are the paperwork layer.

Who This Is For

• Mid-size international companies expanding into EU markets without an in-house compliance team
• Suppliers receiving multiple customer compliance and ESG questionnaires per quarter
• Companies preparing for ISO 27001, SOC 2, or industry-specific certification
• Organizations in regulated supply chains needing structured supplier documentation
• Startups scaling beyond founder-led compliance and not yet ready for a dedicated hire

Get Started

Send us a brief description of your business and the specific documentation challenge you are facing. We respond within two business days with a project scope, timeline, and fixed quote.

Carbon Footprint Reporting

When You Need a Carbon Number

More and more companies are being asked for their carbon footprint — by enterprise customers running supplier sustainability programs, by banks evaluating ESG-linked financing, by regulators implementing the Corporate Sustainability Reporting Directive (CSRD), or simply by their own boards. The questions sound straightforward: What are your annual emissions? Show your Scope 1 and Scope 2.

For companies without an in-house sustainability team, even producing a basic, defensible number can take weeks of back-and-forth.

What We Do

We deliver project-based carbon footprint calculations on a fixed scope and a clear timeline.

You provide:

• Utility bills (electricity, district heating, natural gas, fuel)
• Vehicle fuel records
• Refrigerant top-up logs (where relevant)
• Basic facility and operational data

We deliver:

• Structured Scope 1 (direct emissions) calculation
• Scope 2 (purchased energy) calculation, location-based and market-based
• A clear written report with assumptions, emission factors used, and methodology
• Data formatted for upload into your sustainability reporting platform, supplier questionnaire, or CSRD disclosure

How the Output Is Used

We deliver a finished report. You — or your sustainability team, your auditor, or your legal advisors — review it and upload it where it needs to go, whether that is a customer portal, a CDP submission, a CSRD ESRS E1 disclosure, or your internal reporting.

We are not the system of record for your emissions, and we do not certify or assure your numbers under any third-party verification scheme. If audit-ready third-party verification is required, we can prepare files that support that process.

Methodology

Our calculations follow the GHG Protocol Corporate Standard. Where a more specific framework applies (such as ISO 14064-1 or CSRD ESRS E1), we align the report structure to those requirements as part of project scoping.

Who This Is For

• Companies receiving carbon footprint requests from enterprise customers
• Suppliers needing data for buyer sustainability programs
• SMEs preparing for CSRD reporting through their value chain (CSRD wave 3+)
• Companies pursuing ESG-linked financing or investor disclosures
• Organizations needing a baseline before setting reduction targets

What We Do Not Do

We do not provide assurance, verification, or certification. We do not give legal or financial advice. We do not determine which framework, scope boundary, or reporting path is right for your business — those are decisions you make, ideally with your sustainability lead or external advisor.

Get Started

Send us a brief description of your operations and the reporting period you need covered. We respond within two business days with a project scope and a fixed quote.

EU Deforestation Regulation (EUDR) Documentation Support

What Changed and Why It Matters

Regulation (EU) 2023/1115, known as the EU Deforestation Regulation or EUDR, requires that seven commodities — coffee, cocoa, timber, soy, palm oil, cattle, and rubber — and products derived from them only enter the EU market if they are deforestation-free, produced in accordance with the laws of the country of origin, and covered by a Due Diligence Statement (DDS) submitted through the EU Information System (TRACES NT).

For each shipment, operators must collect, structure, and submit:

• Geolocation coordinates of every plot of land where the commodity was produced
• Date or time range of production
• Country of production
• Supplier identification
• Risk assessment and mitigation documentation
• A Due Diligence Statement referencing all of the above

The volume of paperwork involved — particularly for operators with many smallholder suppliers — is substantial.

What We Do

We provide the operational paperwork support behind your EUDR compliance.

You provide:

• Geolocation data from your suppliers (GPS coordinates, polygon files, or supplier-collected data)
• Supplier and shipment records
• Country-of-origin and legal compliance documentation from your sourcing chain

We deliver:

• Structured, validated geolocation datasets in the formats accepted by TRACES NT
• Organized Due Diligence Statement supporting documentation
• Supplier-record packages aligned with EUDR information requirements
• Clean, audit-ready files your team or your legal advisors can review and submit

What We Do Not Do

We do not provide legal advice on the application of EUDR to your business. We do not determine whether your supply chain meets the deforestation-free or legal-production requirements — that is a substantive assessment your operations and legal teams must own. We do not act as the operator or trader under the regulation.

We are the paperwork layer, not the decision-maker.

Who This Is For

This service is designed for:

• Coffee, cocoa, and timber traders sourcing from multiple producing countries
• Food and consumer goods manufacturers with EUDR-relevant inputs
• Importers without an in-house compliance documentation team
• Cooperatives and producer organizations supporting smallholder suppliers

Timelines and Deadlines

EUDR became applicable on 30 December 2025 for large operators and traders, with the SME deadline following in mid-2026. Operators must submit a Due Diligence Statement before placing relevant products on the EU market or exporting them.

If you are not already preparing your documentation pipeline, the time to start is now.

Get Started

Tell us about your supply chain and the volume of plots you need documented. We respond within two business days with a project scope and timeline.

EU REPRESENTATION SERVICES 

What "EU Representative" Actually Means

Several EU regulations require non-EU companies to designate a person or entity established in the European Union to act as a local point of contact. The most common are:

• GDPR Article 27 — for non-EU controllers and processors handling personal data of EU residents
• Digital Services Act Article 13 — for non-EU providers of intermediary services in the EU
• EU AI Act Article 22 and Article 54 — for non-EU providers of high-risk AI systems and general-purpose AI models (applicable from August 2026)
• Cyber Resilience Act Article 18 — for non-EU manufacturers of products with digital elements (applicable from December 2027)

The role is operational. The representative is the address that authorities, data subjects, or users in the EU can reach, and the person who forwards communications to the company. The representative does not make decisions on behalf of the company, does not provide legal advice, and does not assume liability for the company's underlying compliance with the substantive regulation.

What We Do

Mxis Partner ApS acts as your designated EU point of contact under a written mandate. Specifically, we:

• Provide a registered Denmark address that you list in your privacy policy, terms of service, or product documentation as required by the relevant regulation
• Receive postal mail, email, and electronic communications addressed to you in your capacity as a non-EU company subject to the regulation
• Forward all communications to your designated team contact, in their original language and with timestamps
• Maintain a log of correspondence for audit purposes
• Respond to authority inquiries with the basic acknowledgment required, while routing substantive responses back to your team or your legal counsel

What We Do Not Do

We do not:

• Provide legal advice on the substantive application of GDPR, DSA, AI Act, or any other regulation
• Draft your privacy policy, AI conformity assessment, technical documentation, or other compliance documentation
• Represent you in litigation, regulatory enforcement proceedings, or court appearances
• Negotiate on your behalf with authorities
• Make decisions about how your business should respond to a regulatory inquiry

When substantive legal interpretation is needed, you engage your own legal counsel, and we coordinate the operational handover.

Scope by Regulation

GDPR Article 27. We act as your Article 27 representative for non-EU controllers and processors. Mandate, scope, and limitations are documented in a written agreement aligned with EDPB Guidelines 3/2018.

DSA Article 13. We act as the legal representative addressee for non-EU providers of intermediary services. Note that the DSA imposes specific own-duties on the representative; our scope of mandate documents the limits clearly.

AI Act Articles 22 and 54. Available from August 2026 in line with the regulation's timeline. Contact us for advance scoping.

Cyber Resilience Act Article 18. Available ahead of the December 2027 applicability date for advance contracting.

Who This Is For

• Non-EU SaaS, AI, and IoT companies with EU customers or users
• E-commerce and online-platform operators based outside the EU
• Hardware and connected-product manufacturers selling into the EU market
• Any non-EU business listed in a privacy notice as needing an EU representative

Get Started

Tell us where you are based, what regulation triggers the requirement, and your expected volume of EU communications. We respond within two business days with a draft mandate and a fixed annual fee.