Mandatory legal pages not visible

In Germany, commercial websites need an imprint (Section 5 DDG) and a privacy policy (Article 13 GDPR), both clearly identifiable and reachable from every page. In Austria the same duty follows from Section 5 ECG and Section 25 MedienG; in Switzerland, Article 3(1)(s) UCA requires provider identification for commercial online offers and Article 19 revFADP the information about data processing. The finding cites the provision of the jurisdiction it detected.

In AI and no-code projects this is missing almost systematically: the generator builds the product page and does not think about mandatory legal pages. As long as the project is a prototype among friends nobody notices — with the first real customer outreach it becomes a genuine liability.

We check this deliberately only where a connection to Germany, Austria or Switzerland is recognisable (host suffix or lang attribute), and report it as a note rather than a security gap. Fix: create both pages and link them permanently in the footer. This is a technical assessment, not legal advice.