Compliance: Covering All 12 Officer Roles in a Structured Way

German law recognises more than 25 formally appointable officer roles, of which between eight and twelve may simultaneously be mandatory for a typical mid-sized company. § 130 OWiG establishes personal liability for management when supervisory duties are violated because mandates are not filled or are not evidenced in writing. The fine risk ranges depending on the standard from several thousand euros to €10 million for NIS-2 violations.

This article provides a structured overview: which roles are typically mandatory, how to assess the appointment obligation for your company, where coordination gaps arise and how a central platform closes the gaps without purchasing a separate solution for each role. All role references are based on the legal bases in force in May 2026.

The appointment obligation depends on sector, company size and specific activity. Nevertheless, eleven roles can be identified for SMEs that are frequently mandatory across all sectors.

The widest scope belongs to the Data Protection Officer (DPO) under Art. 37 GDPR, § 38 BDSG: from 20 persons regularly processing personal data, appointment is mandatory. The Compliance Officer (CO) under § 130 OWiG, IDW PS 980 is not always formally required by law, but is de facto mandatory in every company with more than 50 employees, as the supervisory duty of management otherwise cannot be structurally fulfilled.

The Information Security Officer (ISB/CISO) under §§ 30, 38 BSIG and ISO/IEC 27001:2022 becomes mandatory for around 29,500 companies in Germany through NIS-2 from October 2024. The Occupational Safety Specialist (SiFa) under § 5 ArbSchG is required from the first employee as soon as risk assessments under § 5 ArbSchG arise. The Fire Safety Officer (BSB) under DGUV I 205-023 and DIN 14095 is triggered by a building permit or an occupational safety requirement.

The Anti-Money Laundering Officer (GwB) under § 7 GwG covers financial service providers, estate agents, tax advisers and other obliged entities under § 2 GwG. The Quality Management Officer (QMR) under DIN EN ISO 9001:2015 is de facto mandatory in certified supply chains. The Supply Chain Compliance Officer (LkSG) under § 4 LkSG is legally required from 1,000 employees. Added to this depending on sector are Hazardous Substances Officers, Environmental Officers and others. The complete checklist can be found on the CIVAC roles overview page.

The appointment obligation does not arise universally but from three assessment criteria: the legal form of the company, the number of employees and the specific activity. Evaluate these criteria separately for each role, not once for the company as a whole.

For the DPO: the decisive factor is not the total number of employees but the number of persons who regularly process personal data. Art. 37 para. 1 lit. b GDPR requires appointment regardless of headcount when the core activity consists of large-scale processing of sensitive data.

For the Occupational Safety Specialist, the scope of occupational medical care is governed by DGUV Regulation 2 (Annex 2) and the type of operation. Operations with particular hazards – e.g. warehouses, production facilities, construction sites – have higher care times than office operations.

For the Anti-Money Laundering Officer under § 7 GwG: the obligation does not begin at a minimum size but on being an obliged entity under § 2 GwG. Even a GmbH that acts as an estate agent can be subject to the obligation.

A structured inventory is recommended at least once a year, as legislation and company size change. The deadline runs from awareness: when an auditor asks at an inspection, the evidence must be available, not announced.

The following overview consolidates the twelve roles most frequently simultaneously mandatory in German SMEs. The primary legal basis is given for each role.

• Data Protection Officer (DPO): Art. 37 GDPR · § 38 BDSG
• Compliance Officer (CO): § 130 OWiG · IDW PS 980
• Information Security Officer (ISB/CISO): §§ 30, 38 BSIG · ISO/IEC 27001:2022 · NIS-2
• Occupational Safety Specialist (SiFa): § 5 ArbSchG · DGUV Regulation 2 · § 6 ArbSchG
• Fire Safety Officer (BSB): DGUV I 205-023 · DIN 14095 · ASR A2.2
• Hazardous Substances Officer (GSB): § 6 GefStoffV · TRGS 400 · TRGS 510
• Environmental Officer (UsB): BImSchG · WHG · KrWG · ISO 14001
• Anti-Money Laundering Officer (GwB): § 7 GwG · FIU notification obligation
• Quality Management Officer (QMR): DIN EN ISO 9001:2015
• Supply Chain Due Diligence Officer (LkSG): § 4 LkSG · BAFA report
• Equal Opportunities Officer (AGG): § 13 AGG · BGleiG
• Internal Whistleblowing Reporting Officer: § 12 HinSchG · EU Whistleblower Directive 2019/1937

Added to this are sector-specific roles, such as the Occupational Physician under § 3 ArbSchG, the Dangerous Goods Officer under § 3 GbV and ADR, and the Hygiene Officer under § 36 IfSG. Companies in industry, logistics or healthcare may thus have 15 to 18 simultaneously mandatory mandates.

The actual risk rarely lies in the missing appointment itself. It lies in the missing coordination between appointed officers and management, and in the missing shared evidence. Several structural problems arise regularly.

Problem 1: Isolated documentation. Each officer maintains their own filing system, often in different systems. In an external audit by the data protection authority, the trade supervisory office or an ISO auditor, management must compile from multiple sources what should be available in a unified audit log.

Problem 2: Different reporting lines. The DPO reports directly to management (Art. 38 para. 3 GDPR), the Anti-Money Laundering Officer to management under § 7 para. 6 GwG, the ISB to management under §§ 30, 38 BSIG. Without a central reporting line system, management does not know which notifications are outstanding.

Problem 3: Fragmented training records. Mandatory training applies to different groups: GDPR training for all employees, hazardous substances briefing for exposed workers, fire safety briefing for evacuation helpers. An auditor requesting training records expects a consolidated overview, not ten different spreadsheets.

Problem 4: No shared deadline monitoring. Different standards prescribe different repetition intervals: annually under DGUV Regulation 2, every three years under some ISO requirements, event-driven under § 5 ArbSchG. Without centralisation, deadlines are forgotten.

Each of the twelve roles can be filled internally or externally. The choice has legal and organisational consequences that should be assessed in advance.

External appointment is explicitly permitted for the DPO (Art. 37 para. 6 GDPR), the Anti-Money Laundering Officer (§ 7 para. 2 GwG with BaFin approval requirement for institutions), the Compliance Officer, the Hazardous Substances Officer and others. For the Occupational Safety Specialist, § 19 ArbSchG expressly governs external care via inter-company services. For the ISB under BSIG, the law contains no restriction; the external solution is common.

Internal appointment protects against conflicts of interest for the DPO only partially, as Art. 38 para. 6 GDPR does not permit the internal DPO to take on other tasks that lead to a conflict of interest. Managing directors, authorised signatories and IT managers are thus often excluded as internal DPOs.

For external appointment: the appointment certificate must be issued in writing and clearly identify the essential mandates. Audit practice shows that oral or email-based mandates are insufficient. Appointment certificate, signed, filed, verifiable – that is the minimum requirement of every supervisory authority.

For companies outsourcing multiple roles externally, a framework agreement is recommended that uniformly governs reporting line, availability, response time and handover procedure. Otherwise a patchwork of individual contracts arises that makes coordination more difficult and audit evidence more complex.

A platform covering all officer roles must deliver more than a task list. It must map the structural logic of individual roles – knowing that a DPO audit has different steps than a hazardous substances assessment, and that a NIS-2 notification obligation triggers different deadlines than a data protection access right under Art. 12 GDPR.

Concretely this means: for each role, role-specific task templates are needed that pre-structure the recurring activities. A Data Protection Officer regularly maintains records of processing activities (Art. 30 GDPR), reviews data protection impact assessments (Art. 35 GDPR) and documents data breaches (Art. 33 GDPR). An Anti-Money Laundering Officer conducts risk analyses under § 5 GwG, monitors suspicious transactions and files FIU notifications. These workflows must be pre-configured, not rebuilt each time.

In addition, a shared audit log is needed, to which management has cross-role access. Supervisory authorities do not ask about individual roles; they ask whether the company is structurally compliant. An audit log that bundles DPO activities, ISB measures and LkSG reports in one export format is therefore not a convenience but a functional requirement.

Finally, the platform must centrally manage training records. The DGUV auditor asks for fire safety briefings; the ISO auditor asks for ISMS training; the data protection authority values GDPR training certificates. All records must be retrievable from one source.

The coordination of multiple officers is a management task that is frequently underestimated in corporate practice. The legislature addresses this only indirectly: § 130 OWiG requires management to fulfil supervisory duties, which includes ensuring appointments, reporting lines and evidence.

In practice this means: management must be able to answer at any time who is currently appointed as which officer, since when, on what contractual basis, with what reporting line and with what evidence of the last training or audit measure. This requirement regularly exceeds a spreadsheet when more than four roles are simultaneously filled.

Coordination need also arises at the interfaces between roles. A data protection incident under Art. 33 GDPR can simultaneously be a NIS-2 security incident under § 32 BSIG, triggering a 24-hour initial notification to the BSI. The 72-hour GDPR deadline runs in parallel. If DPO and ISB do not act in a coordinated manner, deadlines can be missed.

A further interface topic is the Supply Chain Compliance Officer: their risk analysis under § 5 LkSG draws on data also managed by the Environmental Officer (CO2 emissions, waste management) and the Quality Management Officer (supplier audits under ISO 9001). Without coordinated data access, duplicated work and contradictions in the BAFA report arise.

Others manage compliance like a filing cabinet. Coordination of this quality requires a structural solution, not more meetings.

When filling multiple officer roles, recurring errors arise that lead to objections in external audits.

Error 1: Appointment certificate missing or incomplete. For the DPO, Art. 37 para. 5 GDPR requires formal designation. For the Anti-Money Laundering Officer, § 7 para. 6 GwG provides for written designation to the supervisory authority. An informal email is insufficient. Solution: document each appointment with a structured certificate showing name, function, legal basis and reporting line.

Error 2: Conflict of interest not assessed. For the DPO the prohibition under Art. 38 para. 6 GDPR applies directly. For the Compliance Officer and the Anti-Money Laundering Officer, independence is not explicitly required by law, but is expected by authorities. Assigning the IT manager simultaneously as ISB and as decision-maker on IT investments creates a structural conflict of interest.

Error 3: Training records for the officer themselves are missing. The officer must themselves be trained and qualified. For the Occupational Safety Specialist, § 7 ArbSchG establishes minimum qualifications. For the Hazardous Substances Officer, TRGS 400 recommends specific technical knowledge. Missing qualification records for the officer themselves are cited in audits more frequently than missing employee training.

Error 4: No deputy arrangement. If the sole DPO is on holiday and a data breach occurs, the 72-hour deadline under Art. 33 GDPR runs regardless. A documented deputy arrangement is mandatory for all time-critical roles. Review the deputy arrangement for DPO, ISB and Anti-Money Laundering Officer at least every six months.

The question of whether a company should manage all officer roles on one platform arises as soon as more than four mandates are simultaneously active. Beyond this threshold, the coordination effort exceeds the implementation effort of a central solution.

CIVAC is a compliance platform and Officer-as-a-Service that today covers all 25 officer roles. This includes the eleven typically mandatory roles and 14 sector-specific mandates. For each role, role-specific task templates, audit templates and training modules are available. The shared workspace ensures the unified audit log across all roles.

The model is flexible: Licence the workspace for your internal officers or appoint our officers. Both paths use the same workspace, the same document structure and the same audit log. Many companies combine both: the internal Data Protection Officer works on the licensed workspace, while the Information Security Officer is appointed externally via CIVAC.

The auditor calls and the evidence is ready. With 490 ready-to-use audit templates and a structured reporting line system, CIVAC creates the structural prerequisites for all mandates – whether filled internally or externally – to be managed audit-ready. CIVAC delivers contract, person and certificate for external appointment in two working days, compared with the classic two to six weeks.

Turn reading into action. If you wish to examine which of the twelve roles are mandatory for your company and how a coordinated solution might look, write to info@civac.de.