Compliance platform: Which functions will lead to audit readiness in medium-sized companies in 2026

In 2026, a compliance platform will bundle at least six regulatory obligations in one system: GDPR with Art 27001:2022 with the 93 Controls Annex A in the October 2026 version, as well as the EU AI Act with the obligations for high-risk systems effective from August 2026.

Anyone who manages these obligations in Excel, SharePoint and Outlook will fail in the first joint audit at the latest. This article explains which functions a compliance platform must cover in 2026, how classic GRC suites differ from specialised platforms and why CIVAC, as a compliance platform and officer-as-a-service, pursues the dual model: Licence the workspace for your internal representatives, or have our representatives order it.

A compliance platform in the sense of 2026 connects six domains in one workspace: data protection according to GDPR, IT security according to NIS-2 and ISO 27001:2022, supply chain care according to LkSG, whistleblower protection according to HinSchG, ESG/sustainability according to CSRD and AI compliance according to EU AI Act. Each domain has its own obligations, its own deadlines, its own auditors and its own fine levels.

Anyone who manages the six domains in five tools pays licence five times, trains employees five times and struggles with five separate data models. In the audit, the same event appears five times in five versions, depending on the tool.

The logic of an integrated platform: An incident is recorded once, then linked to the appropriate duties depending on the domain. A data breach according to Art. 33 GDPR can at the same time be a reportable security incident according to Section 32 BSIG, and the platform routes the 72-hour deadline and the 24-hour early warning to the right addressees.

A supplier risk according to LkSG can at the same time trigger an ESG reporting obligation according to CSRD and a whistleblower notice according to HinSchG. An integrated platform recognises multiple relevance and documents it consistently.

A suitable compliance platform covers ten functional areas: role register with appointment certificates, deadline monitor, reporting, audit repository with templates, incident and reporting system, training management, whistleblower protection module, ESG data model, ISO 27001 controls mapping and auditor cockpit.

An overview of the CIVAC platform functions can be found refer to civac.de/facts. Others run compliance like a filing cabinet. We run it like software.

The five mandatory domains differ significantly in terms of logic, deadlines and amount of fines, and a platform must reflect each one correctly without losing touch with the overall view. GDPR: Art. 30 list of processing activities, Art. 33 notification to the supervisory authority within 72 hours, Art. 34 notification to those affected in the event of high risk. Fine limit of up to 20 million euros or 4 percent of global group sales.

NIS-2 according to Section 32 BSIG: 24-hour early warning to the BSI, 72-hour follow-up report, one-month final report. Scope approximately 29,500 companies in Germany, divided into essential and important facilities. Fines of up to 10 million euros or 2 percent of group sales for essential facilities.

LkSG: Due diligence obligations in the own supply chain for companies with 1,000 or more employees. Risk analysis, complaints mechanism, reporting obligation by June of the following year. Fine limit of up to 8 million euros or 2 percent of group sales.

HinSchG: Internal reporting office in accordance with Section 14 for companies with 50 or more employees since December 17, 2023. Confirmation of receipt within seven days, feedback within three months. Data protection in accordance with Section 8 HinSchG with identity protection of the whistleblower.

ISO/IEC 27001:2022 with 93 controls in Annex A, transition period ends October 2025, all re-certifications from 2026 must comply with the new catalogue. Anyone who continues to use the old version 2013 will lose the certificate validity.

A platform must represent all five domains with its own deadlines, its own templates and an overarching view. The NIS 2 implementation in Germany is a separate focus.

A compliance platform 2026 fully covers ten functional areas. Firstly, the role register with appointment certificate, representation regulations and reporting line for each representative role, from DPO to ISB to hygiene officer. CIVAC maps all 25 mandatory roles.

Secondly, the deadline monitor with legal deadlines, reappointments, training requirements and escalation to management. Configurable lead times per deadline are a minimum requirement.

Thirdly, reporting with ready-made templates per role and documented acknowledgment in accordance with Section 38 (3) BDSG. Fourth, the audit repository with templates, protocols and receipts in a searchable repository. CIVAC provides 490 ready-to-use audit templates.

Fifth, the incident and reporting system with its own timers for 72h GDPR reporting and 24h/72h NIS 2 reporting path. Sixthly, the training management with participant lists, learning objectives and completion certificates.

Seventhly, the whistleblower protection module according to Section 14 HinSchG with identity protection, confirmation of receipt and three-month feedback timer. Eighth, the ESG/CSRD data model with risk analysis, complaint mechanism and reporting structure.

Ninth, the ISO 27001 controls mapping with the inclusion of the 93 controls of Annex A 2022 in the internal statement of applicability. Tenth, the auditor cockpit with time-limited read access for external auditors.

If you miss one of these ten functions, buy an isolated solution and integrate it twice in the second audit at the latest, in the form of additional consulting days and parallel tables. An overview of the roles can be found at civac.de/roles.

A reliable catalogue of requirements for a compliance platform contains 14 criteria that are bindingly checked in the tender. Firstly, the coverage of the mandatory domains: GDPR, NIS-2, LkSG, HinSchG, ISO 27001:2022, EU AI Act. Which domain is configured out-of-the-box and which has to be modelled by the customer?

Secondly, the appointment certificate generation with a qualified signature tool and audit-proof version management. Thirdly, the deadline monitor with escalation. Fourthly, the reporting system with documented knowledge of the management.

Fifthly, the audit template collection with a specific number per domain. Sixth, the incident module with its own timers for 72h-GDPR and 24h/72h-NIS-2. Seventh, training management. Eighth, the provider's ISO/IEC 27001:2022 certification and EU data residency.

Ninth, the interfaces to HR, IAM and ticket systems via standardised APIs. Tenth, the full exportability of the data in PDF, JSON and CSV. Eleventh, the authorisation concept with role-based access and audit trail.

Twelfth, the auditor read access with time-limited validity. Thirteenth, the multilingualism model for German and English in identical depth. Fourteenth, the service level agreement with defined response times, availability and reaction times in incident management.

Audit-proof, documented, § 32 BSIG-proof. The CIVAC Facts page documents each criterion openly and reproducibly.

If you let a provider pass one of these 14 criteria, you will buy a later edition. The methodical test costs a few hours, but saves months of renegotiation.

A compliance platform manages extremely sensitive data: appointment certificates with personal data, data protection incident reports, whistleblower notices with identity protection according to § 8 HinSchG, ESG risk assessments with supply chain information, audit findings with vulnerability descriptions.

If the platform itself is not secured, it undermines the compliance that it is supposed to organise. It creates a new concentration risk at a central point, which in the worst case scenario affects all domains at the same time.

The minimum requirement for the provider is a valid ISO/IEC 27001:2022 certification with the updated Annex A. The old version 2013 is no longer sufficient, the transition period ended in October 2025, all re-certifications from 2026 must have the complete 93 Controls catalogue

EU data residency is the second mandatory minimum requirement. According to Schrems II and SCC 2021/914, data processing in the USA, India or Singapore is only permitted with transfer impact assessment and additional measures.

For a platform that processes HinSchG notices or Section 26 BDSG employee data, the ongoing effort for US hosting is disproportionate. The DSK has repeatedly made it clear that European hosting solutions are preferable for particularly sensitive data.

CIVAC hosts exclusively in the EU with German data centres as the primary location, geo-redundant backup in the EU and no data access from US parent companies. The ISO/IEC 27001:2022 certification has been completed, which documented 93 controls and transferred them to the workspace security model.

Audit-proof, documented, § 32 BSIG-proof. Details can be found at civac.de/facts.

The licence costs are only part of the total costs and are usually the smaller ones. A realistic three-year statement includes six items. Firstly, the platform licence: For specialised providers, the annual fee is between 8,000 and 60,000 euros, staggered according to the number of employees and modules. For classic GRC suites, the licence volume starts at 40,000 euros per year.

Secondly, the introduction costs: from the consulting workshop to the configuration to the migration of legacy data from Excel, Word and SharePoint. CIVAC launches in four weeks, classic suites take six to 18 months.

Thirdly, the training costs for internal representatives, management, HR and IT. Professional training costs between 200 and 500 euros per participant per day.

Fourthly, maintenance and support with 15 to 22 percent of the licence fee annually. Fifth, personnel costs for internal or external representatives. An external DPO is between 420 and 4,400 euros per month, an external ISB between 2,000 and 7,000 euros.

Sixth, the opportunity costs of missed deadlines and fines. An NIS 2 breach of duty costs essential companies up to 10 million euros or 2 percent of group sales, important companies up to 7 million euros or 1.4 percent.

The CIVAC logic follows from this six-column invoice: Licence the workspace for your internal representatives, or have our representatives order it. The combination often covers the needs at 50 to 70 percent of the costs of classic consulting solutions.

A compliance platform must be productive in less than four weeks, otherwise it will fail in its purpose and tie up consultants' budget without producing any results. The CIVAC standard schedule is divided into four weeks with clearly defined delivery results.

Week one: inventory. In a two-hour kickoff, existing orders, current representatives, open deadlines and reporting lines are transferred into a common data model. The platform is configured, the role catalogue is narrowed down, the authorisation concept is coordinated with IT and HR.

Week two: migration of legacy data. Existing appointment certificates, report protocols, audit findings, proof of training and open action plans are uploaded and linked to roles and deadlines.

Week three: Training the users. Representatives, management, HR team and IT contacts each go through a role package with practical exercises and learning objective monitoring. The first regular reports are collected.

Week four: dry run. A tabletop audit simulates an audit by a supervisory authority, a data breach scenario according to Art. 33 GDPR with a full 72-hour deadline and an NIS 2 report according to Section 32 BSIG with 24-hour early warning.

Weaknesses are remedied, templates are supplemented, reporting channels are verified. At the end of week four, the platform is productive. Deadline begins as soon as we become aware of it. If you take longer, you are either buying the wrong product or underestimating the preparation. CIVAC supports with a permanent implementation team, which transfers to regular operations after go-live.

Seven errors appear in almost every second tender in the German market. Firstly, the choice of a pure data protection suite, which must later be expanded to include ISB, fire protection, hygiene and ESG. The integration of several isolated solutions often costs twice as much as an integrated platform in a three-year comparison.

Secondly, the underestimation of the data protection requirements for the platform itself. If the provider hosts in the USA or does not have ISO/IEC 27001:2022 certification, purchasing creates a new risk and prolongs the audit preparation.

Thirdly, the reliance on demo versions without trial operation with real data. A configured demo does not show how the platform handles real data volumes and special cases.

Fourth, the lack of definition of the reporting path in the configuration phase. A platform that does not route reports to anyone and does not document any acknowledgment is an Excel spreadsheet in modern packaging.

Fifth, the neglect of the interfaces to HR, IAM and ticket systems. Anyone who maintains master data manually will fail with the twentieth new employee at the latest.

Sixthly, the lack of practice in dealing with data breaches and incidents. The 72h deadline according to Art. 33 GDPR and the 24h/72h reports according to Section 32 BSIG must be carried out at least once a year.

Seventh, the missing exit strategy. Contracts must contain clear data export regulations, defined formats and a maximum return period so that a change of provider is possible without data loss. The CIVAC FAQ answers every point with specific contractual clauses. The auditor calls, the evidence is ready.

A compliance platform in 2026 is not a question of category, but of the depth of implementation. CIVAC offers two paths to the same audit-proof result, and both rely on the same workspace with the same templates, deadlines and reporting channels.

Way one: You manage the representatives internally and licence the CIVAC workspace. Your representatives work in the same system with a uniform data model, the audit templates are stored, the deadline monitor is running, auditor read access is prepared.

Way two: You let CIVAC appoint the representatives as an officer-as-a-service. Our representatives are appointed DACH-wide, the reports are delivered quarterly to your management, the ASA and audit appointments are organised.

Licence the workspace for your internal representatives, or have our representatives appointed. Both paths lead to the same compliance platform and officer-as-a-service.

Turn reading into a mandate. Speak to us at info@civac.de or using the contact form on civac.de, stating the relevant domains, number of employees and locations.

You will receive a structured proposal with module selection, fee range and four-week implementation plan within two working days. The appointment certificate, signed, filed, verifiable.