External compliance consulting 2026: hourly rates, flat rates, fee models

Since the tightening of Section 130 OWiG through the Association Sanctions Act reform package and the expansion of supervisory obligations to supply chains (Sections 3 ff. LkSG, in force since January 1, 2023), the demand for external compliance advice in German medium-sized companies has noticeably increased. Anyone who hires an external compliance officer is rarely looking for a theoretical report, but rather a person with an appointment document, reporting line and an audit-proof workspace in the background. The range of fines according to Section 30 OWiG (up to 10 million euros) and § 130 OWiG (up to 1 million euros for breach of supervisory duty) makes the question of costs a business routine.

This article explains how hourly rates and flat rates will be structured in 2026, when which model is worthwhile and what managing directors should pay attention to in the comparison offer. CIVAC operates a compliance platform and Officer-as-a-Service with transparent pricing logic: Licence the workspace for your internal representatives, or have our representatives order it. Both models end with the same evidence and the same reporting line to management.

External compliance consulting in Germany will be billed in 2026 according to three basic models: hourly fee, monthly flat rate and project flat rate. Each model has its own economic logic and its own distribution of risk between client and consultant.

The hourly fee is the most transparent form: the consultant records his hours, the client pays based on effort. Realistic hourly rates for 2026 are between 160 and 320 euros net, depending on seniority, specialization (data protection, money laundering, ESG, antitrust law), industry focus and location. Junior consultants in large cities start at 140 euros, partners with an industry focus reach 380 euros and above.

The monthly flat rate fixes a scope of services for a fixed fee. It is suitable for ongoing support, for example for the role of external compliance officer according to Section 91 (2) AktG, for the DPO function according to Section 38 BDSG or for the money laundering officer role according to Section 7 GwG. Flat rates allow for planning, but require a clear service description with a quantity structure.

The project flat rate covers one-off implementations or audits. It is typically agreed upon when introducing a compliance management system (CMS) according to IDW PS 980 or when initially implementing an ESG reporting framework. The costs range from 8,000 euros for a compact CMS setup in a small company to 65,000 euros for a medium-sized full implementation with three to five representatives.

Which model is worth it depends on the density of advice. If you use less than 30 hours per year, you can travel cheaper with an hourly fee. If you need more than 80 hours or have agreed on an order for the officer role, you should switch to the flat rate.

CIVAC delivers a compliance platform and officer-as-a-service with clear flat-rate models and an order period of 2 working days instead of the classic 2 to 6 weeks on the market. You can find more details in the CIVAC FAQ.

If you compare hourly rates for external compliance consulting, you should distinguish between five levels of seniority because the terms are not used consistently in the market. The hourly rates are net values ​​excluding travel times and expenses and correspond to market observations for 2026.

Junior consultants with one to three years of professional experience typically charge 140 to 180 euros per hour. You will carry out research, documentation, preparation of directories and standard audits. This level is generally not suitable for independent client management because the supervisory authorities consider experience as an element of specialist knowledge.

Senior consultants with four to eight years of experience cost 180 to 240 euros per hour. You manage individual mandates independently, coordinate with the management and provide technical depth in special questions. This level is the standard choice for ongoing compliance support in medium-sized businesses.

Managers and principals with eight to fifteen years of experience charge 240 to 290 euros. You manage several mandates, supervise junior employees and advise in complex constellations, such as group-wide compliance programs or the interface between data protection and information security.

Directors and partners with an industry focus or specialization in difficult areas (money laundering, antitrust law, sanctions, ESG, EU AI Act) range from 280 to 380 euros. In law firms, top rates of 480 euros and above are reached, but the services then overlap with legal advice and are subject to other professional rules.

Boutique providers with a clear special focus, for example only data protection or only money laundering, are often 10 to 20 percent lower than large consultancies, but compensate for this with in-depth knowledge of methods. CIVAC bundles the ordering and reporting routine in the workspace, so that the hours of an external consultant flow directly into an auditable file.

The monthly flat rate is the standard model for ongoing compliance support in medium-sized companies. It typically covers the appointment of an external representative, an agreed number of hours per month, the response time to inquiries, participation in board meetings and the annual compulsory training of employees.

Small companies with up to 50 employees pay 380 to 720 euros net per month for an external DPO function, and 850 to 1,400 euros net per month for a combined DPO/compliance consultation. Anyone who additionally appoints an external compliance officer in accordance with Section 91 (2) AktG will receive a monthly flat rate of between 1,100 and 1,800 euros.

Medium-sized companies with 100 to 500 employees range between 1,400 and 3,200 euros per month for integrated compliance support. This typically includes DPOs, compliance officers and money laundering officers or the interface to money laundering, depending on the industry.

Larger medium-sized companies with 500 to 2,500 employees pay 3,200 to 4,800 euros per month, often in a multi-part contract with a clear separation of officer roles. Companies above this work with dedicated service level agreements in which hourly quotas, response times and escalation paths are agreed.

The range is explained less by the hourly prices than by the scope of the audit templates supplied, by the availability of the training formats and by the agreed service level for data breach reports in accordance with Art. 33 GDPR or NIS 2 incidents. Flat rates without clear audit templates are often the more expensive option in practice.

CIVAC operates 490 ready-to-use audit templates and 93 controls according to ISO/IEC 27001:2022, which are included in the flat rate. Licence the workspace for your internal representatives, or have our representatives order it. Both paths end with the same evidence and no hidden hourly billing. Audit-proof, documented, § 130-proof.

A serious compliance flat rate describes the scope of services in an appendix to the contract so that the client has comparable sizes in the comparison offer. The following components should be listed explicitly because in the event of a dispute they make the difference between consultation time and compliance.

Firstly, the formal appointment of the representative role with an appointment document, reporting line and representation regulations. Anyone who does not provide an appointment certificate is not selling an agent, but rather consulting hours. Secondly, a defined hourly quota per month for ad hoc inquiries, typically 4 to 12 hours depending on size.

Thirdly, the creation and annual updating of the list of processing activities in accordance with Art. 30 GDPR for DSB mandates, the money laundering risk analysis document in accordance with Section 5 GwG in the case of money laundering mandates or the ESG risk analysis in accordance with Section 5 LkSG Supply chain mandates. Fourth, the annual compulsory training of employees with proof of participation and audit protocol.

Fifth, the handling of incidents with a clear service level. Data breaches according to Art. 33 GDPR must be reported within 72 hours, NIS 2 incidents must be warned within 24 hours and a follow-up report must be provided within 72 hours. Anyone who does not agree on a clear response time is not entitled to priority support in an emergency.

Sixthly, monthly or quarterly reporting to the management with a documented report protocol. Seventh, participation in annual audit preparation and external audits with a clear mandate. Eighthly, insurance for the consultant's professional liability with sufficient coverage.

CIVAC supplies all of these components in a standardised manner. Anyone who appoints an external compliance officer will receive the appointment certificate within 2 working days and an active workspace from day 1. The appointment certificate, signed, filed, verifiable.

The nominal flat rate is not the only cost driver. Four factors significantly increase the overall costs and are often not adequately disclosed in comparison offers. Anyone who knows these positions can negotiate more robustly and avoid additional demands.

Firstly, the overtime quota. Flat rates usually cover 4 to 12 hours per month. Those who need more pay additional hours at the agreed hourly rate, which is often 10 to 20 percent above the market price. Major incidents or government requests can add 30 to 60 additional hours in a month.

Secondly, travel costs and travel time. Some consultants charge travel at half the hourly rate, some at the full rate, some at a flat rate. The difference can amount to several thousand euros per year for monthly on-site appointments.

Thirdly, special reports and statements. If the supervisory authority requests a statement, if a new market is opened or if a data breach reporting path needs to be reconstructed, special fees apply. These are rarely quantified in comparison offers and can range between 4,000 and 25,000 euros.

Fourth, tool costs. Anyone who uses a consultant's own compliance tool often pays additional licence fees per user or per location. If the consultant changes, these licences move with the consultant, so that in the event of a change the client loses the entire database or migrates it for an additional charge. That's a significant commitment.

CIVAC deliberately works differently. The workspace licence belongs to the client. If the agent role changes, the files remain with the client, the audit trail remains intact, and the reporting line remains documented. EU data residency is ensured throughout. Others run compliance like a filing cabinet. We run it like software.

The fees for compliance consulting vary not only depending on the size of the company, but also by industry and risk class. Heavily regulated industries pay higher hourly rates because the consultant's professional depth and personal liability risk are higher. This differentiation will be standard market practice in 2026.

In the financial services sector with MaRisk, BaFin supervision and the Money Laundering Act, the hourly rates are 25 to 40 percent higher than the general middle class. An external money laundering officer according to Section 7 GwG typically costs 1,800 to 4,500 euros per month, a BaFin-approved compliance officer 3,500 to 7,500 euros.

In the healthcare sector with MPDG, social codes and special data categories according to Art. 9 GDPR, the rates are 15 to 25 percent above the medium-sized company level. Hospitals and care facilities need DPOs, hygiene officers and QMBs in parallel, so that bundling the mandates brings cost advantages.

In the manufacturing and construction industries, the rates are close to the market average, but the requirements are growing significantly due to the LkSG (since January 1, 2024 for companies with 1,000 employees or more) and the CSRD reporting obligations. ESG officers with a supply chain focus cost 2,200 to 5,500 euros per month.

In the IT and SaaS areas, data protection, information security according to ISO 27001:2022 and the EU AI Act come together. NIS-2 has created additional obligations since national implementation came into effect. An integrated mandate consisting of DSB, ISB and AI compliance costs 3,500 to 6,500 euros per month.

If you bundle compliance mandates across several roles, it will be cheaper than with three individual contracts. CIVAC offers all 25 representative roles from one platform and thus avoids interface losses. The reporting line to management is consolidated. More about the overall overview in the role catalogue.

Anyone who obtains a comparative offer for external compliance advice should ask seven questions that, in practice, most often lead to price differences. The answers to these questions explain 80 percent of the price range in the market and protect against renegotiations after the contract has been concluded.

Firstly: Is the appointment certificate included or does the provider only sell consultation hours? Secondly: How many hours per month are included in the flat rate and at what rate are additional hours billed? Third: Which audit templates are included in the scope of delivery and how many are actively maintained by the provider?

Fourth: What service level applies to data breaches according to Art. 33 GDPR or NIS 2 incidents according to § 32 BSI-KritisV? Fifth: Is EU data residency guaranteed contractually and which ISMS does the provider maintain itself? An ISO 27001:2022 certificate is a realistic minimum for external compliance providers in 2026.

Sixth: What professional liability insurance does the consultant have and how much coverage? A minimum cover of 3 million euros per claim is common in medium-sized companies, and 5 million euros for larger mandates. Seventh: What happens to the files in the event of termination? Does the database remain with the client or with the consultant?

The answers to these seven questions should be in writing in the appendix to the consulting contract. Only then can the flat rate be evaluated economically and compared with competitive offers. Anyone who avoids one of these questions is selling hours, not compliance.

CIVAC answers each of these questions in writing in the mandate agreement: 490 audit templates, 93 controls according to ISO/IEC 27001:2022, 72-hour response to GDPR incidents, EU data residency, ISO 27001:2022 ISMS, 5 million euros professional liability, files remain with Clients. The auditor calls, the evidence is ready.

The decision between internal staffing and external appointments is a question of calculation. In 2026, an internal full-time position for compliance officer will cost between 95,000 and 165,000 euros an annual salary including employer contributions, depending on region, seniority and industry. There is also a training budget, tool licences and a replacement cushion.

If you finance a full-time compliance position, you should calculate at least 110,000 to 200,000 euros in total costs per year. If you don't need a full-time position, an external flat rate is cheaper, because a monthly flat rate of 3,500 euros only amounts to 42,000 euros per year.

The rule of thumb: If you need a full-time compliance function that is constantly busy, for example with more than 1,500 employees or in highly regulated industries, it is worth filling it internally. Those who have less load or are just setting up can drive cheaper externally and benefit from the provider's broader market observation.

A hybrid variant will be the most common solution in medium-sized companies in 2026: an internal compliance manager (often located in the legal department or in risk management) controls the program and uses an external compliance platform for representative roles, audit templates and reporting. This variant combines market proximity with platform efficiency.

However, the combined solution requires a platform that allows both: internal ordering and external ordering. Licence the workspace for your internal representatives, or have our representatives order it. CIVAC supports both paths without duplicating work because the same audit templates, reporting formats and escalation paths are used.

You can find more about the strategic classification of the compliance function in the CIVAC article on NIS 2 implementation in Germany, which describes the interface between compliance officer and ISB in detail.

External compliance advice only has an economic impact when the hours end in an auditable file. CIVAC operates its compliance platform and Officer-as-a-Service precisely for this purpose: every hour becomes a task, every task becomes an owner, every owner becomes a documented result with a deadline and proof. The audit trail is created during ongoing operations, not during audit preparation.

The model is deliberately two-stage. Licence the workspace for your internal representatives, or have our representatives order it. Both paths lead to the same file: appointment certificate, signed, filed, verifiable. 490 ready-to-use audit templates, 93 controls according to ISO/IEC 27001:2022, NIS 2 reporting path and 72-hour response to GDPR incidents are productive from day 1.

The order duration is 2 working days instead of the classic 2 to 6 weeks on the market. EU data residency is ensured throughout. In the comparison offer, the flat rate pays off compared to the hourly fee for around 30 consulting hours per year, because the platform connection increases hourly productivity and significantly shortens audit preparation.

If you want to take the step from the classic consulting contract to an auditable workspace, write to info@civac.de or use the contact form on civac.de. Turn reading into an assignment. The initial discussions typically last 30 minutes and end with a specific general indication based on the number of employees, industry and desired representative roles.

The onboarding takes 2 working days and ends with a signed appointment certificate and active workspace access. Directory, reporting path, training plan and audit plan are live from day 1. The monthly reporting to the management takes place from the same workspace.

Once you work like this, you rarely go back to the timesheet. Others run compliance like a filing cabinet. We run it like software. The difference will be visible in the first audit and in report format in the second board meeting.