IT compliance in Germany: Obligations, structures and a resilient blueprint for SMEs

IT compliance refers to compliance with all legal, regulatory and contractual requirements for IT systems. In Germany, the GDPR (Art. 32), the IT Security Act 2.0, the NIS 2 implementation of 2026, GoBD requirements from Section 146 AO and industry-specific requirements such as BAIT, VAIT or TISAX overlap. Around 29,500 companies are directly affected by NIS-2 alone.

This article summarizes the five mandatory axes of IT compliance, names typical gaps in SMEs and shows a blueprint that combines roles, templates and reporting lines into an auditable system. You will find out when a compliance officer is sufficient and when an additional information security officer is mandatory.

IT compliance is not a law in itself, but rather a bracket around five mandatory worlds. Firstly, data protection according to GDPR and BDSG with a list according to Art. 30, data protection impact assessment according to Art. 35 and reporting obligation according to Art. 33. Secondly, information security according to IT-SiG 2.0, NIS-2 and ISO/IEC 27001:2022.

Thirdly, the accounting according to Section 146 AO and the GoBD, which regulate the obligation to record, immutability, traceability and archiving of digital documents. Fourthly, industry law, such as BAIT for banks, VAIT for insurance companies or TISAX for automotive suppliers.

Fifth, contractual obligations from customer and supplier contracts, NDA, service level agreements and order processing contracts in accordance with Article 28 GDPR. This layer is often underestimated, even though it regularly produces findings in audits.

The five axes share data objects and processes. A single asset, such as a CRM system, is simultaneously relevant to data protection law, subject to information security, relevant to accounting and subject to contractual requirements.

Operating the axes separately creates additional effort and inconsistencies. An integrated model with a common asset register, a risk matrix and a catalogue of measures reduces the effort and makes the auditor's appointment predictable.

The CIVAC platform maps all five axes in one workspace, with a common database and role-based access for compliance officers, ISB and DPO.

The GDPR defines in Article 32 the obligation to take appropriate technical and organisational measures. These must be chosen in a risk-oriented manner, documented and checked regularly. General formulations such as State of the art are not sufficient without concrete measures.

The List of processing activities in accordance with Article 30 is mandatory, which is generally mandatory for 20 or more employees or for particularly sensitive data. Each processing is documented with the purpose, legal basis, recipients, retention period and TOMs.

The data protection impact assessment according to Art. 35 is mandatory if the processing is likely to entail a high risk. The DSK list specifies this for video surveillance, profiling and special data categories. A blanket denial without checking is not permitted.

The reporting obligation according to Art. 33 is 72 hours from knowledge. Deadline begins as soon as we become aware of it. Anyone who delays or fails to report risks separate fines in addition to the underlying violation. The 72-hour reporting path belongs in every incident response process.

Order processing contracts according to Art. 28 are often designed purely as a standard form. Audits are increasingly checking whether the processor's TOMs are known and evaluated. Simply signing a contract without a substantive review is no longer enough.

CIVAC offers an integrated GDPR module with directory templates, DPIA schemas and a structured reporting path. The auditor calls, the evidence is ready.

The NIS 2 directive will be implemented into national law in Germany in 2026. The target group grows from around 4,500 KRITIS companies to around 29,500 essential and important institutions. Thresholds are 50 employees or 10 million euros in sales in 18 sectors.

The duties include risk management, technical and organisational measures, supply chain security, training and reporting. Early warning within 24 hours, follow-up report within 72 hours and final report after one month. These deadlines are tough.

The personal liability of management is a central innovation. Business managers must personally oversee risk management and participate in training. Fines reach 10 million euros or 2 percent of group sales for essential facilities.

For important facilities, the upper limit is 7 million euros or 1.4 percent of group sales. The amount of the fine depends on the severity, duration and intentional or negligent behaviour. Section 130 OWiG opens up additional personal sanctions.

The IT Security Act 2.0 remains relevant for KRITIS operators and supplements NIS-2. Attack detection systems are mandatory there. A pure firewall is not enough; procedural and technical detection with a defined response is required.

Implementation begins with an impact analysis, gap analysis and action planning. CIVAC delivers an ISB workspace with the 93 controls according to ISO/IEC 27001:2022, which completely maps NIS-2.

The 2022 revision reduces the controls in Annex A from 114 to 93 and organises them into four topics: organisational, personnel, physical and technological. Existing certificates according to 27001:2013 must be converted by October 2026, otherwise they will lose their validity.

The standard requires an information security management system with context, leadership, planning, support, operation, evaluation and improvement. These seven chapters structurally correspond to ISO 9001:2015 and ISO 14001:2015, which creates integration advantages.

A central component is the Statement of Applicability, which documents each of the 93 controls with application or exclusion and justification. Auditors check this list systematically; an empty SoA is a safe major deviation.

The risk assessment follows its own methodology according to Chapter 6.1.2, with identification, analysis and evaluation of risks. Treatment is through avoidance, reduction, transference or acceptance. Every acceptance needs a documented justification.

Audit templates, training plans, asset inventory and authorisation matrix form the operational backbone. Without these four building blocks, an ISMS cannot be tested. A pure policy collection is not enough for certification.

CIVAC provides the ISO/IEC 27001:2022 controls as an interactive list, with links to measures, those responsible and audit findings. Audit-proof, documented, § 130-OWiG-proof.

The Principles for the proper management and storage of books regulate the requirements for digital accounting. § 146 AO requires completeness, accuracy, timely bookings, order, traceability and unchangeability of all transactions that require booking.

Receipts must be kept for 10 years in the format in which they were received. Conversion to other formats without retaining the original is not permitted. PDF invoices are stored as PDF, ZUGFeRD files as XML including PDF.

Procedural documentation is mandatory. It describes how documents are recorded, checked, posted, archived and secured. Missing or incomplete procedural documentation is a classic finding of the tax audit, even without a specific complaint about the accounting record.

Authorizations, the four-eyes principle and change history must be proven in the accounting system. Free write access to booking data without a protocol contradicts immutability. ERP systems offer their own audit logs for this.

For electronic cash registers, additional requirements apply according to KassenSichV, with certified technical security devices. The obligations overlap with data protection because cash register data often contain personal references.

The GoBD can be harmonised with ISO/IEC 27001:2022 controls for access, logging and backup. CIVAC maps this overlap in the workspace, so that a catalogue of measures serves both worlds.

Financial regulatory requirements extend deeply into IT. BaFin'sbanking supervisory IT requirementsapply to credit institutions, VAIT to insurance companies, KAIT to capital management companies and ZAIT to payment service providers. All four follow a similar structure.

Core responsibilities include IT strategy, information security management, authorisation management, identity management, application development, outsourcing and emergency management. BaFin regularly checks on site and imposes sanctions in the event of deficits.

TISAX applies to all suppliers in the automotive sector who process OEM data. The process is based on the VDA information security assessment and leads to a maturity level that is required by the OEM as a condition for cooperation.

In the healthcare system, the KRITIS Ordinance and Section 75c SGB V apply, which obliges hospitals to provide state-of-the-art IT security for more than 30,000 inpatient cases per year. In addition, there are MDR/IVDR for manufacturers of medical devices with software.

In the public sector, BSI basic protection, OZG requirements and country-specific e-government laws apply. This world is unique, but can be operated efficiently with ISO/IEC 27001:2022 as a bracket.

Industry knowledge is crucial here. CIVAC works with experienced representatives in each industry, licence the workspace for your internal representatives or have our representatives appointed.

The management bears ultimate responsibility for IT compliance. Section 130 OWiG sanctions the violation of the supervisory obligation, Section 91 (2) AktG requires a monitoring system for risks that threaten the continued existence of the company. Delegation to representatives does not release you from supervision.

According to Art. 37 GDPR and Section 38 BDSG, the data protection officer is required if 20 or more people constantly process personal data automatically or in the case of particularly sensitive processing. He is not subject to instructions and reports directly to management.

The information security officer is not required by every law, but NIS-2, ISO/IEC 27001:2022 and KRITIS require a named role with responsibility and reporting line. The appointment certificate documents this function.

The compliance officer coordinates the five axes and is the contact person for the management. In SMEs this role is often combined with other functions, and in larger companies it is independent. A personal union with the DSB is controversial.

A clear reporting line avoids conflicts of interest. Representatives report to management, not to the IT management, which they are supposed to control. This separation protects the assignees and the credibility of the role.

CIVAC provides appointment documents, reporting lines and job descriptions for all relevant roles, plus the option to appoint external assignees with a two business day SLA instead of 2 to 6 weeks search.

Audits rarely fail because of the nature of the matter, but often because of the preparation. Anyone who only collects templates, records and authorizations when the auditor visits loses days and produces avoidable findings. A living compliance system shortens this effort drastically.

A realistic audit plan begins three months before the deadline with updating the asset inventory, the risk register and the list of measures. The recordings are reviewed four weeks before the appointment, and the test audit discussions with those responsible take place two weeks beforehand.

The audit folder contains scope, policy, objectives, risk assessment, SoA, catalogue of measures, proof of training, internal audits, management assessment and incident documentation. These ten building blocks are the minimum audit standard.

During the audit, speed of reaction counts. Anyone who submits evidence within 10 minutes signals a living system. Anyone who needs 24 hours signals storage. Both perceptions affect the audit result.

After the audit is before the audit. Corrective measures are planned with responsible persons and deadlines, and their effectiveness is checked in the following year. This loop is the core of every ISMS and QM system.

CIVAC shortens audit preparation with 490 templates, a reporting line and a workspace that keeps records consistent across all roles. Others run compliance like a filing cabinet. We run it like software.

Three models dominate in practice. Firstly, the internal model with its own representatives, which offers full control but requires staff, knowledge and representation. Secondly, the external model with appointed officers, which brings capacity and experience but requires integration effort. Thirdly, a hybrid model.

In the hybrid model, an internal compliance officer is in charge, while external specialists handle data protection, information security or money laundering. This variant is often the most economical solution for SMEs because peak loads are outsourced.

Licence the workspace for your internal representatives or have our representatives order it. Both methods provide the same verifiable status: appointment certificate, signed, filed, verifiable. The SLA for external orders is two working days instead of the classic 2 to 6 weeks.

Concrete first steps: impact analysis for each axis, gap analysis against the five mandatory fields, action plan with dates and responsible persons, appointment of missing representatives, activate audit templates, establish reporting line to management.

Anyone who operates ISO 9001 or ISO 14001 in parallel benefits from the common database. Risks, audits and measures are maintained once and used multiple times. The CIVAC platform and officer-as-a-service structure is built to do just that.

Turn reading into an assignment. Write to info@civac.de or use the contact form on civac.de. We check your compliance situation, suggest a model and roles, and appoint external representatives with SLA. You can find an overview of all 25 representative roles on the platform.