What officers need to know.
Regulatory shifts, framework updates and operational guidance, curated for Data Protection, IT Security, Compliance and AI Governance leads. Written from the field, verified against primary sources.
Whistleblower Hotline Provider in Germany: How to Pick an English-Capable Reporting Channel
German subsidiaries with 50 or more employees must run a confidential reporting channel under HinSchG. International groups need an English-capable provider that also meets BfJ supervision. This guide explains the legal floor, the must-have features, and how CIVAC delivers both.
Whistleblower Protection Act: operational implementation of obligations, deadlines and reporting point
The HinSchG requires companies with 50 or more employees to have an internal reporting office. There is a risk of fines of up to 50,000 euros. This guide shows how to set up a verifiable reporting channel, deadlines and documentation.
Anti-Money Laundering Officer in Germany: Finance and Real Estate Compliance Without Gaps
Banks, asset managers, and real estate firms in Germany must appoint an AML officer under § 7 GwG. This guide explains scope, liability, and how CIVAC operates the role end-to-end.
Report suspected money laundering: Steps to the FIU according to Section 43 of the GwG
Reporting suspicious activity to the FIU is mandatory according to Section 43 of the GwG and cannot be delayed. This guide shows ten steps from internal notice to FIU confirmation, including deadline, enforcement ban and tipping-off ban.
Money laundering officer: duty, appointment, tasks according to Section 7 GwG
The money laundering officer is the central compliance function against money laundering and terrorist financing. This guide explains the compulsory group according to Section 7 GwG, tasks, qualifications and which evidence is valid before a BaFin audit.
Officially appoint a fire protection officer: certificate, duties, evidence
Appointing a fire protection officer requires more than an email. Find out what components the appointment certificate must contain, when a fire protection officer is required and how you can store the proof in a way that is auditable.
Fire protection concept: content, obligations and implementation
A fire protection concept combines structural, technical and organisational fire protection into one verifiable document. This guide shows obligations, content and how CIVAC interlinks implementation with the fire protection officer.
Annual fire protection assistant training online: What ASR A2.2, DGUV and insurers really require
The annual fire protection assistant training is mandatory according to ASR A2.2 and DGUV Information 205-023. This article clarifies which content is allowed to run online, where the practical exercise on the fire extinguisher remains indispensable and how proof is documented in an audit-proof manner.
External ASiG support: Safety-related support in accordance with § 5 and § 6 ASiG
The Occupational Safety Act requires employers to appoint an occupational safety specialist and a company doctor. We show the care models according to DGUV regulation 2, the operating times and how external ASiG care works.
SiFa training 2026: BG course, duration, costs and specialist knowledge according to DGUV V2
According to DGUV V2, the SiFa training lasts at least 297 learning units. We show the course structure, costs between 2,500 and 4,500 euros, funding options and the most common pitfalls.
Office risk assessment: patterns, obligations and pitfalls 2026
A PDF template does not replace a risk assessment. The article shows which risks need to be assessed in the office workplace in 2026, how psychological stress is integrated and how the SiFa role is documented in a workspace that survives the supervisory procedure.
Asbestos removal according to TRGS 519: Which representatives are required and how to prove it
For asbestos work, TRGS 519 requires expertise in accordance with Appendix 3 or 4, a qualified supervisor and a written report to the authorities. We show which representatives are obligatory and how proof is kept in an audit-proof manner.
Duties of the hazardous substances officer in the company: GefStoffV, TRGS, practice
Anyone who uses hazardous substances needs qualified control. This article explains the duties of the hazardous substances officer according to GefStoffV, TRGS 400, TRGS 555 and ArbSchG as well as the operational implementation in the company.
Hazardous substances register software for SMEs: inexpensive, audit-proof, ready for use in two working days
The GefStoffV requires a complete list of hazardous substances in accordance with Section 6 Paragraph 12. Lean, testable software is crucial for SMEs. We compare cost structures, mandatory fields and show how the CIVAC workspace covers the requirement in two working days.
List of hazardous substances: Excel template for free and what it really has to deliver
An Excel template for the list of hazardous substances saves you getting started. However, it only meets Section 6 GefStoffV if all mandatory information is recorded in a structured manner. This article provides the legally compliant field list and the migration path to the audit-proof solution.
BImSchG representative: Obligations according to Section 53 BImSchG for systems requiring approval
The BImSchG representative is stipulated in the Federal Immission Control Act. If the order is not made in the correct form, there is a risk of a fine according to Section 62 BImSchG. This article explains duties, qualifications and the interface to the environmental protection officer.
Calculating the carbon footprint Scope 1, 2, 3: Practical instructions for medium-sized businesses
Climate balance according to the GHG Protocol sounds like a corporation. Medium-sized businesses still have to take them into account: banks, customers, CSRD cascade. CIVAC shows methodology, data sources and documentation structure that the auditor also accepts.
ISO 50001 consulting in the DACH region: introduction, certification, operation
ISO 50001:2018 is the internationally recognised standard for energy management systems. This article shows the advisory timetable in the DACH region, the interfaces to EnEfG, EDL-G and CH wholesale consumer goods and the role of the environmental officer.
Materiality analysis according to ESRS: template, methodology and auditor's perspective
The dual materiality analysis decides which ESRS data points you need to report. We provide an auditor-proof template and show how the CIVAC workspace maps stakeholder dialogue, threshold values and release loops in an audit-proof manner.
Create CBAM report: Importer obligations 2026 step by step
The CBAM quarterly report has been mandatory for importers of CO2-intensive goods since October 1, 2023. Read about which emissions-related data needs to be provided, how the transition phase will end in 2026 and how supplier information can be documented in an audit-proof manner.
LkSG Human Rights Risk Analysis Template: An Audit-Ready Framework for German Supply Chain Compliance
The German Supply Chain Due Diligence Act (LkSG) requires a documented annual human rights risk analysis since 2023. This guide gives you a structured template, the eleven legal risk categories, and the documentation depth BAFA expects when an inspection arrives.
LkSG report: Contents, deadlines and auditor-proof documentation for BAFA
The Supply Chain Due Diligence Act requires companies with 1,000 or more employees to report annually to the BAFA. Anyone who documents risk analysis, prevention measures and complaint procedures for auditors can avoid fines of up to 8 million euros.
Conduct LkSG risk analysis: example, template and seven-step plan
The LkSG risk analysis is mandatory for around 4,800 companies in Germany. This article provides an example, a template and a seven-step plan that combines abstract and concrete analysis with the BAFA requirements.
NIS-2 Implementation Germany: How to Operate the 2026 Deadline as an Officer, Not a Project
The 2026 implementation phase of NIS-2 in Germany shifts the burden from legal interpretation to operational execution. This guide focuses on the officer angle: how to staff, structure, and report a NIS-2 program under Section 38 BSIG without burning out the team.