FAQ

Each kit comes in three packages: Basic EUR 990 · Plus EUR 1,390 · Complete EUR 1,690 net (plus statutory VAT), one-time, the same for all five topics. Basic contains the documentation (all documents and templates of the kit without the training folder, quick start, guide, placeholders and filling-in notes); Plus adds the training pack (slide deck, knowledge test and certificate-of-participation template; trainer handbook, participant handout and training plan are included in the EU AI Act Kit; for GDPR, NIS2, AGG and HinSchG they follow as a free update within the update period); Complete adds the e-learning course on the topic — e-learning only in the Complete package. Each kit is delivered in one legal edition — Germany or Austria; you choose the edition when ordering. There is no kit bundle and no subscription.

You buy online with “Buy now”: when ordering you confirm that you are acting as a business and pay by card or SEPA direct debit via Stripe (Stripe Checkout) or by bank transfer against invoice; in that case we send you the invoice by email. You receive an invoice with VAT ID. The download link follows within 48 hours of receipt of payment (working days). The files are delivered personalised with your company name, logo and licence ID (Terms § 3, § 4).

Questions or a custom quote? Use the contact form.

Twelve months of legal-status updates are included in the price, counted from the first delivery. For kits that means an updated document version by email or download link when the law relevant to the kit changes; for e-learning courses you receive updated course files (HTML file or SCORM package) during that period.

The entitlement covers the edition purchased — the kit or course in the legal edition you bought — and there is no entitlement to a particular update frequency or scope. After the twelve months we offer existing customers further follow-up updates on preferential terms; scope and conditions are agreed separately. The documents delivered up to then stay with you permanently and remain usable — nothing is locked, nothing expires (Terms § 8).

Bought individually, a course costs from EUR 490 net for up to 25 users, and all five courses together cost from EUR 2,190 net; for larger organisations prices are tiered by company size on request. Within a kit, the e-learning is included only in the Complete package (company licence, up to 25 users, larger companies on request).

Each course is delivered as a standalone HTML file or as SCORM 1.2/2004 for your LMS — we do not host, and participant data stay with you. German and English are in one file; the course edition is for Germany or Austria, the AI Act course is a single EU-wide edition. Participants who pass the test (from 70 %, repeatable) receive a certificate of participation with a verification code. Twelve months of updates are included (Terms § 7).

The contractual counterparty is Ens Naturale e.U. (Vienna). You order online. You pay by card or SEPA direct debit via the payment service provider Stripe in the checkout (we do not hold these payment data) or by bank transfer against invoice: you then order using the form, and we send you the invoice by email.

We sell to businesses only: when ordering you confirm that you are acting as a business. All prices are net, plus statutory VAT, and you receive an invoice with VAT ID; businesses have no right of withdrawal. For intra-EU business-to-business transactions with a VAT-ID validated via VIES we invoice under the reverse-charge procedure. The download link is provided after receipt of payment (Terms § 5).

On full payment you receive a non-exclusive, non-transferable right of use, unlimited in time, in the delivered documents as a company licence: for the legal entity named in the order and its group companies, as set out in the licence terms. The files are personalised with your company name, logo and licence ID. You may adapt them to your situation, reproduce them for internal purposes, store them in your own systems, present them to authorities, auditors and business partners as part of your own compliance work, and translate them for internal use.

The files stay with you permanently — no cloud dependency and no ongoing activation (Terms § 6).

Passing the documents on to third parties outside the licensed company, publishing them or otherwise making them publicly available, resale, rental or sub-licensing, removing licence or origin markings, using them for training or consulting services to third parties without our prior consent in text form, and using them to build your own commercial compliance products (Terms § 6).

Yes, within the licence terms. The company licence covers the legal entity named in the order and its group companies, as set out in the licence terms. Within that scope the documents may be used for an unlimited number of employees, sites and internal processes. Further companies, or use by consultants, are possible on request via the contact form (Terms § 6).

You receive the course as a file — an HTML file or SCORM 1.2/2004 for your LMS — and run it yourself; we do not host, and participant data stay with you. In the kit's Complete package the e-learning likewise covers up to 25 users; a course bought individually covers up to 25 users from EUR 490 net, with tiers by company size on request. Course content must not be made publicly available or used for training third parties. Participants who pass receive a certificate of participation with a verification code (Terms § 7).

Your rights of use in the documents already delivered remain unaffected; you may continue to use them indefinitely. The documents and the e-learning files work without our servers. Only the update obligations end, with the last version delivered (Terms § 6).

Yes. The Regulation addresses providers and deployers — a deployer being anyone who uses an AI system under their own authority. Article 4 (AI literacy) applies to both, and so do the transparency obligations of Article 50, which have applied since 2 August 2026.

The deployer obligations for high-risk systems in Article 26 sit in Chapter III, Sections 1 to 3. Under Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27 July 2026) those sections apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028.

Article 4 has applied since 2 February 2025 and has read in an amended version since 27 July 2026 (Regulation (EU) 2026/1744): providers and deployers must take measures to support the development of the AI literacy of their staff and of other people who operate and use AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context of use. The same provision now states expressly that this does not oblige providers or deployers to guarantee any specific level of AI literacy for any individual.

According to the Commission's questions and answers on AI literacy, no certificate is required; organisations can keep an internal record of trainings and other guiding initiatives.

Timetable under Article 113 of the AI Act as amended by Regulation (EU) 2026/1744:

2 February 2025 — prohibited practices (Article 5) and Article 4 (AI literacy). 2 August 2025 — general-purpose AI models (Chapter V), governance and the penalty provisions. 2 August 2026 — general start of application, including the transparency obligations in Article 50.

2 December 2026 — the prohibition newly added by the Omnibus Regulation; by the same date, Article 50(2) has to be complied with for generative systems that were already on the market before 2 August 2026 (Article 111(4)). 2 December 2027 — high-risk requirements for Annex III systems. 2 August 2028 — high-risk requirements for Annex I systems.

Under Article 99(3) of the AI Act, non-compliance with the prohibited practices in Article 5 can be sanctioned with administrative fines of up to EUR 35 million or, where the offender is an undertaking, up to 7 % of total worldwide annual turnover for the preceding financial year, whichever is higher. For most other infringements Article 99(4) sets a lower ceiling of EUR 15 million or 3 %.

In Germany, the Bundesnetzagentur (Federal Network Agency) is the market surveillance authority unless the KI-MIG (in force since 29 July 2026) assigns competence elsewhere — to sectoral authorities such as BaFin, for instance; § 15(3) KI-MIG adds national administrative offences carrying fines of up to EUR 50,000. Austria had not designated an authority under Article 70 of the AI Act as at 17 August 2026; the RTR AI service point is an information and advisory body without supervisory powers.

With an inventory: which AI systems are in use or planned, who supplies them, and in which role does your company act — provider or deployer? On that basis you assess the risk category of each system, document the result, and put the AI literacy measures under Article 4 in place. Our EU AI Act Kit provides templates for the inventory, the role and risk assessment and the training records. How long it takes depends on the number of systems and on how responsibilities are organised in your company.

Yes — but the obligations follow from national law, so each company has to be assessed for its own country. In Germany the BSI Act in the version of the NIS2 implementation act (NIS2UmsuCG) has been in force since 6 December 2025. In Austria the NISG 2026 (Federal Law Gazette I No. 94/2025) applies: sections 2 to 45 have been in force since 1 October 2026, and the previous NISG provisions ceased to apply at the same time.

Sector first, size second: the entity must fall within one of the categories in Anlage 1 or 2 of the BSI Act. § 28 BSIG then distinguishes besonders wichtige Einrichtungen (essential entities) — from 250 employees, or from more than EUR 50 million annual turnover together with a balance-sheet total above EUR 43 million — and wichtige Einrichtungen (important entities) — from 50 employees, or from annual turnover and balance-sheet total each above EUR 10 million.

Operators of critical installations, qualified trust service providers, top-level-domain name registries and DNS service providers count as essential entities irrespective of size; providers of public telecommunications services are covered by their own thresholds. Anlage 1 and Anlage 2 of the BSI Act decide which sector categories exist.

Registration: under § 33(1) BSIG an entity has to register at the latest three months after it first — or again — qualifies as such. The deadline therefore runs from that moment, not from a single calendar date; the Federal Office for Information Security (BSI) points out that the statutory registration deadline has already expired. Changes to the registered data are to be reported without delay, at the latest within two weeks (§ 33(5)).

Incident reporting under § 32 BSIG: early warning within 24 hours, the report within 72 hours, the final report within one month. Under § 32(1) last sentence that obligation applies at the earliest from the point at which the reporting channel is set up; reporting runs through the BSI portal.

In Austria, registration with the Cybersecurity Authority is due within three months of the NISG 2026 entering into force — or, for entities that qualify later, within three months of meeting the conditions.

As a rule, yes. Article 30(5) GDPR does exempt organisations employing fewer than 250 persons — but only where the processing is unlikely to result in a risk to the rights and freedoms of data subjects, and is only occasional, and involves no special categories of data under Article 9(1) or data on criminal convictions and offences under Article 10.

Payroll, personnel files, customer and supplier data are processed regularly rather than occasionally, so in practice the exemption rarely applies. On request, the record has to be made available to the supervisory authority (Article 30(4)).

Yes, provided the transfer rests on a valid basis and is documented. For US recipients certified under the EU-US Data Privacy Framework, the basis is Implementing Decision (EU) 2023/1795 of 10 July 2023, which is in force. The General Court dismissed the action against it on 3 September 2025 (T-553/23, Latombe); an appeal is pending before the Court of Justice (C-703/25 P) and no decision had been handed down as at 17 August 2026. Where the certification does not cover the case, the transfer rests on standard contractual clauses plus a transfer impact assessment.

Whichever route applies, you need a processing agreement under Article 28 GDPR, an entry in your records of processing and documented technical and organisational measures. Our GDPR Kit contains the templates for this.

In Germany, yes: under § 12(2) HinSchG employers who as a rule employ at least 50 people must set up and operate an internal reporting office. Irrespective of headcount, the obligation applies to the financial-sector entities listed in § 12(3) — including investment firms, credit institutions, capital management companies, insurance undertakings, payment institutions and crypto institutions. Employers with 50 to 249 employees may operate a joint reporting office together with others (§ 14(2)); the duty to remedy the breach and to give feedback to the reporting person stays with each individual employer. In Austria the HSchG applies the same threshold of 50 employees.

Since 29 July 2026 the material scope of the HinSchG also covers reports of breaches of the AI Act (§ 2(1) no. 10 HinSchG, inserted by the German act implementing the AI Act).

No. Under § 16(1) HinSchG the internal reporting office should also process reports that arrive anonymously, but there is no obligation to design the reporting channels so that anonymous reports can be submitted at all.

In practice the channel matters: at the federal external reporting office at the Bundesamt für Justiz, more than 90 per cent of the reports received since 1 July 2024 came in through the anonymous channel (BfJ annual report 2024).

§ 40 HinSchG sets three tiers: up to EUR 50,000 for hindering a report, for retaliation and for breaches of confidentiality; up to EUR 20,000 where no internal reporting office has been set up (§ 40(2) no. 2) and for an incorrect disclosure; up to EUR 10,000 in the remaining cases. The Bundesamt für Justiz prosecutes and sanctions these administrative offences (HinSchGOWiZustV, in force since 15 April 2025).

In Austria the district administrative authority may impose fines of up to EUR 20,000, and up to EUR 40,000 for a repeat offence.

The transposition deadline for Directive (EU) 2023/970 expired on 7 June 2026 (Article 34). As at 17 August 2026 neither Germany nor Austria had a transposing act in place: in Germany not even a ministerial draft had been published — according to the Federal Government's reply of 8 July 2026 (BT-Drs. 21/7026) individual questions are still being clarified before the legislative procedure is initiated; in Austria a petition on the subject is before the committee, with deliberations not yet begun. Concrete duties for employers will therefore follow from the respective national act.

The Directive itself provides for reporting on the gender pay gap: employers with 250 or more workers by 7 June 2027 and every year thereafter; 150 to 249 workers by 7 June 2027 and every three years thereafter; 100 to 149 workers by 7 June 2031 and every three years thereafter; below 100 workers there is no reporting obligation unless a Member State introduces one. The right to information under Article 7 and the rules on the initial pay or pay range before employment, including the ban on asking applicants about their pay history (Article 5), do not depend on company size.

There is no headcount threshold. Under § 13 AGG employees have the right to complain to the competent body of the establishment, the company or the agency if they consider themselves discriminated against; the complaint has to be examined and the outcome communicated to the complainant. Employers therefore have to designate such a body — and, under § 12(5) AGG, make the AGG and information about the bodies responsible for complaints known in the establishment. This applies to small employers as well.