Compliance Annual Plan 2026: Quarterly Activities and Deadlines

This annual plan assigns eight activities to the four quarters of 2026 and places the cross-quarter working rhythm alongside them. Two things are worth keeping apart: deadlines that follow from a legal provision, and rhythms that come from practice. For the statements in this plan: statutory deadlines are given with a citation; anything without a citation is marked as a practical recommendation or as a legacy statement of the first edition. The factual status of the date information is 2 May 2026, updated to the legal status of 17 August 2026 (sources block) — the dates 2 August 2025, 7 June 2026 and 2 August 2026 have therefore occurred and are treated here as past; for NIS2 registration the BSIG names no calendar date but a three-month period from the point at which entity status arises (§ 33(1) BSIG), and there is no official date for the start of BSI supervisory practice.

1. Q1 (Jan-Mar): audit preparation

Short answer: Q1 is the year's stocktaking — updating the record of processing activities, reconciling data processing agreements, refreshing training, quarterly risk review. Four tasks, each of which ties back to a legal provision, but whose calendar rhythm is largely a working requirement of this plan (section 9).

Updating the record of processing activities. The record of processing activities is reconciled against the actual processing operations (Art. 30 GDPR). In practice this means: whatever was added in the previous year — new tools, new analyses, new recipients — must be in the record before a supervisory enquiry arrives.

Reconciling data processing agreements. Anyone processing on behalf of a controller needs a contract with a statutory minimum content: subject matter and duration of the processing, nature and purpose, type of personal data, categories of data subjects, and the obligations and rights of the controller (Art. 28(3) GDPR). Upstream of this lies the selection duty: only Data Processors providing sufficient guarantees for appropriate technical and organisational measures may be used (Art. 28(1) GDPR). The reconciliation in Q1 answers two questions — for which service provider is a data processing agreement missing, and which agreement no longer reflects today's processing.

Training refresh and risk review. For protection against discrimination the position in Germany is: the employer must take the necessary measures, including preventive ones, and suitable training of employees counts as fulfilment of that duty (§ 12(1) to (3) AGG). Austria has substantively comparable protective duties under the GlBG (prohibition of discrimination § 3 GlBG for gender, § 17 GlBG for ethnic origin, religion or belief, age and sexual orientation). The training refresh answers which employees have joined since the last training session or have moved into a management or selection role; this group is retrained first — that is a working requirement of this plan; the protective duty itself follows from § 12(1) AGG. The risk review starts on the NIS2 side: risk analysis and security concepts are part of the statutory minimum catalogue (§ 30(2) BSIG 2025). It answers two questions: which systems, sites or service providers are new since the last review, and which of the minimum catalogue measures under § 30(2) BSIG 2025 (in Austria § 32(4) NISG 2026) cover them?

Check responsibilities. Q1 is also the point at which the designation of the data protection officer is reviewed. In addition to the EU-wide cases under Art. 37(1) GDPR, Germany additionally requires designation by anyone who as a rule permanently employs at least 20 persons in the automated processing of personal data — and, irrespective of that number, where processing operations are subject to a data protection impact assessment (§ 38(1) BDSG). For Austria, § 5 DSG applies (Austria box below section 9).

2. Q1: HinSchG effectiveness self-assessment (best practice)

Short answer: best practice (NOT a statutory duty): document an annual effectiveness self-assessment of the internal reporting channel — compliance with deadlines (§ 17), confidentiality (§ 8), handling of anonymous reports, training status, protection against reprisals (§ 36). Modelled on ISO 37301. Note: § 22 HinSchG concerns the reporting office at the Federal Cartel Office, NOT an audit duty.

What the self-assessment asks. The form of the self-assessment follows the documentation logic of this plan — test criterion, finding, measure, date; the reference to ISO 37301 is a pointer to a model, not a certification requirement. The assessment is made exclusively against the duties the HinSchG imposes on the reporting channel in any event. First, the two response deadlines: acknowledgement of receipt no later than seven days (§ 17(1) no. 1 HinSchG) and feedback on planned and already taken follow-up measures within three months of the acknowledgement of receipt — where receipt was not acknowledged, no later than three months and seven days after receipt (§ 17(2) HinSchG). Second, confidentiality: the identity of the reporting person, of the persons concerned and of other persons named may become known only to the persons responsible for receiving reports and taking follow-up measures and to those supporting them (§ 8(1) HinSchG). Third, protection against reprisals: reprisals are prohibited, as are threats of and attempts at reprisals (§ 36(1) HinSchG); where a reporting person suffers a detriment and asserts that they suffered it as a result of the report, the detriment is presumed to be a reprisal, and the person causing the detriment bears the burden of proof (§ 36(2) HinSchG).

Handling anonymous reports. Under § 16(1) HinSchG the handling of anonymous reports is a 'should' provision, not an obligation — a point frequently misunderstood in practice. Anyone who does handle anonymous reports checks in the self-assessment whether the channel technically supports the confidentiality requirement.

Training status — practical recommendation. That the knowledge level of the persons entrusted with the reporting channel also forms part of the self-assessment is a working requirement of this plan. On a statutory training duty specifically for the internal reporting channel, the factual basis of this article contains no statement; check this point separately before relying on it. It makes sense to record the status per person with a date — the same documentation logic as for the training in section 7.

Who the duty applies to. Employers with, as a rule, at least 50 employees each must set up and operate at least one internal reporting channel (§ 12(1) and (2) HinSchG). Failing to do so is an administrative offence (§ 40 HinSchG, range in section 8). The Austrian equivalents are in the Austria box below section 9.

3. Q2 (Apr-Jun): EU pay transparency reporting

Short answer: the transposition deadline of the EU Pay Transparency Directive 2023/970 expired on 7 June 2026 (Art. 34(1)); as at 17 August 2026 no German transposition act was available (BT-Drs. 21/7026). The actual reporting duty for employers with 250 or more employees is provided for by the Directive as of 7 June 2027 (Art. 9(2)). Prepare job evaluation and pay gap calculation early.

Legal effect — frequently presented in shortened form. 7 June 2026 was a transposition deadline addressed to the member states (Art. 34(1) Directive (EU) 2023/970), not a date from which private employers are directly bound by the Directive. A Directive that has not been transposed creates no direct obligations for private employers; direct effect can at most be vertical, against the state or public employers. Practical consequence: the obligations take effect with national transposition. As at 17 August 2026 Germany did not even have a ministerial draft (BT-Drs. 21/7026 of 8 July 2026); in Austria neither a ministerial draft nor a government bill can be found at federal level. Until then, there is transposition pressure as well as interpretation and liability risk.

The staggered reporting duty. Employers with 250 or more workers report by 7 June 2027 and annually thereafter (Art. 9(2) Directive (EU) 2023/970); employers with 150 to 249 workers likewise by 7 June 2027, and every three years thereafter (Art. 9(3)); employers with 100 to 149 workers only by 7 June 2031, and every three years thereafter (Art. 9(4)). The content includes the gender pay gap including variable components, median values, the proportion of workers in each pay quartile and the pay gap per category of worker (Art. 9(1)). The applicable rules are those of the respective national transposition law.

What can already be prepared. Three elements of the Directive do not depend on the report: pay range or entry-level pay for job applicants (Art. 5(1)), the prohibition on asking about pay history (Art. 5(2)) and gender-neutral job advertisements (Art. 5(3)); plus workers' right to information, which the employer must satisfy within two months (Art. 7). In this plan, job evaluation specifically means: form categories of workers performing the same work or work of equal value, and check the classification criteria for freedom from discrimination. This grouping supports both — the right to information under Art. 7 (average pay levels per category, broken down by gender) and the later report under Art. 9(1) (pay gap per category of worker, proportion per pay quartile). It is flanked in law in Germany by § 7 EntgTranspG and in Austria by § 11 GlBG.

Germany and Austria. In Germany the individual right to information exists under current law in establishments with, as a rule, more than 200 employees; the comparator pay need not be stated where the comparable activity is performed by fewer than six employees of the other gender (§§ 10 to 12 EntgTranspG), flanked by the equal pay requirement (§ 7 EntgTranspG). In Austria, § 11 GlBG requires company classification rules to observe the principle of equal pay for the same work or work of equal value; gender-neutral job advertisements are governed by § 9 GlBG, and breaches carry a fine of up to EUR 360 (§ 10 GlBG).

4. Q2: test GDPR determinations against six checkpoints (occasion: current DSK decision practice)

Short answer: Q2 is the point at which your own data protection determinations are tested against current interpretation practice. Six points carry the review: legal basis (Art. 6), consent (Art. 7), special categories (Art. 9), DPIA (Art. 35), response deadline for data subject requests (Art. 12(3)) and — regulated in Germany — § 25 TDDDG.

What the review is aligned to. The first edition of this plan gives as the occasion that the German Data Protection Conference (DSK) publishes new decisions every six months and that adjustments must be reviewed; this six-monthly cadence is a legacy statement of the first edition. On the version and content of the current DSK decisions, the factual basis of this article contains no statement. Practical recommendation: before the Q2 date, obtain the current decision status of your competent supervisory authority yourself and record for each checkpoint whether the interpretation has changed since the last review — the five GDPR checkpoints remain unchanged in the Regulation, the sixth in § 25 TDDDG.

The six points at which adjustments land. First, the legal basis: every processing operation needs at least one of the six grounds for lawfulness (Art. 6(1) GDPR) — where the interpretation changes, it is not the processing that changes but the entry in the record. Second, consent: the controller must be able to demonstrate it, withdrawal is possible at any time and must be as easy as giving consent (Art. 7(1) and (3) GDPR). Third, special categories: health data, biometric data and comparable data are subject to a general prohibition on processing with narrow exceptions (Art. 9(1) GDPR). Fourth, the data protection impact assessment where a high risk is likely, in particular for new technologies, large-scale processing of special categories or systematic large-scale monitoring of publicly accessible areas (Art. 35(1) and (3) GDPR). Fifth, the response deadline for data subject requests under Art. 12(3) GDPR (running of the deadline in the event-deadline table in section 9). Sixth — regulated in Germany — consent for access to terminal equipment: storing or reading is permitted only with prior, informed consent, unless the sole purpose is the transmission of a message or the access is strictly necessary for a digital service expressly requested (§ 25(1) and (2) TDDDG). For Austria the factual basis of this article contains no statement on the national implementation; the GDPR requirements for consent (Art. 7 GDPR) apply there unchanged, and the national rule must be checked separately before relying on it.

Austria. The supervisory authority there is the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG), which also decides on the national administrative fines — up to EUR 50,000, for example, for the intentional transmission of data in breach of data secrecy (§ 62(1) DSG). In Germany the authorities competent under Land law supervise non-public bodies (§ 40(1) BDSG), while the Federal Commissioner for Data Protection (BfDI) is competent for federal bodies (§ 9(1) BDSG).

5. Q3 (Jul-Sep): NIS2 supplier audit

Short answer: Q3 examines supply chain security: evaluate all suppliers' self-declarations, and additionally audit critical suppliers on site. Supply chain security is not a voluntary building block here: it expressly forms part of the statutory minimum catalogue of risk management measures (§ 30(2) BSIG 2025, in Austria § 32(4) NISG 2026, under Union law Art. 21(2) NIS2 Directive). The on-site audit of critical suppliers is a practical recommendation of this plan.

What the self-declaration asks. The benchmark is the statutory minimum catalogue itself: risk analysis and security concepts, handling of security incidents, business continuity with backup management and crisis management, security in the supplier's own supply chain, secure acquisition, development and maintenance including vulnerability management, assessment of the effectiveness of the measures, cyber hygiene and training, cryptography, personnel security and access control, as well as multi-factor authentication and secured communication (§ 30(2) BSIG 2025, in Austria § 32(4) NISG 2026). Anyone who aligns the questionnaire with this asks nothing that does not apply to their own entity anyway. The reporting channels for a significant security incident are to be kept separate from this — they are in the event-deadline table in section 9.

What 'critical' is based on — practical recommendation. The factual basis of this article contains no criterion for selecting the suppliers to be audited on site. This plan proposes three characteristics: the supplier has access to your own network and information systems, it processes personal data on your behalf, or its failure cannot be substituted within your own recovery time. If one of these applies, that justifies the greater audit effort — this is a working requirement of this plan, not a statutory requirement.

Preliminary question: does NIS2 apply at all? In Germany, the type of entity under the annexes to the BSIG, together with size, is decisive. Other entities of a type specified in Annex 1 count as a particularly important entity if they employ at least 250 employees or have an annual turnover of more than EUR 50 million and in addition an annual balance sheet total of more than EUR 43 million; entities of a type specified in Annex 1 or 2 count as an important entity if they employ at least 50 employees or have an annual turnover and an annual balance sheet total each exceeding EUR 10 million (§ 28(1) and (2) BSIG 2025). The link to the annexes is part of the threshold — without a type under Annex 1 or under Annex 1 or 2, employee and turnover figures do not support the classification. Alongside the size thresholds, Germany also treats operators of critical installations, qualified trust service providers, top-level domain name registries, DNS service providers and certain telecommunications providers as particularly important entities (§ 28(1) BSIG 2025). In Austria, § 25(2) and (3) NISG 2026 uses the same figures for large and medium-sized undertakings; the classification itself is governed by § 24 NISG 2026 (details in the Austria box below section 9).

Do not forget registration. Particularly important and important entities must register no later than three months after they first qualify as such and submit their name, address, contact details, relevant sector under Annex 1 or 2, member states concerned and competent supervisory authorities (§ 33(1) BSIG 2025); the deadline for notifying changes is in the event-deadline table in section 9. The BSI points out that the statutory registration deadline has already expired. Anyone who has missed registration should complete it without undue delay — the registration obligation continues to apply, and the obligations under §§ 30 and 32 BSIG 2025 apply irrespective of registration.

Double benefit of the supplier audit. Suppliers that also process personal data on your behalf fall under Art. 28 GDPR. Anyone evaluating the self-declaration anyway checks the same company in one pass against both evidence chains — once as a building block of supply chain security under NIS2, once as a Data Processor providing sufficient guarantees (section 1). This is a practical recommendation on work organisation; the two sets of evidence remain to be documented separately.

6. Q3: request GPAI provider obligations under Art. 53 and 55 AI Act (comparison with the provider's Code of Practice)

Short answer: four documents are to be requested from the GPAI provider — technical model documentation, information for integrating providers, copyright policy and training data summary (Art. 53(1) AI Act); where there is systemic risk, additionally model evaluation, risk mitigation, reporting of serious incidents and cybersecurity (Art. 55(1) AI Act). The GPAI obligations (Chapter V AI Act) have applied since 2 August 2025 — not from 2 August 2026; only existing GPAI models placed on the market before 2 August 2025 have until 2 August 2027 to comply. Check the provider's data processing agreements.

On the GPAI Code of Practice itself — version, content and signatories — the factual basis of this article contains no statement. The provider's document can be compared against the stated obligations under Art. 53 and Art. 55 AI Act.

What lies behind the request. The addressee of the obligations is the provider of a general-purpose AI model — that is, a model with significant generality that can competently perform a wide range of tasks and can be integrated into a variety of downstream systems (Art. 3 no. 63 AI Act). The technical documentation must comply at least with Annex XI, the information for integrating providers at least with Annex XII, and the training data summary follows a template provided by the EU AI Office (Art. 53(1) AI Act). For free and open-source models, points (a) and (b) apply in a limited way, but not where there is systemic risk. A systemic risk is assumed, among other things, where the cumulative compute used for training is more than 10^25 floating-point operations (Art. 51(1) and (2) AI Act). These answers belong in the provider's documentation, not in an assessment of your own.

What additionally occurred on 2 August 2026. The AI Act has applied generally since that date (Art. 113 AI Act). This also makes the transparency obligations of Art. 50 AI Act applicable: systems intended to interact directly with people must inform them that they are dealing with an AI system (paragraph 1); synthetic audio, image, video or text content must be marked in a machine-readable format as artificially generated or manipulated (paragraph 2); deployers of emotion recognition or biometric categorisation systems must inform the persons concerned (paragraph 3); anyone generating or manipulating deep fakes must disclose this (paragraph 4). For high-risk AI systems under Annex III, by contrast, the obligations of Chapter III sections 1 to 3 apply only from 2 December 2027: with Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, the date 2 August 2026 has been dropped for those systems. The same pattern applies to AI in regulated products under Annex I: the obligations take effect from 2 August 2028. Both dates are in Art. 113 AI Act in the version applicable since 27 July 2026. For Art. 5 AI Act (prohibited practices), Art. 4 AI Act (AI literacy) and the GPAI obligations, the original dates of 2 February 2025 and 2 August 2025 remain; what is new is the prohibition no. 9 inserted by the same Regulation, which applies from 2 December 2026, and the new wording of Art. 4 AI Act applicable since 27 July 2026 (measures to support AI literacy; no particular level of competence is owed).

The AI Act is an EU Regulation; it applies equally in Germany and Austria — there is no national difference at this point.

Checking the provider's data processing agreements — against what. Where the GPAI provider processes personal data on your behalf in the process, the review runs against the same benchmark as in section 1 — the minimum content of the data processing agreement under Art. 28(3) GDPR and sufficient guarantees under Art. 28(1) GDPR. The AI Act documentation under Art. 53 and the data processing agreement review are to be documented separately; they answer different questions.

7. Q4 (Oct-Dec): awareness training + AI literacy

Short answer: Q4 bundles three training strands into one date: AI literacy under Art. 4 AI Act, cybersecurity under § 38(3) BSIG 2025 and protection against discrimination under § 12(2) AGG. Q4 is ideal because of budget clarification — what is meant is the coincidence with budget planning for the following year: the next year's training needs (new AI systems, new members of the management bodies, AGG cycle) are established in the same session in which the budget for them is requested. The placement in Q4 is a practical recommendation of this plan — Art. 4 AI Act has applied since 2 February 2025 and, since 27 July 2026, in the version of Regulation (EU) 2026/1744: providers and deployers take measures to support the development of AI literacy; no particular level of competence is owed; these measures run continuously and are not a year-end task.

Three training strands that can be bundled. First, AI literacy under Art. 4 AI Act; the recurring-tasks list gives the cycle as 'annually + when new systems are introduced' (section 9). Art. 4 AI Act in the version applicable since 27 July 2026 covers your own staff and other persons dealing with the operation and use of the AI systems on your behalf; their technical knowledge, experience, education and training and the context of use are to be taken into account. No particular level of competence is owed; according to the Commission FAQ (non-binding), a certificate is not required, and internal training evidence suffices. Second, cybersecurity: the management bodies of particularly important and important entities must attend training regularly (§ 38(3) BSIG 2025); in Austria the attendance duty applies to the management bodies of essential and important entities (§ 31(2) NISG 2026), combined with the entity's duty to offer its employees corresponding training regularly. For the workforce itself, cyber hygiene and training are part of the minimum catalogue of risk management measures (§ 30(2) BSIG 2025). Third, protection against discrimination: here the training operates as fulfilment of the employer's protective duty (§ 12(2) AGG, section 1); the cycle of 'every 2–3 years' given in the recurring-tasks list is a working requirement, not a statutory deadline.

Why the documentation is the real work. Under § 12(2) AGG the training counts as fulfilment of the protective duty; how the employer demonstrates this is not prescribed by the Act — the documentation is a practical recommendation of this plan. For NIS2, compliance with the measures must be documented in any event (§ 30(1) BSIG 2025). Practical recommendation: record for each training session the date, the participants, the content and the underlying legal provision, and carry it as an annex in the management review (section 8).

8. Q4: management review + year-end audit

Short answer: management and the compliance officer review the annual compliance report. The review is at the same time the point at which the management body fulfils a duty personally assigned to it: management bodies of particularly important and important entities must implement the risk management measures under Section 30 BSIG 2025 and supervise their implementation (§ 38(1) BSIG 2025).

What the review goes through. The agenda consists of the results the plan itself has produced over the year: first, the status of the record of processing activities and open gaps in data processing agreements from section 1; second, the result of the reporting channel self-assessment from section 2 (deadline compliance rate under § 17 HinSchG, confidentiality incidents under § 8 HinSchG); third, the result of the supplier audit from section 5 including outstanding registration duties (§ 33(1) BSIG 2025); fourth, the training records from section 7 with date, participants and legal provision; fifth, the event-triggered deadlines that occurred during the year from section 9 and whether the 24-hour and 72-hour deadlines were met; sixth, the state of preparation for 7 June 2027 (section 3). This agenda is a working requirement of this plan; the supervision duty itself follows from § 38(1) BSIG 2025.

Liability as an agenda item. Where management bodies breach this duty, they are liable to their entity for culpably caused damage under the rules of the company law applicable to the legal form (§ 38(2) BSIG 2025). In addition, § 43(1) GmbHG obliges managing directors to exercise the care of a prudent businessman; in case of breach they are jointly and severally liable to the company (§ 43(2) GmbHG) — this is internal liability, not liability towards third parties. In Austria, § 25 GmbHG (AT) applies; the NISG 2026 contains no express internal liability provision such as § 38(2) BSIG 2025, but the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) may temporarily prohibit the management bodies of an essential entity from exercising management functions by notice (§ 39(4) no. 2 NISG 2026, with entry in the commercial register).

Evidence of implementation. The plan's three-year evidence duty is tied in Germany to § 39(1) BSIG 2025: operators of critical installations demonstrate implementation at a point in time determined by the BSI — at the earliest three years after they first qualify as the operator of a critical installation — and every three years thereafter, by means of security audits, examinations or certifications, and submit the results including any security defects identified. The provision names no fixed calendar date; it ties the point in time to the BSI's determination. In Austria the mechanism is a different one: essential and important entities submit a structured self-declaration within twelve months of the registration duty arising and demonstrate implementation on request within two years through an independent body; essential entities must demonstrate the operational and organisational implementation within as little as two months of being requested to do so (§ 33(1) and (2) NISG 2026).

For prioritisation in the review, it helps to look at the sanction and compensation ranges. The table states statutory ranges, not amounts to be expected:

For SMEs including start-ups, the lower of the two amounts applies to the AI Act fines in each case (Art. 99(6) AI Act) — so the EUR 35 million figure is not the benchmark for small undertakings.

9. Quarterly dates in the compliance calendar

Short answer: the plan runs on a quarterly rhythm: on the first Wednesday of each quarter the compliance officer meets with fixed standing topics. Standing topics: record of processing activities, data processing agreements, incidents, training, supervisory news. This rhythm is a practical recommendation of this plan and not a statutory deadline — it organises the recurring tasks, while the event-triggered deadlines run independently of it.

The recurring tasks with their respective legal basis and cycle:

Strictly to be separated from these are the event-triggered deadlines. They begin with the triggering event, not with the quarter — every row of the following table is a statutory deadline with a citation:

Practical recommendation for the agenda: the standing topics of the quarterly meeting mirror the four tasks from section 1 (record of processing activities, data processing agreements, training, risk review) and add 'incidents' and 'supervisory news'. It makes sense to record in the meeting minutes for each item which of the two tables above carries it — cyclical task or event deadline. For the event deadlines, the availability of the role matters more than the meeting date: a 24-hour notification cannot be postponed to the next first Wednesday.