Compliance Budget SME 2026: Realistic Calculation

Main article: Compliance Tool Stack 2026 — ten tool building blocks with an obligations mapping and a procurement sequence.

Short answer up front: A robust compliance budget does not come from a flat rate per head, but from the question of which obligation is triggered at all at which company size. The size bands below therefore name, for each cost block triggered by law, the provision that triggers it; voluntary items such as insurance and tooling have no statutory trigger and are therefore not listed in the statutory anchor table.

On the figures: This article does not give EUR ranges for compliance budgets but the calculation method: which obligation is triggered at which size and which cost items depend on it. Statutory amounts (fine ranges, thresholds, minimum compensation) are each shown with a source. Effort figures in person-days are empirical values (as at 2 May 2026), not statutory requirements; the empirical value for ongoing working time comes from our Compliance Annual Plan 2026.

Small SMEs (10-49 employees)

Focus areas: GDPR + AGG where applicable. NIS2 only where the sector is covered. Cost drivers: appointment of a data protection officer (from the threshold in § 38(1) BDSG), processing time for data subject requests, the reporting route and data processing agreements.

The first size-dependent obligation in this band is the appointment of a data protection officer: in Germany as a rule from 20 persons who are constantly engaged in the automated processing of personal data, and irrespective of that number where processing requires a data protection impact assessment (§ 38(1) BDSG; the full statutory elements are set out in the statutory anchor table). Austria has no additional numerical threshold; the appointment obligation there follows directly from Art. 37(1) GDPR, supplemented by the confidentiality rule in § 5 DSG. Anyone just below the German threshold should still budget for this item: a single processing operation requiring a data protection impact assessment triggers the obligation irrespective of the number of persons.

On an ongoing basis, four processes take up time, and all four have a fixed response deadline or a fixed minimum content: requests from data subjects must be answered without undue delay and at the latest within one month, extendable by two months in complex cases (Art. 12(3) GDPR); personal data breaches must be notified without undue delay and where feasible within 72 hours (Art. 33(1) GDPR); every service provider that processes personal data on behalf of a controller needs a data processing agreement with the minimum content of Art. 28(3) GDPR; and access to terminal equipment is permitted in Germany without consent only where it serves solely the transmission of a message or is strictly necessary for a service expressly requested by the user (§ 25(1) and (2) TDDDG). In this band, NIS2 only costs money where the entity belongs to a type under Annex 1 or 2 BSIG or falls under one of the size-independent categories in § 28 BSIG.

Check step for annex classification: First compare your own activity against the sector lists. Annex 1 BSIG covers energy, transport, finance (banking and financial market infrastructures), health, water (drinking water and waste water), digital infrastructure including the management of ICT services, and space; Annex 2 covers postal and courier services, waste management, chemicals, food, manufacturing, digital service providers and research. In Austria, the corresponding lists are set out in Annexes 1 and 2 to the NISG 2026. Only then do the thresholds of § 28 BSIG apply: without a type under an annex, even 500 employees do not trigger an obligation — unless the entity falls under one of the size-independent categories in § 28 BSIG (among others, operators of critical installations, qualified trust service providers, top-level domain name registries, DNS service providers and certain telecommunications providers); entities of the federal administration are covered separately by § 29 BSIG. Practice recommendation, not a statutory requirement: document the result of the check together with the date — it is the basis for the three-month registration deadline under § 33(1) BSIG.

Medium SMEs (50-99 employees)

Focus areas: GDPR + HinSchG + AGG. Check NIS2. Cost drivers: in addition, operating the internal reporting channel with named roles and deputies so that the deadlines of § 17 HinSchG are met.

As a rule from 50 employees, the internal reporting channel is added as a permanent item (§ 12(1) sentence 1 and (2) HinSchG; in Austria from 50 or more employees under § 3(1) and § 11(1) HSchG). What is relevant for the budget is less the reporting channel itself than its operation: acknowledgement of receipt within seven days at the latest (§ 17(1) no. 1 HinSchG), feedback on planned and taken follow-up measures within three months of the acknowledgement of receipt (§ 17(2) HinSchG) and a confidentiality regime that makes the identity accessible only to the responsible persons and those supporting them (§ 8(1) HinSchG). This requires named roles including deputies — otherwise the deadlines are missed during holidays.

The sanctions side explains why this item is not optional: in Germany, the absence of an internal reporting channel can be penalised with a fine of up to EUR 20,000, and obstructing a report, reprisals and breaches of confidentiality with up to EUR 50,000 (§ 40(2) to (6) HinSchG). Practice recommendation, not a statutory obligation: document an annual effectiveness self-review of the reporting channel — there is no statutory audit obligation for this. Whether NIS2 applies still depends on the annex classification: an entity of an Annex 1 or Annex 2 type qualifies from 50 employees — or where annual revenue and annual balance sheet total each exceed EUR 10 million — as an important entity (§ 28(2) BSIG).

Large SMEs (100-249 employees)

Focus areas: all 5 domains; NIS2 as soon as a type under Annex 1 or 2 BSIG applies. Cost drivers: where NIS2 applies, the catalogue of measures in § 30 BSIG including documentation, registration and reporting readiness, as well as management time and training of the management body.

As soon as a type under Annex 1 or 2 BSIG applies, the full NIS2 catalogue of obligations is added in this band as a separate cost block. The catalogue in § 30(1) and (2) BSIG requires at least ten areas of measures — among them risk analysis, incident handling, business continuity, supply chain security, cryptography, access control and multi-factor authentication — and documentation of compliance with them. Added to this are registration at the latest three months after the property first applies (§ 33(1) BSIG) and the three-stage reporting chain: early initial report within 24 hours, report with an initial assessment within 72 hours, final report at the latest one month after the 72-hour report (§ 32(1) BSIG); under the last sentence of § 32(1) BSIG this obligation applies at the earliest once the reporting route has been set up, and reports are submitted via the BSI portal. The trigger for the reporting chain is a significant security incident, that is, one that has caused or can cause serious operational disruption or financial loss, or that has affected or can affect other natural or legal persons through considerable material or non-material damage (§ 2 no. 11 BSIG).

Two points have already tied up budget in Germany: registration must be carried out under § 33(1) BSIG at the latest three months after the entity property arises; as the BSIG entered into force on 6 December 2025, this deadline has already expired for entities that have had that property since that day. Anyone who has missed registration should complete it without undue delay — it is the precondition for all further steps. Also already in effect is the general start of application of the AI Act on 2 August 2026 (Art. 113 AI Act); with Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, the high-risk obligations of Chapter III Sections 1–3 apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028. The transparency obligations of the AI Act do not attach to company size, but to the type of system: anyone who provides AI systems for direct interaction with people, generates synthetic content or publishes deepfakes must label or disclose this accordingly (Art. 50(1) to (4) AI Act). And the management body is itself a cost centre: it must implement the measures under Section 30 BSIG, monitor their implementation and attend training regularly (§ 38(1) to (3) BSIG). Also relevant for the budget in this band is the pay gap report: for 150 to 249 employees for the first time on 7 June 2027 and every three years thereafter (Art. 9(3) Directive (EU) 2023/970), for 100 to 149 employees only on 7 June 2031 and likewise every three years thereafter (Art. 9(4)) — in each case subject to national implementing law. The classification of the transposition deadline is set out in the Mid-cap section.

Mid-cap (250-999 employees)

Focus areas: all 5 + pay transparency. Cost drivers: a possible classification as a particularly important entity under NIS2 as well as pay analysis and report preparation for the pay gap report.

From 250 employees, the NIS2 classification can switch from 'important' to 'particularly important', and that can be quantified. Any other entity of an Annex 1 type qualifies as a particularly important entity where it employs at least 250 employees or has annual revenue of more than EUR 50 million and in addition an annual balance sheet total of more than EUR 43 million (§ 28(1) BSIG). For breaches of the risk management and reporting obligations, the fine range thus rises from up to EUR 7 million to up to EUR 10 million (§ 65(5) no. 1 BSIG); § 65(5) BSIG contains further tiers with their own statutory elements. The intensity of supervision also differs between the two classes defined in Art. 3 Directive (EU) 2022/2555: proactive supervision for essential and particularly important entities, ex post supervision for important entities.

The second new block is pay transparency — and this is where budget is frequently tied up too early. 7 June 2026 was the Member States' transposition deadline under Art. 34(1) Directive (EU) 2023/970, not a date from which private employers are directly bound by the Directive; the employer obligations take effect with national implementation (in Germany via a reform of the EntgTranspG, for which as at 17 August 2026 not even a ministerial draft existed — BT-Drs. 21/7026 of 8 July 2026; in Austria via an implementing act for which, as at the same date, neither a ministerial draft nor a government bill existed at federal level — the 2026 GlBG consultation draft concerns equal treatment in goods and services, not pay transparency; the current state of implementation is to be checked before budgeting). What can be planned for, by contrast, is the reporting cycle: employers with 250 or more employees report for the first time on 7 June 2027 and annually thereafter (Art. 9(2)), employers with 150 to 249 employees likewise for the first time on 7 June 2027 and every three years thereafter (Art. 9(3)) — in each case subject to national implementing law. The content includes, among other things, the gender pay gap including variable components, median values, the proportion of workers per pay quartile and the gap per category of worker (Art. 9(1)). Independently of this, the individual right to information under §§ 10 to 12 EntgTranspG already exists in Germany in establishments with, as a rule, more than 200 employees. Practice recommendation, not a statutory deadline: start job evaluation and pay gap calculation four to six months before the reporting date.

Enterprise (1,000+ employees)

Focus areas: all + ISO certifications + cluster compliance. Cost drivers: the number of parallel evidence streams and independent entities; an ISO certification is itself not a statutory obligation (classification below).

Evidence towards the supervisory authority is practically always a separate budget item in this band — it does not, however, depend on headcount, but in Germany on the property of being an operator of a critical installation and in Austria on the classification as an essential or important entity. In Germany, the recurring evidence obligation applies to operators of critical installations: they demonstrate implementation of the measures under § 30(1) in conjunction with § 31 BSIG at a point in time determined by the BSI — at the earliest three years after they first qualify as an operator of a critical installation — and every three years thereafter by means of security audits, checks or certifications, and transmit the results including any security deficiencies identified (§ 39(1) BSIG). In Austria, by contrast, the evidence obligation applies to all essential and important entities: structured self-declaration within twelve months of the registration obligation arising, on request evidence from an independent body within two years, and for essential entities evidence of operational and organisational implementation already within two months of the request (§ 33(1) and (2) NISG 2026) — the NISG 2026 starts to apply on 1 October 2026.

On the sanctions side, the revenue percentage becomes decisive from this size onwards: where total revenue exceeds EUR 500 million, up to 2% of worldwide total revenue may be imposed on particularly important entities and up to 1.4% on important entities (§ 65(6) and (7) BSIG). Under the AI Act, the upper range is EUR 35 million or 7% of worldwide annual revenue for breaches of the prohibited practices in Art. 5, whichever is higher (Art. 99(3) AI Act); for provider, deployer and transparency obligations it is up to EUR 15 million or 3% (Art. 99(4)). The relief in Art. 99(6) AI Act, under which the lower of the two amounts applies to SMEs including start-ups, only eases the burden on companies that qualify as SMEs.

What triggers the move from a spreadsheet solution to a platform solution in this band is the number of parallel evidence streams with their own deadlines: the three-year evidence requirement for operators of critical installations (§ 39(1) BSIG), the Austrian self-declaration within twelve months together with evidence from an independent body within two years of the request (§ 33(1) and (2) NISG 2026), the pay gap report from 250 employees annually (Art. 9(2) Directive (EU) 2023/970 via national implementing law) and the ongoing maintenance of records and technical and organisational measures under Art. 30 and Art. 32 GDPR. 'Cluster compliance' here means the case of several independent entities — for example several companies within a group — each of which must itself fulfil its registration (§ 33(1) BSIG) and its reporting chain (§ 32(1) BSIG): the evidence effort multiplies with the number of entities, not with the number of employees. An ISO certification is itself not a statutory obligation: § 39(1) BSIG permits security audits, checks or certifications as evidence — which is why this item is deliberately not listed in the statutory anchor table, and anyone providing the evidence via an audit saves the certification item.

Breakdown by domain: what drives the weighting

This article does not give a fixed percentage breakdown across the five domains: the weighting depends on which obligations apply to your company at all — without a type under an annex, for example, the NIS2 block is dropped, and below, as a rule, 50 employees the internal reporting channel under the HinSchG.

The weighting follows the number of recurring obligations per domain. The GDPR share carries the maintenance of records and technical and organisational measures (Art. 30 and Art. 32 GDPR), access and erasure requests under Art. 15 to 22 with the one-month deadline in Art. 12(3), data processing agreements (Art. 28) and the 72-hour reporting route (Art. 33). The NIS2 share bundles the ten areas of measures in § 30(2) BSIG including documentation, registration (§ 33 BSIG) and reporting readiness (§ 32 BSIG). The AI Act share covers labelling and disclosure under Art. 50 AI Act as well as — in the case of a high-risk classification under Art. 6 AI Act — risk management, documentation and conformity assessment; the high-risk obligations of Chapter III Sections 1–3 only tie up budget, however, from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) respectively (Art. 113(3)(c) AI Act as amended by Regulation (EU) 2026/1744). HinSchG and AGG are as a rule the smaller blocks because they are predominantly operating and training effort: internal reporting channel with a chain of deadlines (§§ 12 and 17 HinSchG) as well as protective measures, training and the employer's complaints body (§ 12(1) to (3) and § 13(1) AGG). Practice recommendation, not a statutory requirement: refresh AGG training every two to three years, NIS2 management training once or twice a year.

How to calculate your budget

Short answer: in five steps. 1. Determine the size band and read off the obligations it triggers (sections above). 2. Check the annex classification under Annex 1 or 2 BSIG — if neither a type under an annex nor one of the size-independent categories in § 28 BSIG applies, the NIS2 block is dropped (check step above). 3. Tick off the rows of the statutory anchor table that apply to you; rows that do not apply are deleted from the budget. 4. For each remaining item, set one-off and running effort separately: internal working time in person-days multiplied by the internal day rate, external services as quoted, tooling as quoted. 5. Add sector specifics: operators of critical installations additionally bear the three-year evidence requirement under § 39(1) BSIG; if further sector-specific requirements apply to your sector, record them as a separate row. The savings levers in the FAQ only take effect after that.

Statutory anchors: which provision triggers which budget item

Short answer: every budget item in this article that is triggered by law has a clearly identifiable statutory trigger — in part with alternatives, in part in two stages; anyone who knows it can delete items that do not apply to their company at all. Voluntary items (insurance, tooling, training beyond the mandatory content) are deliberately not in the table and are business decisions. The column 'Trigger' names for each row the statutory element from which the obligation exists; the column 'Budget item' is the editorial assignment to the cost block and is not a legal statement. The sources from BDSG, TDDDG, AGG, HinSchG, BSIG and EntgTranspG apply in Germany; the GDPR and the AI Act apply directly as EU regulations in Germany and Austria.

Austria: same cost blocks, different sources

Short answer: the cost blocks are the same in Austria, the legal bases and in part the evidence logic differ. The following table names the Austrian sources for the cost blocks governed at national level as well as AT-specific risk amounts; the GDPR and the AI Act apply unchanged in both countries. The NISG 2026 starts to apply on 1 October 2026.