Compliance Calendar Implementation: Tools and Workflow

Main article: Compliance Annual Plan 2026 — eight quarterly activities across six areas of law, two per quarter, plus the cross-quarter working rhythm.

What a compliance calendar has to deliver

A compliance calendar has to deliver three things: carry recurring obligations with a plannable date, start event-driven deadlines and document that they have been met.

The first group can be set up as a recurring appointment — updating the record of processing activities (Art. 30 GDPR), the review of technical and organisational measures (Art. 32 GDPR), updating the NIS2 risk analysis (§ 30(2) BSIG) or AI literacy training (Art. 4 EU AI Act).

The second group has no date, but a clock: once a personal data breach becomes known, the 72-hour deadline of Art. 33(1) GDPR starts running; in the case of a significant security incident, a 24-hour deadline for the early warning starts under § 32(1) no. 1 BSIG. An incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG). A calendar containing only annual appointments fails to cover precisely those cases in which the deadline is measured in hours.

Third, the calendar serves as evidence. § 30(1) BSIG requires compliance with the risk management measures to be documented — completed appointments with the results attached are the simplest source for this.

Setting it up in five steps

The build follows five steps: clarify whether you are in scope, collect the obligations, define those responsible and the lead time, create response templates, schedule the quarterly review.

1. Clarify whether you are in scope. Which sets of rules apply at all depends on sector and size; the decisive thresholds are listed in the following section.
2. Collect the obligations. Every line gets four fields: task, legal basis, frequency, responsible person. No line without a legal source — and the frequency field records whether the rhythm comes from the law or is a practice recommendation.
3. Define those responsible and the lead time. Compliance officer as owner, management as the escalation level. Practice recommendation: one advance appointment 30 days before each annual obligation for input from IT, HR and procurement.
4. Create response templates. For every clock a task chain with recipient and deadline — personal data breach, security incident, whistleblower report and data subject request. The chain for the security incident is set out in full further below.
5. Schedule the quarterly review. A recurring appointment with fixed standing topics — details in the quarterly plan further below.

Clarifying scope: which thresholds apply

Whether NIS2, whistleblower protection, the obligation to appoint a data protection officer and pay transparency apply is decided by sector and size.

For companies in Germany, being in scope of NIS2 is tied to a type of entity specified in Annex 1 or Annex 2 of the BSIG; federal administration entities are covered separately under § 29 BSIG. Annex 1 lists the highly critical sectors (energy, transport, finance, health, water, digital infrastructure including the management of ICT services, space), Annex 2 the other critical sectors (postal and courier services, waste management, chemicals, food, manufacturing, digital service providers, research). Within these types, an entity counts as an important entity if it employs at least 50 people or has an annual turnover and an annual balance sheet total each exceeding EUR 10 million; other entities of a type specified in Annex 1 count as particularly important entities if they have at least 250 employees or more than EUR 50 million in annual turnover and, in addition, more than EUR 43 million in annual balance sheet total (§ 28(1) and (2) BSIG). Covered irrespective of size are, among others, operators of critical installations, qualified trust service providers, top-level domain name registries, DNS service providers and certain providers of public telecommunications networks and services. Austria uses the same size values and likewise requires the entity to belong to a type under Annex 1 or Annex 2 (§ 24, § 25 NISG 2026).

The remaining thresholds: an internal reporting office must be set up in Germany where there are as a rule at least 50 employees (§ 12 HinSchG), and in Austria where there are 50 or more employees or public servants (§ 11 HSchG). In Germany, a data protection officer must be appointed where, as a rule, at least 20 persons are permanently engaged in automated processing — and, irrespective of the number of persons, where processing operations are subject to a data protection impact assessment under Art. 35 GDPR or where data are processed commercially for the purpose of transfer or for purposes of market or opinion research (§ 38(1) of the German Federal Data Protection Act (BDSG)); alongside this, the EU base cases of Art. 37(1) GDPR apply (public authority, large-scale regular and systematic monitoring, large-scale processing of special categories of data). Austria has no additional numerical threshold. In Germany, the right to information under the German Pay Transparency Act (EntgTranspG) exists in establishments with, as a rule, more than 200 employees.

Recurring obligations: the annual baseline

Eight obligations are not one-off but have to be performed annually or periodically — they form the backbone of every calendar. The column "Basis of the frequency" separates what the law prescribes from what is a practice recommendation: where it says "practice recommendation", the rhythm is established practice and not a statutory deadline that can be mapped in a calendar — in the case of § 30(2) BSIG and § 12(2) AGG, for instance, the wording of the provision names no interval. Anyone moving an appointment there moves a recommendation — whereas for the pay gap reports they would be moving a statutory deadline. Where national law is concerned (BSIG, HinSchG, AGG), the table names the German legal sources; the Austrian equivalents are set out further below. The GDPR and the AI Act apply as directly applicable EU law in the same way in Germany and Austria.

In addition there is an evidence deadline on a multi-year cycle, here prescribed by law: in Germany, operators of critical installations demonstrate implementation at a point in time set by the Federal Office for Information Security (BSI) — at the earliest three years after they first qualify as the operator of a critical installation — and every three years thereafter by means of security audits, reviews or certifications (§ 39(1) BSIG).

Event-driven deadlines: the clocks in the calendar

These deadlines do not start on a date but with an event — set up a task template with a start trigger for each line. Unlike the annual baseline, the entries here are statutory deadlines, not recommendations — with the exception of the last line, which is a preparation appointment.

Tools: choosing along four requirements

Test a tool against four requirements before comparing prices — a calendar without a template for the 24-hour case fails half its purpose. The requirements follow from the deadlines above, independently of the provider. We have not tested the four tools named below against them; use the checklist in a trial account and enter the result yourself.

Four tools are on the shortlist. Price, size and suitability details: as at 05/2026, not re-surveyed — this also applies to the assessments in the "Target group" and "Features" columns; the Notion price is stated without reference to a number of users, the other three per employee and month. The provider's current price list is what counts.

Workflow: the task chain behind the appointment

The workflow consists of three fixed rules and one template per clock: quarterly appointments run as recurring tasks, the compliance officer is the owner, and a red status is escalated to management; ongoing communication runs via the Slack/Teams integration, the appointments themselves via the Outlook connection. For the deadlines that run in hours, this is not enough — there, every step needs a point in time, a responsible person and a result that can be filed.

Example task chain: significant security incident

The allocation of roles is a practical suggestion and is often combined in one person in smaller organisations; the statutory deadlines and legal sources are not — lines without a statutory deadline are expressly marked as such.

Escalation paths: who is informed and when

Three levels are enough (practice recommendation): a reminder to the owner 14 days before the due date, a summary email to management 30 days after it is missed, red status as a standing topic in the quarterly meeting. Prioritise by fine ranges: the EU AI Act up to EUR 35 million or 7 % of worldwide annual turnover for prohibited practices, whichever is higher (Art. 99(3)), the GDPR up to EUR 20 million or 4 % (Art. 83(5)), HinSchG up to EUR 50,000, and up to EUR 20,000 for a missing internal reporting office (§ 40(6) sentence 1 HinSchG; AT: up to EUR 20,000, in the event of repetition EUR 40,000, § 24 HSchG).

Under NIS2 the ranges differ: in Germany, § 65(5) no. 1 in conjunction with (6) and (7) BSIG provides for fines of up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities for infringements of, among other things, the risk management and reporting obligations; only where total turnover exceeds EUR 500 million do 2 % and 1.4 % of worldwide total turnover respectively take their place. In Austria, under § 45(2) and (3) NISG 2026 the higher of the two values applies directly: EUR 10 million or 2 % for essential entities, EUR 7 million or 1.4 % for important entities.

That management is the addressee of escalation is initially a practice recommendation; for entities in scope of NIS2 it follows from the law: the management bodies of particularly important and important entities must implement the risk management measures under Section 30 BSIG and supervise their implementation; if they breach this duty, they are liable to their entity for culpably caused damage under the rules of the company law applicable to the legal form (Section 38 BSIG). In Austria, the corresponding governance duty is set out in § 31 NISG 2026: ensuring and supervising risk management measures, together with participation in specifically designed cybersecurity training.

Example quarterly plan 2026

A workable annual plan spreads nine activities across four quarters so that audit preparation, training and reporting do not pile up in December:

1. Q1 — audit preparation: update of the record of processing activities, reconciliation of data processing agreements, training refresh, quarterly risk review.
2. Q1 — effectiveness self-check of the internal reporting office (best practice, not a statutory obligation): compliance with deadlines (§ 17 HinSchG), confidentiality (§ 8 HinSchG), handling of anonymous reports, training status, protection against reprisals (§ 36 HinSchG). Modelled on ISO 37301.
3. Q2 — preparing for EU pay transparency: set up job evaluation and pay gap calculation; the Directive provides for the reporting obligation from 250 employees as from 7 June 2027 (Art. 9(2) Directive (EU) 2023/970), but it only becomes effective via national transposing law — the transposition deadline of 7 June 2026 has passed, and as at 17 August 2026 Germany and Austria had not transposed it.
4. Q2 — review of the DSK collection of resolutions: review resolutions published by the DSK since the last review for any need to adjust (practice rhythm, not a statutory deadline).
5. Q3 — NIS2 supplier audit: evaluate self-declarations, audit critical suppliers on site.
6. Q3 — GPAI update: the GPAI obligations have applied since 2 August 2025; only legacy models placed on the market before that date have until 2 August 2027. Review provider data processing agreements.
7. Q4 — awareness training and refresher on AI literacy under Art. 4 AI Act in the version in force since 27 July 2026 — what is required are measures to support AI literacy; no particular level of competence is owed; according to the Commission's FAQ a certificate is not required, an internal training record is sufficient. Q4 is convenient because of the budget discussions.
8. Q4 — management review and year-end audit: management and the compliance officer review the annual compliance report.
9. Throughout the year — quarterly appointment in the calendar: a compliance officer meeting on the first Wednesday of each quarter with the standing topics record of processing activities, data processing agreements, incidents, training, supervisory news.

Framework of dates for 2026: the member states' transposition deadline for pay transparency (7 June 2026), the Austrian EntgleichV (forecast start of application 1 July 2026, not a statutory deadline; the forecast date has passed), the general start of application of the AI Act (2 August 2026, Art. 113), the start of application of NISG 2026 (1 October 2026). There is no official date for the start of German BSI supervisory practice.

One obligation has already fallen due: under § 33(1) BSIG, registration with the BSI must take place no later than three months after the entity qualifies as such, and the BSI points out that the statutory registration deadline has already expired. Anyone who has missed it should make up for it without undue delay via the registration facility set up jointly by the BSI and the BBK (§ 33(1) BSIG) and thereafter report changes to the master data submitted within two weeks (§ 33(5) BSIG). With the registration, the entity submits its master data — including name, address and contact details, sector and competent supervisory authorities (§ 33(1) BSIG); the risk management and reporting obligations of §§ 30 and 32 BSIG apply irrespective of this.

Austria: same rhythm, different legal sources

The calendar rhythm in Austria is identical, the legal bases are not. NIS2 follows NISG 2026 instead of the BSIG: registration (§ 29), risk management measures (§ 32), reports to the competent CSIRT (§ 34); the competent body is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) instead of the BSI. The three-year evidence requirement under § 39 BSIG concerns only German operators of critical installations; in Austria § 33 NISG 2026 applies — self-declaration within twelve months of the registration obligation arising, on request evidence by an independent body within two years, and for essential entities operational and organisational implementation within as little as two months of the request.

Whistleblower protection follows the HSchG: an internal office from 50 employees (§ 11), protection against retaliation (§ 20); the external office is the Federal Bureau of Anti-Corruption (BAK), and in Germany the federal external reporting office at the Federal Office of Justice (BfJ). In data protection, the Austrian Data Protection Act (DSG) applies alongside the GDPR, with the Austrian Data Protection Authority (Datenschutzbehörde) as the supervisory authority; the DSK is a purely German body. On equal treatment, the GlBG takes the place of the AGG: prohibition of discrimination § 3 (sex) and § 17 (ethnic origin, religion or belief, age, sexual orientation), gender-neutral job advertisements § 9 (infringements punishable by a fine of up to EUR 360, § 10), non-discriminatory pay criteria § 11; advice and supervision are provided by the Ombud for Equal Treatment (GAW) and the Equal Treatment Commission (Gleichbehandlungskommission) instead of the Federal Anti-Discrimination Agency (Antidiskriminierungsstelle des Bundes). Pure EU law — the AI Act and Directive (EU) 2023/970 — applies in the same way in both countries.