Compliance Maturity Model SME: 5-Level Self-Assessment

Main article: Compliance Tool Stack 2026 — the overarching article on the tools behind these steps.

What the model does — and what it is not

The five-level model classifies the state of your compliance organisation; it does not create any obligation and does not replace an applicability assessment. CMMI, ISO 37301 and NIST CSF serve as reference models; the level names and the allocation of obligations in this article are our own practice classification and not a reproduction of those standards.

Whether an obligation applies is decided by threshold and activity, not by the level. In Germany, an internal reporting channel must be set up and operated from as a rule 50 employees onwards (§ 12(1) and (2) HinSchG), in Austria from 50 or more employees or public-sector staff (§ 3(1), § 11(1) HSchG). In Germany, in addition to Art. 37(1)(b) and (c) GDPR — core activity being the regular and systematic monitoring of data subjects on a large scale, or the large-scale processing of special categories of data or of data relating to criminal convictions (Art. 9, Art. 10 GDPR) — a data protection officer must be designated where, as a rule, at least 20 persons are permanently engaged in the automated processing of personal data (§ 38(1) BDSG); Austria provides for no numerical threshold going beyond Art. 37 GDPR. Under NIS2, the sector type under Annex 1 or 2 and the size classes of § 28 BSIG or § 25 NISG 2026 are decisive — certain types such as DNS service providers, TLD name registries, qualified trust service providers and providers of public telecommunications networks and services are covered irrespective of size; in Germany, the federal administration is covered separately under § 29 BSIG.

An organisation at level 2 can therefore be compliant while an organisation at level 4 carries an unresolved obligation.

Level 1: Initial

You recognise level 1 by compliance running reactively and ad hoc: no compliance officer, no documentation, no training — and therefore a high risk of fines.

Legally, the low level changes nothing. Any processing of personal data is lawful only if one of the six legal bases of Art. 6(1) GDPR is met. Requests from data subjects must be answered without undue delay and at the latest within one month; in complex cases an extension by two months is possible, of which the data subject must be informed with reasons within one month (Art. 12(3) GDPR). A personal data breach must be notified without undue delay and where feasible within 72 hours — unless it is unlikely to result in a risk to the rights and freedoms of natural persons; where the notification is made later, reasons for the delay must be given (Art. 33(1) GDPR). In Germany, cookies and comparable access to terminal equipment require prior, informed consent unless the access is strictly necessary (§ 25 TDDDG).

The range of fines is tiered: infringements of the principles of processing, the conditions for consent and the rights of data subjects are subject to fines of up to EUR 20 million or 4 % of total worldwide annual turnover, infringements of the obligations under Art. 25 to 39 — including the notification obligation under Art. 33 — to up to EUR 10 million or 2 %, whichever is higher (Art. 83(4) and (5) GDPR).

Next step (practice recommendation): build a record of processing activities (Art. 30 GDPR) and an inventory of Data Processors — this is the data basis for everything that follows.

Level 2: Reactive

At level 2 the mandatory documentation exists — record of processing activities and data processing agreements — but it is static: no officer, training only at onboarding.

Static means: the documents age faster than the processes. Data Processors may only be used if they provide sufficient guarantees of appropriate technical and organisational measures; the contract must set out the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects and the obligations and rights of the controller (Art. 28(1) and (3) GDPR). Above the 50-employee threshold, the internal reporting channel is added: acknowledgement of receipt at the latest after seven days (§ 17(1) no. 1 HinSchG; AT seven calendar days for written reports, § 9(1) HSchG), feedback on follow-up measures within three months (§ 17(2) HinSchG; AT § 13(9) HSchG), confidentiality of identity (§ 8 HinSchG, AT § 7 HSchG), prohibition of reprisals (§ 36 HinSchG, AT § 20 HSchG).

The sanctions are tailored differently in each jurisdiction — a close look pays off here. In Germany, failing to set up and operate an internal reporting channel is an administrative offence: a fine of up to EUR 20,000 (§ 40(2) no. 2 HinSchG); obstructing a report, reprisals and intentional or reckless breaches of confidentiality up to EUR 50,000 (§ 40(2) nos. 1 and 3, (3) HinSchG), negligent breaches of confidentiality up to EUR 10,000 (§ 40(4) HinSchG); for obstruction, reprisals and breaches of confidentiality the maximum fine is multiplied by ten for legal persons — for the EUR 50,000 cases, up to EUR 500,000 (§ 40(6) HinSchG in conjunction with § 30(2) sentence 3 OWiG). In Austria, obstructing or putting pressure on a protected person, retaliation, breaching confidentiality under §§ 7 or 17(1) HSchG and knowingly false reports are administrative offences: a fine of up to EUR 20,000, and up to EUR 40,000 in the event of repetition (§ 24 HSchG).

Next step (practice recommendation): decouple training from onboarding — under German anti-discrimination law, suitable training of employees counts as fulfilment of the prevention obligation (§ 12(2) AGG); the act and the competent complaints body must be made known within the organisation (§ 12(5), § 13 AGG).

Level 3: Proactive

Level 3 is reached once responsibility has been assigned: a part-time compliance officer, regular training, audit preparation, quarterly reviews.

This makes compliance plannable — and two sets of rules now require an assessment of their own. NIS2: in Germany the BSI registration deadline expired on 6 March 2026; anyone who missed it should complete the registration without undue delay. The general rule is: registration at the latest three months after an entity first qualifies as particularly important or important (§ 33(1) BSIG). In Austria the NISG 2026 starts to apply on 1 October 2026; registration with the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) must take place within three months (§ 29 NISG 2026). Entities in scope implement the statutory minimum catalogue — risk analysis, incident handling, business continuity, supply chain security, cryptography, access control, multi-factor authentication (Section 30 BSIG; AT § 32 NISG 2026) — and report significant security incidents in three stages: early warning within 24 hours, assessment within 72 hours, final report at the latest one month afterwards (§ 32 BSIG; AT § 34 NISG 2026). In Germany the management body must implement the measures, supervise their implementation and take part in training regularly (Section 38 BSIG); in Austria the management bodies must, from 1 October 2026, ensure and supervise compliance and take part in specifically designed cybersecurity training (§ 31 NISG 2026).

AI Act (EU AI Act): record which AI systems are in use and classify them. Under Art. 6(2) AI Act, the systems listed in Annex III are high-risk, among them biometrics, employment and workforce management and creditworthiness assessment; by way of exception, such a system is not considered high-risk if it does not pose a significant risk to health, safety or fundamental rights — unless it performs profiling of natural persons (Art. 6(3) AI Act). For systems with direct interaction, synthetic content and deepfakes, the disclosure obligations of Art. 50 AI Act apply. The general date of application (including Art. 50) arrived on 2 August 2026; with Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, the high-risk obligations of Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 and the obligations relating to Art. 6(1) AI Act (AI in products under Annex I) from 2 August 2028 (Art. 113 AI Act). Art. 4 AI Act has applied since 2 February 2025 and, since 27 July 2026, in a new version: providers and deployers take measures to support the development of AI literacy; no particular level of competence is owed.

Why level 3 is the target state for most SMEs (practice recommendation): at this level, responsibility, training rhythm and review cadence are assigned — the obligations are therefore worked on continuously rather than only when something happens. The additional effort for levels 4 and 5 pays off where proof towards third parties is required: for the evidence obligation for operators of critical installations (§ 39(1) BSIG), for the Austrian self-declaration and the proof by an independent body (§ 33 NISG 2026), or where customers, tenders or a group of companies demand a certificate. In the absence of such occasions, the jump to level 4 mainly brings additional documentation effort.

Next step (practice recommendation): assess whether NIS2 applies to you and document the result, set up an AI inventory with a risk classification per system — both in writing, so that the assessment can be evidenced later.

Level 4: Integrated

Level 4 differs from level 3 in its ability to provide evidence: compliance is integrated into all processes, the ISMS and the data protection management system are documented, management receives compliance reporting, and an ISO certification — for the ISMS, ISO/IEC 27001 — is in place or being built up.

Under § 30(1) BSIG, compliance with the risk management measures must be documented. The regular obligation to provide evidence through security audits, reviews or certifications — at the earliest three years after the first classification, and every three years thereafter — applies in Germany to operators of critical installations (§ 39(1) BSIG). In Austria, from the date of application of the NISG 2026 on 1 October 2026, all essential and important entities must submit a self-declaration within twelve months of the registration obligation arising; upon request, implementation must be evidenced by an independent body within two years, and essential entities must evidence operational and organisational implementation within as little as two months of being requested to do so (§ 33 NISG 2026).

In data protection, this is where the data protection impact assessment belongs, carried out before processing likely to result in a high risk, for instance profiling with legal effect or large-scale processing of special categories of data (Art. 35 GDPR) — in Germany, processing subject to a DPIA triggers the designation of a data protection officer irrespective of the number of persons (§ 38(1) BDSG). Effective encryption can render notification of data subjects after a Personal Data Breach unnecessary (Art. 34(3) GDPR).

Next step (practice recommendation): set up evidence management — define for each obligation which document evidences it, who maintains it and when it is reviewed.

Level 5: Strategic

Level 5 uses compliance as a competitive advantage: compliance as code, predictive compliance and ESG integration shape the way of working.

In this model, compliance as code means generating recurring evidence by machine rather than manually — for instance the compliance with risk management measures to be documented under § 30(1) BSIG, or the reconciliation of the record of processing activities with the technical measures (Art. 30, Art. 32 GDPR). Predictive compliance means preparing for obligations before they take effect: the first pay gap reports by 7 June 2027 — from 250 employees annually thereafter, every three years for 150 to 249 employees, and for the first time by 7 June 2031 for 100 to 149 employees (Art. 9(2)–(4) Directive (EU) 2023/970, the decisive rules being the national transposing law; the transposition deadline of 7 June 2026 has passed, and as at 17 August 2026 a German transposing act had not even been published as a ministerial draft — BT-Drs. 21/7026 —, and Austria had by then presented neither a ministerial draft nor a government bill) —, the end of the GPAI transition period on 2 August 2027 and the high-risk dates postponed by Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026: the obligations of Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028. In this model, ESG integration means attaching sustainability requirements to the same evidence and review process as the obligations of the previous levels — a practice classification of this model, not a legal obligation.

Measurability is not an end in itself: assessing the effectiveness of the risk management measures is part of the statutory minimum catalogue (Art. 21(2) NIS2 Directive; § 30(2) BSIG; § 32(4) NISG 2026). It is different for the internal reporting channel: the annual self-assessment of effectiveness is best practice; there is no statutory audit obligation for it (§§ 12–18 HinSchG). Pay transparency also provides lead time: in Germany the individual right to information already exists today in organisations with, as a rule, more than 200 employees (§§ 10–12 EntgTranspG); Art. 7 of Directive (EU) 2023/970, by contrast, provides for the right to information irrespective of size and with a response deadline of no more than two months — the transposition deadline (7 June 2026) has passed, and as at 17 August 2026 a German transposing act was not in place (BT-Drs. 21/7026).

Next step (practice recommendation): plan upcoming dates backwards — for the pay gap report, prepare job evaluation and pay data now.

Obligations behind the levels: legal sources for Germany and Austria

These obligations determine progress through the levels — check the trigger first, then the legal source. The EU regulations themselves (GDPR, AI Act) apply identically in Germany and Austria; their national supplements (BDSG and TDDDG as against the DSG) as well as whistleblower protection, NIS2 and equal treatment differ in act, section and competent authority. Under the AI Act the obligations are identical, supervision is not: in Germany the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) KI-MIG), unless sectoral authorities — such as BaFin — are competent; as at the date of this article (17 August 2026) Austria had not designated a market surveillance authority under Art. 70 AI Act, and the AI service point of RTR is an information and advisory body without supervisory powers. A note on timing for Austria: the NISG 2026 starts to apply on 1 October 2026 — the five NIS2 rows with an Austrian legal source are relevant from that date onwards.

Self-assessment

The self-test assigns you to a level across five dimensions: documentation status, officer status, training frequency, audit preparation and reporting maturity — the score gives the level.

The questionnaire below covers these five dimensions with two questions each; each block carries its dimension as a heading so that, at a level boundary, you can name the weakest dimension. Award 0 points (not in place), 1 point (partial or not documented) or 2 points (complete and evidenced) per question. The legal sources in the questions predominantly refer to German law; the Austrian equivalents are set out in the obligations matrix above.

Documentation status

1. Is the record of processing activities complete and has it been updated within the last twelve months?
2. Is there a contract for every service provider containing the minimum content of Art. 28(3) GDPR?

Officer status (assigned responsibilities)

3. Has it been clarified and documented whether a data protection officer must be designated — and has one been designated (Art. 37 GDPR, § 38(1) BDSG)?
4. Above the 50-employee threshold, is there an internal reporting channel with named responsible persons (§ 12 HinSchG, AT § 11 HSchG)?

Training frequency

5. Have employees been trained on anti-discrimination (§ 12(2) AGG)?
6. Have measures to develop AI literacy been taken and documented internally for the users of AI systems (Art. 4 AI Act in the version applicable since 27 July 2026 — no particular level of competence is owed, no certificate is required)?

Audit preparation (evidence towards the supervisory authority)

7. Can you evidence your technical and organisational measures (Art. 32 GDPR, under NIS2 § 30(1) BSIG)?
8. Has it been assessed and documented whether NIS2 covers you — and has registration taken place (§ 33 BSIG)?

Reporting maturity (reporting route to the outside, reporting upwards)

9. Is there a designated reporting route that meets the 72-hour deadline and, where applicable, the 24-hour early warning?
10. Does the compliance function report regularly to the management body — and, where NIS2 applies, does the management body take part in the cybersecurity training?

Evaluation: 0–4 points level 1, 5–9 level 2, 10–14 level 3, 15–17 level 4, 18–20 level 5. Questions that do not apply are dropped — anyone below the 50-employee threshold skips question 4, anyone not using AI systems skips question 6; scale the score up proportionally in that case (points achieved divided by points possible, times 20). Questions 4 and 8 are knock-out questions: anyone who meets the threshold and awards 0 points there has an unresolved legal obligation — regardless of the overall score. Of the two points mentioned in question 10, only the management body's participation in training is required by law (§ 38(3) BSIG; AT § 31 NISG 2026); the reporting rhythm towards the management body is a practice recommendation.

Roadmap recommendation

The following timings are practice-based values for the organisational transition, not statutory deadlines: level 1→2 record of processing activities and data processing agreement inventory in 3 months, 2→3 compliance officer and quarterly reviews in 6 months, 3→4 ISMS and ISO certification in 12 months, 4→5 predictive compliance and ESG in 18 months.

The order is not arbitrary, because each stage carries the next. Without a record of processing activities, the service provider inventory cannot be kept complete, nor can it be determined which processing triggers a data protection impact assessment. Without assigned responsibility there is nobody who owns the applicability assessments for NIS2 and the AI Act and who watches the deadlines. And without those assessments, evidence management at level 4 has no subject matter — only what has been decided beforehand can be documented. Anyone who skips stages builds evidence for obligations whose applicability they have never assessed.

Irrespective of this, the statutory deadlines run from day one, including at level 1; the overview is in the last FAQ answer. Recurring rhythms such as 'update the record of processing activities annually', 'management training once or twice a year' or 'AGG training every two to three years', by contrast, come from our deadline and annual planning and are practice recommendations; the legal bases cited there are German law — in Austria the GlBG takes the place of the AGG and the NISG 2026 takes the place of the BSIG. In Germany, § 38(3) BSIG requires the management body to take part in training regularly, in Austria § 31 NISG 2026 requires participation in specifically designed cybersecurity training; what cadence 'regularly' means is for you to define and document.