Compliance Reporting to Management and Board: 5 KPIs and Dashboard

Main article: Compliance Liability of Managing Directors 2026: 6 Risks — the full article on this topic.

What is a legal duty in the management report — and what is a practice recommendation

What is anchored in law is not the report format but the governance duty behind it: in Germany, the management bodies of particularly important entities and important entities must implement the risk management measures under Section 30 BSIG and monitor their implementation (§ 38(1) BSIG); in Austria, the management bodies of essential entities and important entities must ensure and supervise compliance with the measures under § 32 NISG 2026 (§ 31(1) NISG 2026). The choice of KPIs, the scales, the target values, the page count and the quarterly cycle do not follow from this — they are marked as practice recommendations where they appear in the text.

Who is subject to the duty is determined by the classification. In Germany, any other entity of a type specified in Annex 1 counts as a particularly important entity if it employs at least 250 employees, or has an annual turnover of more than EUR 50 million and in addition an annual balance sheet total of more than EUR 43 million; an entity of a type specified in Annex 1 or 2 counts as an important entity if it has at least 50 employees, or an annual turnover and an annual balance sheet total each exceeding EUR 10 million (§ 28(1) and (2) BSIG). Austria works with the same size metrics for large and medium-sized undertakings (§ 25(2) and (3) NISG 2026) and assigns essential and important entities on that basis (§ 24 NISG 2026). Without assignment to an annex type, this size-based classification does not apply; independently of these size thresholds, certain types of entity additionally count as particularly important entities — in Germany operators of critical installations, qualified trust service providers, top-level domain name registries and DNS service providers (§ 28(1) BSIG); in Austria, qualified trust service providers, TLD name registries and DNS service providers, among others, count as essential entities irrespective of size (§ 24(1) NISG 2026).

The report is not an end in itself: § 38(2) BSIG directs internal liability to follow the company law applicable to the legal form — for the GmbH § 43 GmbHG, which obliges managing directors to exercise the diligence of a prudent businessperson and, if breached, leads to liability towards the company, and for the stock corporation § 93 AktG as the liability provision. In Germany, compliance with the risk management measures must be documented (§ 30(1) BSIG); a recurring report is the customary way to bring that documentation and the monitoring under § 38(1) BSIG together in one place (practice recommendation). The effect relevant to liability lies not in the report as a document but in its documentary function: it records when that monitoring took place and what was decided. Practice recommendation for evidential value: for each report, log the date, the circle of addressees, the management body's submission or acknowledgement note and the decisions taken under chapter 5 — without documented acknowledgement, the report does not show whether the management body received it at all. In Austria, liability follows general company law (see the governance table); in practice the report is kept there as documentation of the diligence owed under § 25 of the Austrian GmbHG or § 84 of the Austrian AktG (practice recommendation). The Austrian NISG 2026 references in the following table apply from its date of application on 1 October 2026.

KPI 1: compliance risk score

The compliance risk score aggregates the degree of fulfilment across GDPR, NIS2, AI Act, HinSchG and AGG on a scale from 0 to 100, calculated as fulfilled obligations divided by the total number of applicable obligations; target value >75 — scale, calculation method and target value are practice recommendations.

The score only becomes robust through its denominator: the register of obligations. For each set of rules, the obligations with a clear reference can be included — GDPR: record of processing activities (Art. 30), data processing agreements with the minimum content of Art. 28(3), data protection impact assessment where processing is likely to result in a high risk (Art. 35(1)), designation of a data protection officer (Art. 37(1); in Germany additionally where, as a rule, 20 persons are constantly engaged in automated processing, § 38(1) BDSG; Austria provides for no numerical threshold going beyond Art. 37 GDPR, § 5 DSG). NIS2: the minimum catalogue of § 30(2) nos. 1 to 10 BSIG or § 32(4)(a) to (j) NISG 2026. HinSchG: internal reporting channel from, as a rule, 50 employees (§ 12(1), (2) HinSchG; AT: § 11(1) of the Austrian Whistleblower Protection Act (HSchG) from 50 employees). AGG: the employer's protective and preventive measures (§ 12(1) to (3) AGG; AT: prohibitions of discrimination § 3 and § 17 of the Austrian Equal Treatment Act (GlBG)).

For weighting, the fine framework provides the hardest reference point: the AI Act up to EUR 35 million or 7% of total worldwide annual turnover for prohibited practices under Art. 5 (Art. 99(3)), the GDPR up to EUR 20 million or 4% (Art. 83(5)), NIS2 up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities — under the AI Act and the GDPR the higher of the two amounts applies in each case; in Austria the figures are up to EUR 10 million or 2% of total worldwide annual turnover for essential entities and up to EUR 7 million or 1.4% for important entities, whichever amount is higher (§ 45(2), (3) NISG 2026); in Germany the framework for infringements of, among others, the risk management and reporting duties is set at EUR 10 million or EUR 7 million respectively, and where total turnover exceeds EUR 500 million, at up to 2% or 1.4% of total worldwide turnover instead (§ 65(5) no. 1, (6), (7) BSIG). For whistleblower protection, the framework extends to EUR 50,000 (hindering a report, retaliation, breach of confidentiality), EUR 20,000 (among others, a missing internal reporting channel) and EUR 10,000 in all other cases (§ 40(2) to (6) HinSchG); against legal persons, the maximum is multiplied by ten for hindering, retaliation and breach of confidentiality, i.e. up to EUR 500,000 in the EUR 50,000 cases (§ 40(6) sentence 2 HinSchG in conjunction with § 30(2) sentence 3 OWiG); in Austria up to EUR 20,000, or up to EUR 40,000 for a repeat offence (§ 24 HSchG). For SMEs including start-ups, the lower of the two amounts applies under the AI Act (Art. 99(6)); the EUR 35 million figure is therefore not the benchmark for small undertakings. The specific weighting formula remains an in-house decision. Practice recommendation for the calculation: the basic variant is the unweighted fulfilment rate. Anyone who weights assigns each obligation a fixed weight based on the fine framework of the provision — for example 3 for prohibited practices under Art. 5 AI Act (Art. 99(3)), 2 for obligations under Art. 83(5) GDPR and § 65(5) no. 1 BSIG, 1 for the rest — and calculates the rate on a weighted basis. What matters is that the variant and the weights stay constant across quarters; otherwise the comparison with the previous quarter in chapter 2 is worthless.

KPI 2: security incidents (trend)

Reported per quarter (practice recommendation) are the number of incidents, the damage volume and the response time, presented as a red/amber/green trend indicator — the traffic light is a presentation convention, whereas the response time is measured against real statutory deadlines.

Response time is measured against the NIS2 reporting stages and against Art. 33(1) GDPR; triggers, deadlines and references for Germany and Austria are set out in full in the table 'Statutory deadlines'.

For the figure in the dashboard to hold up, the significance threshold has to be documented alongside it: an incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss (AT: severe financial loss), or has affected or is capable of affecting other persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG; AT: § 35(1) NISG 2026). Practice recommendation: for each incident, log the four time stamps of becoming aware, the 24-hour report, the 72-hour report and closure — this produces the response time metric without any follow-up research.

Practice recommendation for the traffic light: green if all reporting stages of the quarter were served within the deadlines under § 32(1) BSIG or § 34(2) NISG 2026; amber if a deadline was missed and the report was made subsequently; red if a report was omitted or if the significance assessment under § 2 no. 11 BSIG or § 35(1) NISG 2026 is not documented. The damage volume is shown as the damage estimated per incident in the incident register in EUR; the basis of the estimate and the cut-off date belong in the same row.

KPI 3: open actions and deadlines

This KPI brings together open items from audits, data protection impact assessments and risk assessment and tracks them in the stages Open / In progress / Completed with a delay alert — the stage model and the alert logic are practice recommendations; the alert is only as good as the deadlines stored behind it. Practice recommendation for the delay alert: triggering as soon as the stored due date is exceeded, with an advance warning 5 working days beforehand where statutory deadlines are running — for the one-month period under Art. 12(3) GDPR, the advance warning coincides with the decision on the two-month extension.

The response, feedback and registration deadlines with their legal basis — Art. 12(3) GDPR, § 17 HinSchG or § 9(1) and § 13(9) HSchG, § 33 BSIG or § 29 NISG 2026 — are set out in full with trigger and reference in the table 'Statutory deadlines'; each entry in the tracker should carry the provision named there as a field. Only the AGG deadline is kept in the running text: claims under § 15(1) or (2) AGG must be asserted in writing within two months, unless the parties to a collective agreement have agreed otherwise (§ 15(4) AGG — Germany; in Austria, different deadlines apply under § 15 and § 29 GlBG, including six months from refusal where an employment relationship is not established).

In addition there are the evidence dates: in Germany, operators of critical installations demonstrate implementation at a point in time determined by the Federal Office for Information Security (BSI) and thereafter every three years by means of audits, examinations or certifications (§ 39(1) BSIG); in Austria, all essential and important entities must submit a self-declaration within twelve months of the registration duty arising and, upon request, provide evidence by an independent body within two years, while essential entities must complete operational and organisational implementation within two months of being requested to do so (§ 33(1), (2) NISG 2026). Under § 33(1) BSIG, registration must take place no later than three months after the entity status arises; the BSI points out that the statutory registration deadline has already expired. No official date for the start of supervisory and fining practice is available.

KPI 4: training status

What is reported is the percentage of employees with current training in GDPR, AI literacy and cybersecurity; target value >95% — the target value is a practice recommendation. What is legally required is training at management level (§ 38(3) BSIG; AT: § 31(2) NISG 2026, which additionally requires training to be offered to employees), measures to support the AI literacy of staff under Art. 4 AI Act (implemented as AI literacy training — practice recommendation) and — as an item of the minimum catalogue 'cyber hygiene and training' — the cybersecurity track (§ 30(2) BSIG or § 32(4) NISG 2026); the GDPR track is carried along as a practice recommendation. A fourth track, code of conduct, is carried along in practice; it rests on none of the training duties named here and is therefore reported separately so that the mandatory coverage is not diluted.

At management level, training is expressly required: the management bodies of particularly important entities and important entities must take part in training on a regular basis (§ 38(3) BSIG); in Austria, management bodies must take part in specifically designed cybersecurity training, and entities must regularly offer corresponding training to their employees (§ 31(2) NISG 2026). The German act says 'regularly'; a specific cycle of once or twice a year is a practice rhythm, not a statutory deadline. Under the AGG, suitable training of employees counts as fulfilment of the employer's duty to take the necessary and preventive measures to protect against discrimination (§ 12(1) to (3) AGG) — which makes the training rate a metric close to liability. For AI competence, Art. 4 AI Act is the basis: providers and deployers take measures to support the development of AI literacy of their staff; no specific level of AI literacy is owed. Art. 4 has applied since 2 February 2025, paragraph 1 since 27 July 2026 in the version of Regulation (EU) 2026/1744.

Practice recommendation for the presentation: report coverage separately by circle of obligations (management level, employees overall, roles with data access) and file the evidence per person with a date — the training record of the management body serves, in the event of a dispute, as evidence of participation under § 38(3) BSIG or § 31(2) NISG 2026.

KPI 5: audit readiness

This KPI measures how current the record of processing activities is, how complete the data processing agreements are, the status of data protection impact assessments and the documentation gaps. The metric is the share of the four checkpoints with the status 'complete and current' in percent, collected in a window of less than 30 days before the appointment; target value 100% — metric, collection window and target value are practice recommendations. Open audit findings themselves run in KPI 3 (open actions and deadlines); KPI 5 measures the evidence position before the appointment.

The four checkpoints hang on specific duties. The record of processing activities follows Art. 30 GDPR; updating it annually and upon changes is the established practice rhythm. Data processing agreements must reflect the minimum content of Art. 28(3) GDPR — subject matter, duration, nature and purpose of the processing, type of data, categories of data subjects as well as the obligations and rights of the controller — and only processors offering sufficient guarantees for appropriate technical and organisational measures may be used (Art. 28(1) GDPR). A data protection impact assessment must be carried out in advance where processing is likely to result in a high risk, in particular in the case of a systematic and extensive evaluation of personal aspects producing legal effects, extensive processing of special categories of data under Art. 9, or systematic monitoring of publicly accessible areas on a large scale (Art. 35(1), (3) GDPR). For documentation gaps, the following applies in Germany: compliance with the risk management measures must be documented (§ 30(1) BSIG). Practice recommendation for the counting method: a documentation gap is any category of measures in the minimum catalogue under § 30(2) nos. 1 to 10 BSIG or § 32(4)(a) to (j) NISG 2026 for which no dated evidence (concept, minutes, test report) exists. Metric: categories with evidence out of ten — the same system as in the register of obligations under KPI 1, so that both metrics run from a single source.

Who carries out the review differs by set of rules and by country: for data protection, in Germany the state data protection authorities or the BfDI, in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (details in the DE/AT note above); for cybersecurity, in Germany the BSI as the central body for information security (§ 1 BSIG), in Austria the Federal Office for Cybersecurity as the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (§ 3a(1), (2) NISG 2026). For the AI Act, each Member State designates at least one market surveillance authority, one of them as the single point of contact (Art. 70(1), (2) AI Act): in Germany this has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), insofar as sectoral authorities — such as BaFin — are not competent; as at the status date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act, and the AI service centre at RTR is an information and advisory body without supervisory powers.

Dashboard design: data sources per KPI

The dashboard needs exactly one leading data source per KPI — otherwise the report and the evidence diverge. The following allocation is a practice recommendation; the column 'Anchor obligation' names in each case one reference from which the underlying duty itself follows.

Practice recommendation for operation: one view for the management body with the five metrics and the traffic light, and a second detailed view with the individual obligation and reference for the specialist level. Metrics without a named source do not belong on the board — in the event of a supervisory enquiry, the source is what counts.

Structure of the quarterly report

The template comprises five chapters: 1) a one-page executive summary, 2) the KPI dashboard, 3) top risks and actions, 4) communication with supervisory authorities, 5) recommendations — the structure and the typical overall length of 8–12 pages are empirical values, not a requirement.

Chapter 1 answers in five sentences what has changed compared with the previous quarter and which decision the management body is expected to take. Practice recommendation for the interlocking: every failure to meet a target value in KPI 1, 4 and 5 generates exactly one entry in the action tracker of KPI 3 with an owner and a target date. Chapter 1 shows only those shortfalls on which the management body itself has to decide — budget, staff or the deliberate postponement of an internal target date; everything else stays in chapter 5. Chapter 2 shows the five KPIs with a comparison to the previous quarter. Chapter 3 carries the risk heat map: top risks per set of rules, assessed by likelihood of occurrence and fine framework — the allocation to the provision belongs here, because priority and level of sanction differ (for example § 65(5) no. 1 BSIG compared with Art. 83(5) GDPR). Practice recommendation for the scope: no more than ten risks, axis 1 the estimated likelihood of occurrence in five stages, axis 2 the fine framework of the applicable provision — Art. 99(3) AI Act, Art. 83(5) GDPR, § 65(5) no. 1 BSIG or § 45(1) to (3) NISG 2026, and for SMEs under the AI Act the lower of the two amounts under Art. 99(6). As with the score in KPI 1: keep the scale and the allocation constant across quarters.

Chapter 4 documents every contact with a supervisory authority by date, occasion and deadline; depending on country and set of rules, different bodies are competent — for whistleblower protection, for example, the federal external reporting channel at the Federal Office of Justice (BfJ) (§ 19(1), (4) HinSchG) or, in Austria, the Federal Bureau of Anti-Corruption (BAK) (§ 15(1) HSchG). Chapter 5 carries the roadmap: open actions with owner, target date and budget requirement. Practice recommendation for the addressee version: the executive board and the managing directors receive the full template; for a supervisory board or advisory board, an extract from chapters 1, 2 and 3 (executive summary, KPI dashboard, top risks) on an annual cycle is sufficient, without the individual actions from chapter 5. Cadence and scope are practice recommendations; the statutory connecting factor is set out in the governance table above.

For scheduling in 2026/2027 the following applies: with Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, the high-risk obligations of Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028; the general date of application of the AI Act on 2 August 2026 (including Art. 50) remains. As at the update status of this article, 2 August 2026 already lies in the past; the dates should be checked against the consolidated version of Art. 113 AI Act before each reporting cycle. Firmly scheduled are the date of application of NISG 2026 on 1 October 2026 and the first pay gap reports by 7 June 2027 (from 250 employees annually thereafter, Art. 9(2) of Directive (EU) 2023/970; 150 to 249 employees every three years thereafter, Art. 9(3)) — the decisive factor in each case is the national implementing law.

Reporting cadences: statutory deadlines and practice rhythms kept apart

What is tied to a specific deadline are the reporting, response and registration duties; the reporting cycle, the training interval and the review cycles are set by the company itself — § 38(3) BSIG names 'regularly' as the benchmark for training of management bodies in Germany. The first table therefore contains only deadlines with a reference, the second only practice rhythms together with the duty they serve.

Practice recommendation for the half-yearly re-evaluation: check whether the classification under § 28(1), (2) BSIG or § 24 and § 25(2), (3) NISG 2026 has changed through headcount, turnover or balance sheet total, whether obligations have to be newly added to the register of obligations under KPI 1 (for example after the date of application of NISG 2026), and whether the incidents of the past six months justify an additional metric. The result is either 'KPI set unchanged' or a documented change together with a cut-off date.

Statutory deadlines — each row names the trigger and the deadline under the provision stated in each case; the Austrian NISG 2026 references apply from its date of application on 1 October 2026:

Practice rhythms — none of these rows is a statutory deadline; in each case the duty served by the rhythm is named:

The two rows marked (DE) reflect German law; in Austria, GlBG and HSchG take the place of AGG and HinSchG.

Austria: same report, different references

For Austrian companies, the KPI scope, the dashboard and the quarterly cycle remain identical — what is exchanged are the legal bases and the addressees of the communication. NISG 2026 takes the place of BSIG throughout; the references per duty are set out in the tables above. The addressee of incident reports there is the competent CSIRT (§ 34), and the supervisory and registration authority is the Federal Office for Cybersecurity (§ 3a, § 29).

For the liability chapter, the distinction from the governance table applies: in Austria, liability follows general company law (§ 25 Austrian GmbHG, § 84 Austrian AktG). In return, the Cybersecurity Authority may temporarily prohibit the management bodies of an essential entity from exercising management functions by official notice, with entry in the commercial register (§ 39(4) no. 2 NISG 2026); administrative penalties are imposed by the district administrative authorities, and a penalty against the responsible person under § 9 VStG is waived only where the legal person has already been penalised for the same infringement (§ 44(5) NISG 2026). For whistleblower protection, HSchG takes the place of HinSchG (internal channel from 50 employees under § 11), and for the equal treatment part, GlBG applies with the Ombud for Equal Treatment (GAW) and the Equal Treatment Commission (Gleichbehandlungskommission). Pure EU law — the GDPR and the AI Act — applies identically in both countries; the national supplements (BDSG and DSG respectively, such as the designation threshold for the data protection officer) differ.