Compliance Tool Stack 2026 for SMEs

The tool and price information on third-party providers (numbers 1 to 4, 6, 7 and 9 as well as the FAQ) is provider information from the first version as at 2 May 2026 and was not re-surveyed for this revision; unsubstantiated market and effectiveness claims from the first version have been removed. What has been added is the legal basis behind the tools, the differences between Germany and Austria, and practitioner recommendations of the editorial team, marked as such. Numbers 5, 8 and 10 are our own products; numbers 1 to 4, 6, 7 and 9 are third-party providers. For our own items this article names no alternatives — the underlying requirements (inventory fields, document base, training records) can also be met with other tools.

Which obligation does which tool cover?

Short answer: tools mainly cover documentation, reporting and evidence work — the obligation itself arises from the provision, not from the product. The overview below assigns to each number in this article the obligation it contributes to. Column 2 names the provision from which the obligation follows, separated into Germany and Austria where national law differs — as far as this article cites a source for both countries; where it does not, the row says so. Column 3 is the editorial team's practitioner assessment and not a legal consequence.

One caveat on the table: the NIS2 rows only apply once your company qualifies as a particularly important or important entity (Germany) or as an essential or important entity (Austria) — thresholds see 'Does NIS2 apply to your company at all?'.

1. GDPR: Pirsch Analytics (cookieless)

EUR 30 per month, servers in Germany. The provider states that no cookie banner is required — you must have this statement substantiated (see below).

Why this is the first building block: in Germany, storing information in the terminal equipment of an end user, or accessing information already stored there, is only permitted with prior, informed consent measured against the GDPR standard. It is possible without consent where the sole purpose is to carry out the transmission of a message, or where access is strictly necessary for a service expressly requested by the user (§ 25(1) and (2) of the German Telecommunications-Digital-Services Data Protection Act (TDDDG)).

What to do: the vendor statement 'no banner required' is a provider assertion. What matters is whether the tool accesses the terminal equipment within the meaning of § 25(1) TDDDG; have the provider confirm this in writing and file the confirmation with your documentation. Independently of that, you need a legal basis under Art. 6(1) GDPR, a data processing agreement with the minimum content from Art. 28(3) GDPR and an entry in the record of processing activities (Art. 30 GDPR).

2. GDPR: Userlike (instead of a US live-chat provider)

The provider states EU hosting and an available data processing agreement. Alternative to LiveChat, Intercom (US).

Why the contract counts, not the server location alone: a controller having data processed on its behalf may only work with processors providing sufficient guarantees; the cooperation requires a contract setting out the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects as well as rights and obligations (Art. 28(1) and (3) GDPR).

Three points regularly overlooked in chat: first, chat logs can contain health data or other special categories — processing such data is prohibited in principle and only permitted via the exceptions in Art. 9(2) GDPR. Second, requests for access to chat histories are subject to the deadline in Art. 12(3) GDPR: without undue delay, at the latest within one month, extendable by two months in complex cases. Third, providers must ensure that an AI system intended to interact directly with natural persons informs the person that they are interacting with an AI system (Art. 50(1) AI Act).

3. NIS2: Microsoft Defender for Endpoint

EDR, integrated in M365 E3/E5. Threat protection, vulnerability management, auto-investigation.

Why an EDR is only one part: in Germany, particularly important entities and important entities must take appropriate, proportionate and effective technical and organisational measures and document compliance with them (§ 30(1) and (2) of the German BSI Act (BSIG)). In Austria, essential entities and important entities must implement appropriate and proportionate risk-management measures in technical, operational and organisational terms (§ 32(1) and (4) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026)) — the NISG 2026 applies from 1 October 2026. In both countries the minimum catalogue covers ten areas, from risk analysis to multi-factor authentication (§ 30(2) BSIG, § 32(4) NISG 2026; full list in the FAQ).

Practitioner assessment: an EDR product mainly contributes to incident detection and vulnerability management. Supply chain security, crisis management and assessing effectiveness remain organisational work. Practitioner recommendation: maintain a mapping list assigning a measure and a responsible person to each of the ten catalogue items — the documentation duty under § 30(1) BSIG requires documentation of compliance in any case.

4. NIS2: Veeam Backup & Replication

3-2-1 backup with a hardened repository, that is, immutable backup storage. Ransomware protection.

Why backup is in the catalogue of obligations: business continuity, backup management and crisis management are part of the minimum catalogue of risk-management measures (§ 30(2) BSIG, § 32(4) NISG 2026) — immutable backup storage contributes to exactly this catalogue item, because it cannot be overwritten in the event of an attack. For classified entities, the reporting chain is added: in the case of a significant security incident, an early initial notification must be submitted without undue delay and at the latest within 24 hours, a notification with an initial assessment within 72 hours, and a final report at the latest one month after that notification; if the incident is ongoing, a progress report takes its place for the time being (§ 32(1) BSIG; in Austria § 34(2) NISG 2026 to the competent CSIRT).

An incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss (in Austria: severe financial loss), or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG, § 35(1) NISG 2026). Practitioner recommendation: test restoration in such a way that you can quantify the impact within 72 hours.

5. EU AI Act: AI inventory in the Compliance-Kit

Excel template with 12 columns (a kit field list as a practitioner recommendation, not a statutory requirement) + 12 SME examples. Included in the EU AI Act Kit.

Why the inventory comes first: the AI Act grades obligations by risk, and in practice the classification can only be made on the basis of a complete list of the systems in use. Prohibited practices include social scoring and emotion recognition in the workplace (Art. 5(1)). The systems listed in Annex III are deemed high-risk, among them employment and personnel management (Art. 6(2)). For AI systems with a particular risk of deception, marking and disclosure obligations apply (Art. 50).

Which fields such an inventory should keep as a minimum per system follows exactly these provisions — a practitioner recommendation of the editorial team, nine fields: name and provider, your own role (provider or deployer), purpose and area of use, outcome of the check for prohibited practices (Art. 5(1)), allocation to Annex III (Art. 6(2)), marking or disclosure requirement (Art. 50), affected groups of persons, responsible person and the date of the last assessment. The 12 columns of the Excel template are a kit field list, not a statutory requirement; which fields your inventory needs as a minimum is set out in the list above.

The dates have arrived: the prohibitions under Art. 5 have applied since 2 February 2025, the obligations for providers of general-purpose AI models since 2 August 2025 (for legacy models placed on the market before that date a transition period runs until 2 August 2027), and the Regulation in all other respects since 2 August 2026. Under Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, the high-risk obligations of Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 and to Annex I systems — that is, Art. 6(1) and the corresponding obligations — from 2 August 2028 (Art. 113).

6. HinSchG: EQS Integrity Line

From EUR 990 per year. Anonymous return channel. The provider states audit capability and GDPR conformity.

From when you need such a system at all: employers with as a rule at least 50 employees must establish and operate at least one internal reporting office (§ 12(1) and (2) of the German Whistleblower Protection Act (HinSchG)); in Austria the obligation applies to companies with 50 or more employees (§ 3(1), § 11(1) of the Austrian Whistleblower Protection Act (HSchG)).

What the system must deliver: acknowledgement of receipt within seven days, feedback on follow-up measures within three months (§ 17(1) no. 1 and (2) HinSchG) — details and the differing Austrian starting points for the deadlines are in the FAQ. Added to that is confidentiality of the identity of reporting persons and persons concerned (§ 8(1) HinSchG, § 7 HSchG). Anyone who does not establish and operate an internal reporting office risks a fine of up to EUR 20,000 in Germany (§ 40(2) to (6) HinSchG). In Austria, § 24 HSchG penalises other infringements — obstructing or putting pressure on reporting persons, retaliation, breach of confidentiality and knowingly false reports — with a fine of up to EUR 20,000, and up to EUR 40,000 in the event of a repeat offence.

7. AGG: applicant tracking system with anonymised initial screening

Personio, HR Works, Workday — the providers each state that they offer an anonymisation mode. The aim is a documented initial screening free of protected characteristics.

Why the initial screening is the critical point: in Germany, employees may not be disadvantaged on a protected ground, and a job may not be advertised in breach of that prohibition (§ 7(1), § 11 of the German General Equal Treatment Act (AGG)). Where a rejected person proves indicia suggesting a disadvantage, the employer bears the burden of proving that there was no infringement (§ 22 AGG) — documented, traceable selection steps are therefore the real benefit of the tool. Claims must be asserted in writing within two months of receipt of the rejection, unless the parties to the collective agreement have agreed otherwise (§ 15(4) AGG).

In Austria, a job may not be advertised for men only or for women only, unless one sex is an indispensable requirement for the activity; infringements carry a fine of up to EUR 360 (§§ 9, 10 of the Austrian Equal Treatment Act (GlBG)). As regards the standard of proof, it is sufficient for the person concerned to establish prima facie evidence; the defendant must then prove that, weighing up all the circumstances, another motive was more probable or that a justification exists (§ 12(12), § 26(12) GlBG). Important: where AI-assisted pre-selection contributes to the decision, the system may fall within the Annex III area of employment and personnel management and thus be deemed high-risk (Art. 6(2) AI Act); under Regulation (EU) 2026/1744, the high-risk obligations of Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027.

8. Cross-compliance: Compliance-Kit (all 5 areas)

from EUR 990 net per kit (German or Austrian edition); 12 months of legal-status updates included. 5 kits cover GDPR + NIS2 + AI Act + HinSchG + AGG.

Why a shared foundation pays off: a single incident can trigger two reporting chains at the same time. If personal data is breached in a ransomware attack, the notification to the data protection supervisory authority runs without undue delay and where feasible within 72 hours (Art. 33(1) GDPR), and in parallel the 24 hours / 72 hours / one month chain runs to the joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK) (§ 32(1) BSIG) or to the competent CSIRT in Austria (§ 34(2) NISG 2026). Both notifications draw on the same factual data.

The same applies to training, which appears in three regimes (Art. 4 AI Act, § 38(3) BSIG and § 31(2) NISG 2026 respectively, § 12(2) AGG), and to registration under § 33 BSIG and § 29 NISG 2026 respectively, which in the editorial team's practitioner assessment builds on the same company master data as the rest of your data protection documentation. Practitioner recommendation: one document base, five views — not five separate filing systems.

9. DPO software: PRIVA data protection cockpit

Record of processing activities, processor inventory, DPIA, document management. From EUR 49 per month.

When you actually have to designate a data protection officer: under Art. 37(1) GDPR for public authorities, for core activities involving regular and systematic monitoring on a large scale, or large-scale processing of special categories of data. In Germany there is an addition: at least 20 persons who, as a rule, are constantly engaged in automated processing — and, irrespective of that number, for processing operations subject to a data protection impact assessment as well as for commercial transfer or for market and opinion research (§ 38(1) of the German Federal Data Protection Act (BDSG)). Austria provides for no numerical designation threshold going beyond Art. 37 GDPR (§ 5 of the Austrian Data Protection Act (DSG)).

What the software maps: processing on behalf of a controller under Art. 28 GDPR, the data protection impact assessment where the processing is likely to result in a high risk — in particular for profiling with legal effect, large-scale processing of special categories of data or systematic large-scale monitoring of publicly accessible areas (Art. 35(1) and (3) GDPR) — as well as deadline monitoring for data subject requests under Art. 12(3) GDPR. No tool takes the decision on whether a DPIA is required off your hands.

10. Training: Compliance-Kit e-learning courses

5 e-learning courses (GDPR, NIS2, AI Act, HinSchG, AGG) in DE and EN, with quizzes and progress tracking.

Why training is its own building block in the stack: in the AGG it is expressly provided for as a route to fulfilment — the employer must take preventive measures to protect against disadvantage, and suitable training of employees is deemed fulfilment of that duty (§ 12(1) and (2) AGG). Under the NIS2 regime, the managements of particularly important entities and important entities must attend training regularly (§ 38(3) BSIG); in Austria, the management bodies must attend specifically designed cybersecurity training, and the entities must regularly offer corresponding training to their employees (§ 31(2) NISG 2026).

Added to that is AI literacy under Art. 4 AI Act, which was already due on 2 February 2025. As for the intervals: they are practitioner recommendations — the specific cycles are set out below under 'Sequence, costs and practitioner rhythms'.

Does NIS2 apply to your company at all?

Short answer: NIS2 tools only become mandatory once your company belongs to a type of entity from the sector annexes — the employee and turnover thresholds alone are not sufficient. In Germany, another company qualifies as a particularly important entity if it belongs to a type specified in Annex 1 and employs at least 250 employees, or has an annual turnover of more than EUR 50 million and in addition an annual balance sheet total of more than EUR 43 million. Entities of a type specified in Annex 1 or Annex 2 with at least 50 employees, or with an annual turnover and an annual balance sheet total of more than EUR 10 million each, qualify as important entities (§ 28(1) and (2) BSIG). Irrespective of the employee and turnover thresholds, § 28(1) BSIG also covers operators of critical installations; covered regardless of size are qualified trust service providers, top-level domain name registries and DNS service providers.

In Austria, the NISG 2026 works with the same size classes (§ 25(2) and (3)) and assigns the classification as an essential entity or important entity under § 24(1) and (2); covered regardless of size there are, among others, qualified trust service providers, TLD name registries and DNS service providers. In both countries, Annex 1 covers the highly critical sectors and Annex 2 the other critical sectors.

Registration follows the classification: in Germany at the latest three months after an entity first qualifies as a particularly important entity or important entity, with subsequent notification of changes within two weeks (§ 33(1) and (5) BSIG). The BSI points out that the statutory registration deadline has already expired; there is no official date for the start of supervisory and fining practice. Anyone who has missed the registration should catch up without undue delay. In Austria a three-month deadline also applies; it runs from the entry into force of the NISG 2026 or from the point at which the conditions are met (§ 29(2) to (4) NISG 2026). The NISG 2026 applies from 1 October 2026.

Germany and Austria: same stack, different sources

Short answer: the tools stay the same, the legal bases and authorities do not. Pure EU law — GDPR and the AI Act — applies identically in both countries; everything transposed nationally differs.

• NIS2: NISG 2026 instead of BSIG — registration § 29, risk-management measures § 32, notification to the competent CSIRT § 34. The competent body is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria), and in Germany the BSI. The NISG 2026 applies from 1 October 2026.
• Evidence of implementation: in Germany the regular obligation to provide evidence through audits, examinations or certifications every three years applies to operators of critical installations (§ 39(1) BSIG). In Austria, all essential entities and important entities submit a structured self-declaration within twelve months of the registration obligation arising and, upon request, demonstrate implementation within two years through an independent body — essential entities must demonstrate operational and organisational implementation within two months of the request (§ 33(1) and (2) NISG 2026).
• Whistleblower protection: HSchG instead of HinSchG. The material scope is narrower than in Germany: Austria essentially covers the EU areas plus the corruption offences under §§ 302 to 309 of the Austrian Criminal Code (StGB) (§ 3(3) HSchG), whereas Germany covers all infringements subject to criminal penalties (§ 2(1) HinSchG). The external reporting office in Germany is the office at the Federal Office of Justice (BfJ) (§ 19 HinSchG), and in Austria the Federal Bureau of Anti-Corruption (BAK) (§ 15(1) HSchG).
• Equal treatment: GlBG instead of AGG; advice and support from the Ombud for Equal Treatment (GAW) instead of from the Federal Anti-Discrimination Agency (Antidiskriminierungsstelle des Bundes). The deadlines differ considerably: two months in writing in Germany (§ 15(4) AGG), and in Austria six months for bringing court proceedings where an employment relationship was not established, and 14 days for challenging a dismissal (§ 15 GlBG).
• Data protection supervision: in Germany the authorities competent under Land law for non-public bodies (§ 40(1) BDSG), and in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG).

Sequence, costs and practitioner rhythms

Short answer: start with GDPR tools and training, then the NIS2 tooling follows, and the AI Act tool last; the costs depend on headcount, NIS2 classification and choice of tools (calculation method in the next paragraph), and the repetition cycles in the table below are practitioner recommendations, not statutory deadlines. This sequence comes from the first version and still holds: the GDPR obligations apply to every company processing personal data, the NIS2 obligations only to classified entities, and for the AI inventory you first need a reliable stocktaking from day-to-day operations. This sequence concerns tool procurement, not when the obligations apply: Art. 4 and Art. 5 AI Act have been applicable since 2 February 2025, and the Regulation in all other respects as a general rule since 2 August 2026 (different dates for individual chapters under no. 5). Practitioner recommendation: start the stocktaking of the AI systems in use in parallel from day 1; only the procurement of a dedicated inventory tool comes later. Anyone already classified as a NIS2 entity should bring registration forward — the statutory three-month deadline is set out above under 'Does NIS2 apply to your company at all?'.

On the cost framework: as an SME recommendation, the first version names the combined stack of GDPR tool, GRC light and training LMS, and as an alternative open source (Eramba, OpenKM, DocuWare). In this recommendation, 'GRC light' means the evidence and documentation layer — covered here by no. 8 (kit foundation) and no. 9 (record of processing activities, data processing agreements, DPIA); this article does not deal with a dedicated GRC product — see the linked article 'GRC tooling comparison 2026' on that. Which position in the stack the named alternatives replace in each case, and whether the saving outweighs the in-house effort, has not been re-examined in this revision. Calculation method for your own budget: one-off, the kits you need (from EUR 990 net per kit, no. 8) and the e-learning courses (no. 10), plus the sum of the ongoing licences of the tools chosen (provider information from the first version under numbers 1, 6 and 9) and — where a data protection officer has to be designated and the role is filled externally — their fee, which depends on size, sector and scope of support and is to be clarified by obtaining quotes.

The following intervals are practitioner recommendations of the editorial team and not statutory deadlines. The column 'Reference' names the provision the respective activity contributes to; the interval beside it is the editorial team's practitioner assessment. A dash means that this article assigns no provision to the activity.

What the tools do not take off your hands

Short answer: all assessment decisions — and the responsibility of the management. Whether a personal data breach is notifiable depends on whether it is likely to result in a risk to the rights and freedoms of natural persons (Art. 33(1) GDPR); whether a data protection impact assessment is necessary is decided by the risk forecast under Art. 35(1) GDPR; whether an AI system is high-risk follows from Art. 6 AI Act (on the exception in Art. 6(3) AI Act, see the details in the FAQ).

Added to that is the governance level: the managements of particularly important entities and important entities must implement the risk-management measures and supervise their implementation; if they breach that duty, they are liable to their entity for culpably caused damage under the rules of the company law applicable to the legal form (§ 38(1) and (2) BSIG). In Austria, the management bodies of essential entities and important entities must ensure and supervise compliance (§ 31(1) NISG 2026). A tool can document this task, not take it over.