Which Compliance Kit do I need?

How the recommendation works

The test asks 8 questions. Questions 1 to 6 determine which of the five kits come into question for you: company size, handling of personal data, sector, use of AI, recruiting and a possible special position under NIS2. Question 7 selects the package per kit: Basic, Plus with training pack or Complete with e-learning. Question 8 adds a timeline based on your time frame: under acute pressure with a clear starting point, for three or six months as a monthly plan, for preventive work with the next key dates.

The order of the kits depends on how clearly the obligations apply on the basis of your answers. Using the Germany or Austria switch, you choose the jurisdiction for which the result cites the legal references. The evaluation runs entirely in your browser; answers are neither transmitted nor stored.

The five kits at a glance

GDPR Compliance Kit

For companies that process personal data, which in practice means every company with employees. The core obligations are the record of processing activities (Art. 30 GDPR), security of processing (Art. 32) and data subject rights with a response deadline of one month (Art. 12(3)); depending on the processing, the data protection impact assessment (Art. 35) and data processing agreements (Art. 28) are added. To the GDPR kit · GDPR guide

NIS2 Compliance Kit

For entities in the sectors listed in Annexes 1 and 2 BSIG with at least 50 employees or with an annual turnover and an annual balance sheet total each exceeding €10 million (§ 28(2) BSIG), and also for operators of critical facilities and for entities covered regardless of size, such as DNS service providers (§ 28(1) and (2)). In Austria the thresholds of § 25 NISG 2026 apply; the Act has applied since 1 October 2026. To the NIS2 kit · NIS2 guide

EU AI Act Governance Kit

For companies that develop or use AI systems. Since 2 February 2025, Art. 4 AI Act has applied, with the obligation to take measures for the AI literacy of staff (amended since 27 July 2026); since 2 August 2026, the transparency obligations under Art. 50 have applied. Under Regulation (EU) 2026/1744, the high-risk obligations follow from 2 December 2027 for systems under Annex III and from 2 August 2028 for systems under Annex I. To the EU AI Act kit · EU AI Act guide

Whistleblower Protection Kit (HinSchG)

For employers with, as a rule, at least 50 employees (§ 12(1) and (2) HinSchG) and, regardless of size, for institutions in the financial, crypto and payment sector (§ 12(3)). In Austria, the obligation to set up an internal whistleblowing system applies from 50 employees and, regardless of size, in the areas of § 3(2) HSchG (§ 11(1) HSchG). To the HinSchG kit · Whistleblower guide

Anti-Discrimination & Pay Transparency Kit (AGG)

For employers who recruit staff: job advertisements without discrimination (§ 11 AGG), burden of proof where there is circumstantial evidence (§ 22) and protective duties that suitable training fulfils (§ 12(2)). The Pay Transparency Directive (EU) 2023/970 had to be transposed by 7 June 2026; a German transposition act did not exist as at 17 August 2026 (BT-Drs. 21/7026). In Austria, too, no transposition act existed as at that date. There the GlBG applies, including the income report for employers with permanently more than 150 employees (§ 11a GlBG). To the AGG kit · AGG guide

Which training is mandatory

Only two of the five sets of rules contain an explicit training obligation. Art. 4 AI Act requires measures to support the AI literacy of staff; since the amendment of 27 July 2026, no specific level of literacy is owed. § 38(3) BSIG obliges the management of especially important and important entities to attend training regularly. In Austria, § 31 NISG 2026 requires training for management bodies and a regular training offer for employees.

Under the AGG, suitable training of employees counts as fulfilment of the employer's protective duties (§ 12(2) AGG). The GDPR and the HinSchG do not prescribe general training for all employees; under the GDPR, awareness-raising can be part of the organisational measures. That is why question 7 does not ask about an obligation, but whether you want to cover training with documentation.

Packages and prices

Every kit comes in three packages: Basic for €990 net (the documentation), Plus for €1,390 net (additionally the training pack with training materials, knowledge test and certificate of participation template; contents per kit on the kit page) and Complete for €1,690 net (additionally the e-learning as an HTML file and as SCORM 1.2/2004 for your own LMS, company licence for up to 25 users, larger companies on request). Within the kits, the e-learning is included only in the Complete package. All prices are net and one-time. Every package includes 12 months of legal-status updates and a company licence, personalised with company name, logo and licence ID, in the version for Germany or Austria.

The kits are bought individually. A bundle exists only for the e-learnings on all five topics (from €2,190 net), not for the kits. The e-learning on its own costs from €490 net for up to 25 users, for larger companies tiered by company size on request. The offer is aimed exclusively at businesses. You buy online with payment by card, SEPA direct debit or bank transfer and receive an invoice with VAT ID; you receive the download link within 48 hours of receipt of payment (working days). Questions or a custom quote? Contact form · All kits · All e-learnings · All prices

Germany and Austria

Limits of the recommendation

The test is guidance and not legal advice. It deliberately simplifies: for NIS2, the specific type of entity in the annexes to the BSIG or the NISG 2026 is decisive, size is determined under Recommendation 2003/361/EC, and special rules apply to individual sectors. Whether an AI system is high-risk follows from Art. 6 AI Act in conjunction with Annex I (products) and Annex III (areas of use). Clarify borderline cases with the individual tools or with a legal review.

Continue to the NIS2 Readiness Check, the EU AI Act Quick Test, the Job Posting Audit or the overview Compliance deadlines 2026, 2027, 2028. You will find all tools under Compliance tools.