Why Compliance-Kit?
For their compliance documentation, SMBs in Germany and Austria essentially have four models to choose from. We compare them honestly and explain when each model makes sense.
The four compliance models for SMBs in Germany and Austria
Whether data protection, NIS2, the AI Act, whistleblower protection or equal treatment: in the end every company concerned needs policies, records, processes and evidence. How it gets there is what distinguishes the four models. None of them is right for everyone.
1. Premium SaaS subscriptions
Web-based compliance platforms with workflow management, ongoing monitoring and dashboards. You pay a recurring fee for as long as you use the platform, usually monthly or annually, depending on the provider. Your data and processes sit in the provider's platform.
Makes sense when: a dedicated compliance department works continuously with live reports, or an international structure with several companies has to be managed. Which platforms exist and how they differ is shown in the GRC Tooling Comparison 2026.
2. Consultancies and law firms
Classic compliance consulting: a law firm or consultancy records the current state and prepares the documentation for you. You pay a fee per engagement. In return you get an assessment of your individual case and, with a law firm, also the legal review that no template package can provide.
Makes sense when: a fining procedure is ongoing, a highly complex special case exists, or an international group structure has to be put in order. The budget SMBs should realistically expect is set out in the calculation Compliance Budget SME 2026.
3. Free templates
Template texts and checklists that chambers, industry associations and authorities make freely available. They cost nothing but are mostly generic: adapting them to your company and keeping track of legislative changes remain your task.
Makes sense when: the company is very small, works in a non-regulated sector and processes no sensitive data. A selection of useful free starter aids is listed in GDPR 2026: 8 Free Starter Tools for SMEs.
4. The professional template model (our model)
Complete template packages per regulation, in an edition for Germany or for Austria: editable Word, Excel and PowerPoint files, delivered unpopulated with placeholders and selection fields, with legal references and a guide for filling them in. Three packages per kit from €990 net, one-time, with 12 months of legal-status updates. No subscription, the files stay with you.
Makes sense when: you are an SMB without a dedicated compliance department and need standardised documentation that you fill in and maintain yourself. All five kits are listed in the kit overview.
The four models in direct comparison
The table compares the models qualitatively. We deliberately do not state third-party prices, because they vary widely depending on provider, scope and contract.
| Criterion | SaaS subscription | Consultancy | Free templates | Compliance-Kit |
|---|---|---|---|---|
| Cost model | Recurring fee for as long as you use it (monthly or annually, depending on the provider) | Fee per engagement | Free of charge, but your own adaptation effort | One-time: Basic €990, Plus €1,390, Complete €1,690 net |
| Where are the documents kept? | In the provider's platform | With you, after handover | With you | With you, as Word, Excel and PowerPoint files |
| Dependence on the provider | Export and continued use after cancellation depend on provider and contract | Low for the documents handed over | None | None: delivered files are not locked and do not expire |
| Updates on legislative changes | In the subscription, depending on the contract | New engagement required | Your own effort | 12 months included, then optional follow-up updates on preferential terms |
| Review of your individual case | As a rule, no | Yes (legal: law firm) | No | No, no legal advice |
| Edition for Germany or Austria | Depends on the provider | Depends on the law firm | Depends on the publisher | A separate edition per country, no mix |
| Start | After the platform has been set up | After the initial assessment | Available immediately | Online purchase; download link within 48 hours of receipt of payment (working days) |
How kit and subscription differ over three years is shown schematically by the time-lapse on the Pricing page; the comparison table of kit, subscription software and law firm is also there. What the Basic, Plus and Complete packages contain for each kit is set out on the kit pages in the kit overview.
Four points that set our model apart
- Edition for Germany or for Austria. You receive the edition for your country, with the provisions that apply there. German and Austrian rules are not mixed in one document.
- Legal references from official full texts. Behind the templates stand 301 official source documents: regulations, acts and publications of the supervisory authorities. The sources the kits are based on are listed on the About page.
- Company licence, personalised. Every kit is delivered with your company name, your logo and a licence ID. The kits are aimed exclusively at businesses (B2B).
- No legal advice. We supply structured templates and a guide. Responsibility for correct implementation remains with you. Anyone who wants their individual case reviewed needs a law firm.
Packages and figures
Every kit comes in three packages. Basic (€990 net) contains the documentation. Plus (€1,390 net) adds the training pack for internal training, including a slide deck, a knowledge test and a certificate of participation template. Complete (€1,690 net) additionally includes the e-learning as an HTML file and as SCORM 1.2/2004 for your own LMS (company licence, up to 25 users, larger companies on request); the e-learning is included only in the Complete package. All prices are net prices, one-time, with 12 months of legal-status updates. There is no kit bundle.
| Kit | Total documents | of which Basic package | E-learning |
|---|---|---|---|
| EU AI Act Kit | 65 | 59 | AI literacy |
| GDPR Kit | 69 | 64 | Data protection at work |
| NIS2 Kit | 73 | 67 | Cybersecurity at work |
| AGG Kit | 61 | 57 | Equal treatment at work |
| Whistleblower Kit | 54 | 50 | Whistleblower protection |
The e-learning is also available on its own: from €490 net for up to 25 users, for larger companies tiered by company size on request, all five courses together from €2,190 net. We do not host: the course runs as a stand-alone HTML file or in your own LMS and concludes with a certificate of participation with a verification code. If you do not want to fill in the documents yourself: a standardised fill-in service is coming soon, and we are taking expressions of interest via the contact form.
Honestly: when the professional template model is NOT the right choice
We do not sell a universal remedy and say clearly when other models fit better:
- You have an ongoing fining procedure? Then you need a specialised law firm with procedural experience.
- You are a group with an international structure? Then a platform with a multi-company architecture fits better.
- You have a special case with idiosyncratic sectoral regulation? Then individual consulting is the better choice.
- You want daily live reports with dashboards? Then a SaaS platform with workflow management makes more sense.
- You have fewer than five staff, work in a non-regulated sector and process no sensitive data? Then free templates are often sufficient.
For SMBs without a dedicated compliance department that need standardised documentation, on the other hand, our model fits.
FAQ on the comparison
When is a premium SaaS subscription worth it instead of professional templates?
A subscription platform is worth it when a dedicated compliance department works continuously with workflows, live reports and dashboards, or when many companies in several countries have to be managed. In return there is a recurring fee for as long as you use the platform, usually monthly or annually, depending on the provider. If what you mainly need is the documentation, that is policies, records, process descriptions and evidence, a kit is enough: one-time from €990 net, with no recurring fee, as Word, Excel and PowerPoint files on your own systems. A comparison of individual platforms is offered by the GRC Tooling Comparison 2026.
When is a consultancy or law firm better?
A law firm is indispensable when a fining procedure is ongoing, a highly complex special case exists or an international group structure has to be put in order, because only a law firm reviews your individual case legally. For standard documents such as the records of processing activities, the technical and organisational measures (TOMs) or the data processing agreement, by contrast, consulting is often more than is needed. These standard documents are covered by the GDPR Kit. The two can be combined: the kit for the foundation, the law firm for the special questions.
Why not simply free templates from chambers of commerce or industry bodies?
Free templates are a good starting point. They have two weaknesses, however: they are mostly generic and need more adaptation, and nobody commits to updating them when legislation changes. A kit supplies the standard documentation for one regulation in the edition for Germany or Austria, with legal references, a guide and 12 months of legal-status updates. Which free aids are suitable for getting started is shown in the article GDPR 2026: 8 Free Starter Tools for SMEs.
What does "one-time price instead of subscription" mean concretely for updates?
The price includes 12 months of legal-status updates from first delivery, for the edition purchased, that is the purchased kit in the purchased edition for Germany or Austria. In the event of relevant legal changes you receive an updated document version by e-mail or download link. After the 12 months have expired, we offer existing customers follow-up updates on preferential terms. Delivered files are not locked and do not expire; they remain with you permanently. Details are governed by § 8 of the Terms and Conditions.
Which kits does a tax consultancy with 50 employees typically need?
The typical first need is the GDPR Kit: records of processing activities (Art. 30 GDPR), TOMs (Art. 32 GDPR), data processing agreement (Art. 28 GDPR), data protection impact assessment (Art. 35 GDPR) and the check whether a data protection officer has to be designated. In Germany, in addition to Art. 37(1)(b) and (c) GDPR, a data protection officer has to be designated where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data, and irrespective of the number of persons where processing operations are subject to a data protection impact assessment under Art. 35 GDPR (§ 38(1) BDSG); in a tax consultancy of this size this is as a rule met. Austria has no such additional threshold; there the obligation follows from Art. 37(1) GDPR alone.
Then there is the internal reporting office. In Germany, employers with as a rule at least 50 employees must set up and operate an internal reporting office (§ 12(1) sentence 1 and (2) HinSchG). In Austria, the obligation to have an internal whistleblowing system applies to companies with 50 or more employees (§ 3(1) and § 11(1) HSchG). What is mandatory is the reporting office, not the kit; the Whistleblower Kit helps with setting it up. There is no kit bundle: both kits in the Basic package cost €1,980 net together. This classification is a product example and not legal advice in an individual case. Further reading: GDPR guide, GDPR for tax advisors, Whistleblower guide (HinSchG) and Whistleblower system from 50 employees.
How quickly can I start with the kit compared to consulting?
You buy online and receive the download link within 48 hours of receipt of payment (working days). Questions in advance are answered via the contact form. With consulting, work only begins after the initial assessment; how long that takes depends on the provider and the scope. How long filling in takes depends on your starting position: on existing documents, the number of processes and who in the company contributes. With NIS2, time is often pressing because of registration. In Germany, entities concerned must register via the joint registration facility of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK) no later than three months after they first or again qualify as a particularly important or important entity; the period runs from the point at which the entity status arises, not from a fixed date (§ 33(1) BSIG). In Austria, §§ 2 to 45 NISG 2026 have applied since 1 October 2026; registration with the Cybersecurity Authority (Federal Office for Cybersecurity) has to take place within three months of entry into force (§ 29(2) to (4) in conjunction with § 51(2) NISG 2026); anyone who only later qualifies as an essential or important entity must register as soon as possible, at the latest three months after meeting the requirements. Where you stand with implementation is shown by the NIS2 Readiness Check; who is affected and which obligations apply is explained in the NIS2 guide.
Who are the kits intended for?
The kits are aimed exclusively at businesses (B2B), above all at SMBs in Germany and Austria without a dedicated compliance department. Every kit is available in an edition for Germany or for Austria. What is delivered is a personalised company licence with your company name, your logo and a licence ID. The templates are unpopulated, with placeholders, selection fields and a guide for filling them in. They do not replace legal advice in an individual case.
Further reading
- GRC Tooling Comparison 2026: platforms compared individually, if you are considering the subscription model.
- Compliance Budget SME 2026: what compliance realistically costs by company size.
- Compliance Tool Stack 2026 for SMEs: which tools together make up a compliance system.
- GDPR 2026: 8 Free Starter Tools: the route via free aids.
- About Compliance-Kit: who is behind the kits and which sources they are based on.