In recent weeks several companies contacted us with the same question, phrased differently: which of these actually affect us? They meant the GDPR, the AI Act, NIS2, the Data Act, accessibility, e-invoicing and more. The honest answer is almost always: fewer than feared, but different ones than expected. This article describes the approach we use to answer that question.
Step 1: Start from the business model, not the law
Starting with a law means checking one regulation after another and losing the overview. The reverse works better: describe the company first. Which entities exist, in which countries? Who are the customers, businesses or consumers? Which products contain software or are connected? Where is AI used, including in purchased tools? Which providers process data? These facts are quickly gathered, and they decide almost everything that follows.
Step 2: Check thresholds
Many duties depend on numbers. The key thresholds in the German-speaking region:
- 50 employees: internal reporting channel under Germany’s HinSchG and Austria’s HSchG.
- 50 employees or more than EUR 10 million turnover and balance sheet: the start of medium size, from which NIS2 applies in the covered sectors.
- Fewer than ten employees and at most EUR 2 million turnover: the microenterprise exemption for accessibility of services.
- EUR 800,000 prior-year turnover: the 2027 or 2028 date for issuing e-invoices in Germany.
- 20 people regularly processing personal data: duty to appoint a data protection officer under Germany’s BDSG.
Step 3: Clarify the market link
For Swiss companies, the link to the EU market is the central question. The GDPR applies when people in the EU are targeted with goods or services or their behaviour is monitored. The AI Act applies when AI systems are placed on the EU market or their output is used there. The European Accessibility Act and the Data Act attach to offering in the EU, not to the seat. Conversely, NIS2 does not apply to a Swiss company, but it does apply to its subsidiary in Germany or Austria. In Switzerland itself, the Information Security Act with its reporting duty for critical infrastructure applies instead.
Step 4: Give reasons for applicability
For each regulation we record in writing whether it applies, in which role, from when, and above all why. The reasoning matters more than the result, because it makes the assessment verifiable. An example: a website chatbot makes a company the deployer of an AI system with a transparency duty under the AI Act, not the provider of a high-risk system. AI-based screening of job applications, by contrast, falls under Annex III and therefore into the high-risk category, whose duties apply from 2 December 2027.
Step 5: Rate and bundle the gaps
Only for the applicable regulations does the gap analysis follow. Each gap is rated by risk and deadline. Then it pays to look for shared building blocks: one system inventory serves data protection, the NIS2 risk analysis and the AI inventory. One incident plan can cover the reporting channels under the FADP, GDPR, ISA and NIS2 at once. Building these blocks properly once saves work with every further regulation.
What the assessment is not
A compliance assessment is not legal advice. It gathers facts, maps them to regulations and prioritises measures. Where an individual legal opinion is needed, for example on an unclear AML classification or management liability, that question belongs with a law firm. Good assessments flag such points explicitly instead of glossing over them.
A typical result
For a Swiss SME with around 60 employees, an online shop for customers in Germany and an AI chatbot on its website, the picture is often: the FADP and GDPR apply, an EU representative must be considered, the online shop falls under Germany’s BFSG, the chatbot needs a transparency notice, NIS2 does not apply to the Swiss company, and the German e-invoicing mandate generally does not hit a company without a German establishment directly. That is a manageable list, but a different one from what you would have expected without an assessment.
How to start
Our free regulatory check gives a first overview. It asks the questions from steps 1 to 3 and shows which regulations may be relevant. For a robust assessment with reasons and an action plan, our compliance assessment service describes the approach; the preparation checklist helps gather the facts. The legal differences between Switzerland, Germany and Austria are summarised in our overview regulations compared across DACH.