Checklist: preparing a compliance assessment
For: Management, compliance and IT owners
Updated: 2026-11
Good preparation shortens any compliance assessment. Compile: legal form and entities, markets and customer groups, key systems and providers, products with digital elements, AI in use, headcount and turnover figures, and existing data protection and security documents.
Most questions in a compliance assessment can be answered with a few basic facts. Gathering them in advance saves interview time and yields a more precise applicability check.
The list is designed so that someone without a legal background can work through it.
The checklist
- 01
List entities
All entities with seat, legal form and activity, including branches abroad.
Done when: A list of all entities with seat and activity exists.
- 02
Describe markets and customers
In which countries you sell, whether to businesses or consumers, and through which channels.
Done when: For each market it is known whether business or consumer customers are served.
- 03
Provide key figures
Headcount, turnover and balance sheet total per entity, because many duties depend on thresholds.
Done when: The three figures are recorded per entity for the last financial year.
- 04
Capture systems and providers
The main applications, cloud services and IT providers with purpose and storage location.
Done when: A list of core systems and providers with storage location exists.
- 05
Name products and AI
Products with software or connectivity and every use of AI, including purchased tools.
Done when: Products with digital elements and AI uses are listed by name.
- 06
Collect existing documents
Privacy notice, record of processing, contracts with providers, incident plan, policies.
Done when: All existing documents are in one place with the date of last change.
- 07
Appoint contacts
Who can provide information on data protection, IT, finance and the main business units.
Done when: For each area a contact person with availability is named.
Common mistakes
- —Purchased AI tools are forgotten although they trigger duties as a deployer.
- —Consumer customers in the EU are overlooked because they make up a small share of turnover.
- —Outdated documents are submitted as current and distort the gap analysis.
What this checklist does not cover
- —The checklist prepares an assessment; it does not replace an applicability check.
- —Sector-specific supervisory rules, for example in finance or healthcare, require additional documents.
Parent service: Compliance assessment
FAQ
What if we don’t have all the information?
Start with what you have. Missing information is clarified together during scoping.
How long does preparation take?
For an SME usually a few hours, spread across the contact persons.
More checklists
Checklist: ready for e-invoicing
For e-invoicing, companies in Germany need to know their date, ensure receipt of structured invoices, choose a format, check their billing systems, complete master data, regulate archiving and test issuing with first customers. Swiss suppliers check what their German customers require.
Checklist: choosing an app agency
When choosing an app agency, glossy references matter less than verifiable answers: which form factor does it recommend and why? Who owns the code? Where is the data? How are requirements, changes and acceptance handled? And who operates the app after launch?
Checklist: testing an app for accessibility
A first accessibility test of an app covers: full keyboard operation, understandable screen reader output, sufficient contrast, zoom without loss, labelled forms, understandable error messages, no overly short time limits and the required accessibility information.