Running a company in the German-speaking region today means dealing not with one regulation but with several at once: the Swiss FADP and the GDPR, the EU AI Act and Germany’s implementing act KI-MIG, the NIS2 transpositions in Germany and Austria, Switzerland’s Information Security Act with its reporting duty, the Data Act for connected products, accessibility duties under the European Accessibility Act, and Germany’s e-invoicing mandate. Each has its own thresholds, roles and deadlines. The question we hear most often in first conversations is therefore not “What does the GDPR require?” but “Which of these affect us at all?”.
From business model to applicability
We start with a structured intake: legal form and seat, markets and customer groups, consumers or businesses, sector and size, systems and service providers, products with digital elements, AI use, payment and asset flows. From these facts we derive for each regime whether it applies, in which role and from when. The result is a reasoned list, not a guess: for each regime it states why it applies or why not.
A gap analysis, not a legal commentary
For the regimes that apply, we compare the current state with the duties. We review existing documents such as the privacy notice, the record of processing, contracts with providers, incident plans and policies, and hold short interviews with the people responsible. Each gap is rated by risk and deadline. The result is an action plan that starts with what is most urgent and fits your organisation realistically.
Why across regulations
Many duties overlap. One inventory of systems serves data protection, the NIS2 risk analysis and the AI inventory at the same time. An incident response plan covers the reporting channels under the FADP, GDPR, ISA and NIS2 if it is built for that from the start. Tackling each regulation separately means building the same foundations several times. Our assessment shows which building blocks satisfy several duties at once.
The experience behind it
Leutrim Miftaraj has worked in IT and project mandates for more than ten years, including for federal agencies and regulated companies, as an IREB-certified business analyst and as a project lead. Innopulse runs its own compliance products for the EU AI Act, for anti-money laundering duties in family offices and for cyber assurance. The assessment is methodical requirements work: elicit, delimit, evidence. Where a question needs a legal opinion on the individual case, we say so and involve a law firm on request, rather than claiming to give legal advice we do not provide.
When it pays off
A compliance assessment is most valuable in three situations: when a company grows into new markets or customer groups, when a large customer asks for evidence, or when several new regulations approach at once and nobody has the overview. Our free regulatory check on the website gives a quick first impression; the assessment then goes into depth.