Compliance in the DACH region: which rules apply to your company

Companies in the DACH region are subject to several regulations at once: data protection under the FADP and GDPR, cybersecurity under the ISA, Germany’s NIS2 act or Austria’s NISG 2026, the EU AI Act with Germany’s KI-MIG, the Data Act, accessibility under the BFSG and BaFG, and German e-invoicing. Which apply depends on seat, size, sector and offering.

This topic page guides you through the content that helps with this question: the regulatory check, the country comparison and the overview of supervisory authorities, glossary terms, articles, checklists and our offers from compliance assessment to NIS2 implementation. The content explains rules and approaches and does not replace legal advice on individual cases.