What is IT compliance?
IT compliance means that a company can prove its IT meets every requirement that applies to it. It covers three levels: the IT systems themselves (security, availability, logging), the data they process (data protection, retention, integrity), and the processes through which IT is run, procured and changed.
IT compliance is not a separate area of law. The term bundles duties from different sources that are implemented in IT and must be evidenced there. That makes it part of general compliance and overlapping with information security. Internal requirements include the company's information security policy and its IT security policies.
Which laws and rules make up IT compliance?
Which requirements apply depends on industry, size and legal form. The main sources for companies in Germany (as of October 2026):
| Source | Who it applies to | What it requires of IT | Legal reference |
|---|---|---|---|
| GDPR, BDSG | anyone processing personal data | security of processing through technical and organizational measures, breach notification where feasible within 72 hours | Article 32 of Regulation (EU) 2016/679, Article 33 |
| NIS2 Implementation Act / BSIG | around 29,500 important and essential entities, since December 6, 2025 | ten minimum risk management measures, registration, reporting of significant incidents | § 30(2) BSIG, §§ 32, 33, 38 BSIG |
| KRITIS law | operators of critical installations | proof of the measures to the BSI every three years; physical resilience under the KRITIS-Dachgesetz, in force since March 17, 2026 | § 39(1) BSIG, KRITISDachG |
| DORA | financial entities, since January 17, 2025 | ICT risk management framework, incident reporting, resilience testing, ICT third-party risk | Regulation (EU) 2022/2554, Articles 5 to 44 |
| MaRisk (BaFin Circular 06/2026) | credit institutions and financial services institutions, except significant institutions directly supervised by the ECB (AT 2.1 para. 1) | appropriate and effective risk management as part of a proper business organization | § 25a(1) KWG |
| HGB, AO, GoBD | all companies required to keep accounts | keep electronic books and records unalterable, available and readable for the whole retention period | § 239(3) and (4) HGB, § 257 HGB, § 147 AO |
| AktG, GmbHG | management board and managing directors | early warning and monitoring system; for listed companies an appropriate and effective internal control and risk management system | § 91(2) and (3) AktG, § 43(1) GmbHG |
| Cyber Resilience Act | manufacturers of products with digital elements | reporting duties since September 11, 2026, full application from December 11, 2027 | Regulation (EU) 2024/2847 |
| EU AI Act | providers and deployers of AI systems | transparency duties since August 2, 2026, high-risk duties from December 2, 2027 or August 2, 2028 | Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744 |
Under § 28(5) and (6) BSIG, the BSIG duties generally do not apply to operators of public telecommunications networks and certain energy installations, or to financial entities under DORA.
Standards such as ISO/IEC 27001 are voluntary on their own. They become binding once a customer, a tender or a contract requires the certificate. For essential and important entities, § 30(2), first sentence, BSIG also says the measures should take the relevant European and international standards into account.
Who is responsible for IT compliance?
Management is responsible. Under § 91(2) AktG, the management board of a German stock corporation must take suitable measures, in particular set up a monitoring system, so that developments threatening the company's survival are detected early. Managing directors of a GmbH must apply the care of a prudent businessperson under § 43(1) GmbHG.
For entities in scope of the BSIG, § 38(1) BSIG obliges management to implement the risk management measures under § 30 BSIG and to oversee their implementation. If it breaches this duty, it is liable to the entity under § 38(2) BSIG according to the rules of company law. More in the article on management liability for IT security.
In operations, IT management runs the systems and the information security officer runs the ISMS. The data protection officer covers personal data, the compliance function keeps the overview of duties and internal audit reviews independently.
IT compliance, IT governance and IT security: the difference
IT compliance asks whether IT meets all binding requirements and whether that can be proven. The neighboring terms ask different questions:
| Term | Guiding question | Relation to IT compliance |
|---|---|---|
| IT governance | How is IT steered so that it supports the company's objectives? | overarching framework; IT compliance is part of it |
| IT security / information security | Are confidentiality, integrity and availability protected? | supplies the measures through which IT compliance is met |
| Data protection | Is personal data processed lawfully? | one of the legal sources, with its own set of duties |
| IT risk management | Which IT risks exist, and how are they treated? | links breaches of duty to their consequences; itself a duty under DORA and MaRisk |
IT can be secure and still not compliant when measures work but are not evidenced. Conversely, complete documentation meets no duty if the measures it describes do not work in operation. What IT security covers is explained in its own entry.
How do you implement IT compliance?
- Determine which laws, supervisory requirements, standards and contracts apply to your company, and record them in a legal register.
- Assign each duty to the systems, applications and service providers where it is implemented. The basis is a current asset inventory.
- Name one responsible person per duty and system, not a department.
- Implement the measures and file the evidence where the duty is assessed.
- Review effectiveness and currency at fixed intervals, after legal changes and after audits, and report to management.
Fictional example of an entry that brings steps 2 to 5 together for one duty and one system; the systems, data and dates are invented:
| Field | Entry |
|---|---|
| Duty | Article 32 GDPR; as an important entity, also § 30(2) sentence 2 no. 10 BSIG (multi-factor authentication) |
| System | HR administration (SaaS) holding salary and bank details |
| Responsible | head of HR for the business side, IT operations for the technical side |
| Measure | second factor for all accounts with access to HR data |
| Evidence | export of the sign-in policy and list of accounts without a second factor dated September 30, 2026: none |
| Next review | March 31, 2027, result reported to management |
Test your register against this pattern: pick a duty and go to one affected system. If the evidence there is missing or older than the set review interval, the duty is open on that system, even if the register shows it as met. An ISMS can provide the framework for measures, evidence and reviews; the guide to implementing an ISMS describes how to introduce one.
Requirements on each system in Rizzqo
Rizzqo carries each requirement on the system it applies to. ISO/IEC 27001, ISO/IEC 27002 and DORA, among others, are held in Rizzqo as requirement catalogues; their requirements attach to supporting assets by category and subcategory, such as the HR administration system in the example.
The owner answers each requirement, can attach evidence and finalizes the answer with name and timestamp. A gap is a finalized "not fulfilled" answer, and Rizzqo computes coverage from the finalized answers. Measures for a gap run as tasks that sync with Jira in both directions.