Compliance 2026: Five concrete steps for management and supervisory boards

Step 1: Update risks – don’t reinvent them

The starting point is not a fundamental discussion, but a targeted update of the existing risk analysis:

• IT and cyber risks (NIS2)
• Internal reporting systems and response processes
• ESG and supply chain risks

Existing risk overviews are often sufficient – they just need to be supplemented and prioritized.

Step 2: Clearly define responsibilities

Compliance rarely fails because of rules, but because of ambiguity. It is important to have:

• clear overall responsibility at management level
• designated contact persons for IT, HR, and legal
• transparent reporting lines to the supervisory board

Documented responsibilities create certainty and relieve the burden.

Step 3: Update existing regulations

Many companies already have:

• a code of conduct
• a compliance manual
• internal guidelines

These should be specifically adapted, not rewritten – for example, by adding short additions on NIS2, whistleblower protection, and ESG. Less scope, more relevance.

Step 4: Keep training short, regular, and practical

Instead of extensive training programs, we recommend:

• A compact update format (e.g., 90–120 minutes)
• Focus on new risks and typical practical cases
• Documented participation

This makes training a living part of corporate management.

Step 5: Check effectiveness – without bureaucracy

Finally, a quick check is all it takes:

• Are reporting systems being used?
• Are responsibilities known?
• Are risks reported regularly?

Short reports to management and the supervisory board are usually sufficient to meet documentation and control requirements.