Frequently asked questions

No. Complass explains every step in plain language, with templates, sample texts and references to the source. Your team implements on its own. If you would like support, you can add accompanying consulting.

Yes. Your administrator connects Teams and Jira in a few steps. Notifications and approvals then run through Teams, and measures become Jira issues. A responsible person still confirms in Complass what counts as done, so the evidence is right.

The interface is available in German and English. French, Spanish, Italian, Dutch, Polish and Portuguese are available as a beta; the texts in these languages have not yet been reviewed by subject-matter experts.

Not directly, if you do not fall under § 28 BSIG yourself. Your customers do, however, have to consider supply chain security and often ask for evidence. You can provide it in a structured way with Complass, e.g. via ISO 27001.

The BSIG does not require certification. ISO/IEC 27001 is a proven framework, though; in Complass you link both catalogues so that evidence counts for both.

No. Certification is carried out by an accredited certification body. Complass prepares you with documents, the Statement of Applicability and evidence.

No, standards are protected by copyright. Complass explains the requirements and refers to the clause; you can store your own excerpts from your licensed copy.

The module is aimed at asset owners and integrators. Manufacturers currently implement product requirements via the CRA module, which is linked with IEC 62443.

No, IEC standards are protected by copyright. Complass explains the requirements and refers to the source; you can store your own excerpts.

Often both. Complass shows the overlaps and links the catalogues so that you provide evidence only once.

No. Complass calculates the deadlines and prepares the content; you submit the report via the reporting platform.

Possibly, if the modification counts as substantial. The module contains a dedicated assessment with a template for this.

One phase in the module deals with the interplay between the Machinery Regulation, the CRA and IEC 62443; the catalogues can be linked.

For AI safety components that are high-risk AI systems, only a few articles of the AI Act have applied since 27 July 2026; their requirements will come through Annex III of the Machinery Regulation from 2 August 2028. AI functions without a safety role, such as wear prediction, must still be assessed under the general rules of the AI Act. The module guides you through the classification.

Both modules belong to the IEC 62443 framework and use the same zone model. You carry out the gap analysis against the individual system requirements from 3-3 in the asset owner module, ideally together with your customer.

No, IEC standards are protected by copyright. Complass explains the requirements in its own words and refers to the requirement number; you can store your own excerpts.

No. Harmonised standards for the CRA are in preparation; as long as their references are not published in the Official Journal, IEC 62443 does not give rise to a presumption of conformity. You can, however, describe 4-1 and 4-2 as the chosen technical solution in the technical documentation; the module contains a mapping template for this.

No, IEC standards are protected by copyright. Complass explains the requirements in its own words and refers to the numbers; you can store your own excerpts from your licensed edition.

Not necessarily. Many manufacturers start with a self-declaration of the SL-C and support the process with their own evidence. A process or product certificate from an independent body strengthens customer trust; the module helps you collect the evidence for it.

No. Complass structures implementation and evidence; advice and monitoring remain the task of the data protection officer where one is designated. The content does not replace legal advice.

No. Complass helps with assessment, content and documentation of the notification; you submit the notification via your supervisory authority’s reporting channel.

Yes. The content follows the Regulation, which applies in all Member States. German specifics from the BDSG are marked as national notes; you check national rules of other Member States yourself.

Yes, as a deployer: you must take measures for the AI literacy of users and rule out prohibited practices. Further obligations only arise for high-risk purposes or transparency cases.

AI for quality control or performance optimisation is not considered a safety component. For AI safety components of machinery only a few articles of the AI Act apply; the requirements come via the Machinery Regulation. Complass links the AI Act, Machinery Regulation and CRA projects for this.

Only in certain cases. Art. 27(1) obliges deployers that are bodies governed by public law or private entities providing public services, as well as deployers of high-risk AI systems under Annex III point 5(b) and (c) (creditworthiness, risk assessment and pricing in life and health insurance), before first use. The obligation does not apply to high-risk AI systems in the area of critical infrastructure (Annex III point 2). Complass gives a hint based on your classification; you take the decision.

No. Complass structures classification, obligations and evidence based on the legal text; the legal assessment of the individual case remains with you.

Partly. The obligation to design products for data access only applies to connected products and related services placed on the market after 12 September 2026; what counts is each individual unit, not the product type. Users’ rights to access readily available data and to have it shared with third parties, by contrast, have no separate start date and have applied since 12 September 2025. According to the European Commission’s FAQ, they also cover machines already in the field.

The data access obligations of Chapter II do not apply to microenterprises and small enterprises, provided they have no larger partner or linked enterprises and have not been subcontracted to manufacture or design a connected product. The rules on unfair contractual terms and on cloud switching still apply. Complass guides you through this check.

As a user you can request the readily available data of your machines from the data holder, free of charge and in a machine-readable format, and have them shared with a third party of your choice, for example a service partner. Complass helps you request data, review contracts and set requirements for purchasing new machines.

No. Complass structures roles, obligations and evidence based on the legal text and provides templates with example wording; have contracts and customer-facing texts legally reviewed before use.

No. It is German law and applies to critical facilities in Germany. The other EU Member States transpose the CER Directive with their own laws; facilities there are subject to the respective national law.

The ordinance with the thresholds has not yet been promulgated. Record your services, facilities and supply level values now and document your assessment. Once a facility counts as critical, you have three months to register; ten months after registration, the resilience plan and incident reporting must be in place.

No. The BSI Act governs cybersecurity, the KRITIS Umbrella Act physical protection and the continuity of supply. Registration is joint, however, and you can use existing risk analyses, documents and certificates as evidence (§ 17). In Complass you use risk management for the risks under both acts.

Fines apply only to certain infringements, with maximum amounts between EUR 100,000 and EUR 1 million: missing or incorrect registration data, non-compliance with enforceable orders, audit results not submitted, and refused access or information during an inspection (§ 24). For missing measures the authority can order the deficiencies to be remedied (§ 16); management is liable under company law (§ 20).

No. Complass structures the applicability check, obligations and evidence based on the legal text; the legal assessment of the individual case remains with you.

As a rule, yes: the machine with a radio module is then itself radio equipment, and if it can communicate over the internet, the requirement on protection of the network applies. The Complass RED module helps you with the classification.

Only if you apply harmonised standards in full for all applicable essential requirements and none of the restrictions published in the Official Journal applies, for example because the user is allowed to skip setting or using a password when clauses 6.2.5.1 and 6.2.5.2 of EN 18031 are applied. Otherwise a notified body must be involved.

Yes. Radio equipment placed on the market until then must meet the RED requirements, and the risk assessment, security concept and test reports can be carried over into your CRA project.

Indirectly, yes: your customers must demonstrate the MDR cyber requirements and expect information and commitments from you for this. If you also sell the component to other industries, the Cyber Resilience Act generally applies to it as well. The module contains a dedicated phase for suppliers.

No. Complass structures the cyber requirements and evidence and can be integrated into your existing QMS; conformity assessment and approvals remain with you and your notified body.

The module describes the activities in its own words with references to the clauses. You obtain the standard text itself from a standards distributor; you can store excerpts from your licensed edition in the project.

The law does not oblige you to, but the reporting office should process anonymous reports. Complass offers the anonymous route by default because it lowers the threshold; anyone who wishes can give their name voluntarily.

Only if it is itself part of the reporting office. Administrators name the reporting office but see no content. Every change in the line-up is visible to the existing members at once, so nobody can read along unnoticed.

For most smaller companies the obligation does not apply, financial companies excepted. Because the channel and the framework are included in the baseline protection, you can still offer the channel at no extra cost.

No. Complass provides the reporting channel, procedure and evidence; how a reported violation is to be assessed legally is decided by your reporting office case by case.

Yes, indirectly, if you provide ICT services to financial entities. Your customers must agree the contract contents under Art. 30 with you and require information for their register of information, assistance with incidents, audits and exit arrangements. Direct oversight only applies to critical ICT third-party service providers under Art. 31.

For financial entities DORA is the more specific act; § 28(6) BSIG exempts them from central NIS2 obligations. ICT providers, on the other hand, may fall under NIS2 themselves and additionally have to meet their customers' DORA requirements. The applicability check in Complass covers the NIS2 side.

No. Complass helps you document incidents with timestamps, justify the classification as major with check questions, calculate the reporting deadlines and prepare the reports with their mandatory information. You submit the report yourself via the channel prescribed by the supervisor; the legal assessment of the individual case remains with you.

In the “Contracts and licences” register of asset management, with term, notice period, owners, linked assets and evidence; with supplier management also on the provider concerned. It provides information for your register of information under Art. 28 DORA; Complass does not offer an export in the format of Implementing Regulation (EU) 2024/2956.

No. The certification body for ISO 27001 on the basis of IT-Grundschutz is the BSI; the audit is carried out by an auditor certified by the BSI. Complass prepares you with templates, catalogues and evidence.

No. For Edition 2023, Complass contains identifiers, levels and its own short descriptions; you read the wording in the free BSI Compendium. The BSI publishes the Grundschutz++ requirements under the CC BY-SA 4.0 licence; they are included in the original wording.

If you want to be certified soon, you can do so on the basis of classic IT-Grundschutz until 30 November 2031. If you only want to be certified in 2027 or later, it is best to plan directly with Grundschutz++; structure analysis, protection requirements and risk analysis remain usable in both cases.

No. The label requires an assessment by an audit provider approved by ENX, and that assessment decides whether you receive it. Complass prepares you for it: with a self-assessment, the current maturity level per requirement, templates, evidence and a corrective action plan.

No. For each requirement Complass only gives the VDA ISA number and describes it in its own words. You download the official catalogue from ENX and use it alongside; you can store excerpts from it in the project.

No. Registration, ordering the audit provider and sharing the result take place on the ENX portal. Complass prepares the information for it with a checklist.

Yes. The VDA ISA is closely based on ISO/IEC 27001 and 27002, so you will already have implemented many requirements. The policy templates in the TISAX module are structured as in the ISO 27001 module. Prototype protection and data protection are added where needed.

VDA ISA 2027 applies to assessments ordered from 1 January 2027, with partly new numbers. Your answers in Complass are tied to our own stable identifiers and are kept when switching over. The numbers under VDA ISA 2027 are in preparation.

The service provider can implement the technology, but responsibility stays with the practice management. Rules for the team, training and evidence are up to you. In Complass you record which requirements the service provider confirms and which the practice implements itself.

No, dental practices implement the KZBV guideline. Both versions have the same structure and numbering; for every requirement Complass shows the KBV wording and, where it differs, the KZBV wording.

No. The guideline does not require a certificate. You must, however, be able to demonstrate implementation, for example to the regional association of statutory health insurance physicians or dentists, the data protection authority or, after an incident, to insurers.

Section 391 SGB V applies to all hospitals and requires precautions according to the state of the art. The B3S is the way the BSI has confirmed as suitable for this and is therefore the obvious benchmark for smaller hospitals too.

No. The B3S is a work of the DKG. Complass describes the requirements in its own words and refers to chapters and ANF numbers. You can obtain the standard free of charge from the DKG; you can store excerpts from it in your project.

No. Measures you document in the B3S project are also assigned to the NIS2 framework through the shared control catalogue.

No. The CSF cannot be certified. Complass helps you describe and evidence your position as a profile; no certificate or label results.

The four tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how established your governance and risk management are overall. You record the current and target tier in a template.

No. Through the shared controls, Complass suggests adopting assessments and evidence. You check each suggestion on its merits before confirming it.

No. It complements them as a way to present your position to customers and insurers. Legal duties remain.

No. Neither the SSDF nor OWASP SAMM can be certified. Complass helps you describe and evidence your implementation status and maturity.

Not automatically. The SSDF covers many requirements for development and vulnerability handling, and Complass shows the mapping to Annex I. The conformity assessment under the CRA remains a separate task.

The SSDF says what to do; SAMM shows how established it is. With levels 0 to 3 you can measure progress and set targets.

No. Through the shared controls, Complass suggests adopting assessments and evidence. You check each suggestion before confirming it.

Yes. As a manufacturer, importer or distributor you have your obligations even if the marketplace has obligations of its own. Complass assigns the role to you per product.

No. Complass prepares the details for the report in the Safety Business Gateway and documents the case; you submit the report yourself.

No. Complass structures roles, obligations and evidence based on the text of the Regulation; the legal assessment of the individual case remains with you.

The module is in preparation. We will only name a date once it is fixed. Get in touch: we will show you the current state and how you can start in Complass today with ISO/IEC 27001 or NIS2.

For network operation and for energy facilities of important or particularly important entities, sections 5c to 5e EnWG apply; most duties of the BSI Act do not apply to them. Classification and registration under the BSI Act remain. Further lines of business such as water or waste water are subject to the BSI Act. If the energy facility is only a secondary activity in relation to the business as a whole, the BSI Act applies as well.

For network operators the catalogue of August 2015, for operators of energy facilities the catalogue of December 2018. According to the Federal Network Agency, both remain in force until a new catalogue is published. Status checked: 10 October 2026.

The Federal Network Agency, together with the BSI, is revising the catalogues into one catalogue that is also to apply to digital energy services. The consultation draft names 1 January 2027 as the start of application. This has not been fixed yet. Your work on the twelve topics of section 5c(4) EnWG counts in any case, because every catalogue must contain them.

If you were previously covered by section 8a BSIG (old version), continue to implement the BDEW “B3S Aggregatoren”. Otherwise build an ISMS under ISO/IEC 27001 and orient yourself by the twelve topics. In Complass you assess these topics and add the new catalogue as soon as it is fixed.

To the BSI reporting office: an early warning within 24 hours, an incident notification within 72 hours and a final report one month later at the latest. If the incident is relevant to the security of energy supply, the BSI forwards the report to the Federal Network Agency (section 5d(5) EnWG).

No. Complass structures the applicability check, obligations and evidence based on the legal text and the catalogues; the legal assessment of the individual case remains with you.