Compliance-officer copilot for small businesses (GDPR, AML, professional rules)

A hotel, a care service, an engineering office or a tax practice with 10-50 staff has the same documentation duties as a corporation but no compliance department. The owner or an external data protection officer (DSB) maintains a RoPA that is out of date, a deletion concept nobody applies, and a money-laundering risk analysis written once. A copilot keeps these documents alive: it drafts and updates them from the firm's real systems and contracts, assesses incidents against the 72-hour rule, and reminds the owner of reviews that are due. Judgement and signature stay with the responsible human. This is the small-firm counterpart to SEC-018, which targets enterprise privacy platforms; widening SEC-018 instead of keeping a separate entry is a catalogue-design option.

Problem & value

• Today: compliance is a yearly clean-up before an audit, a chamber questionnaire or a customer request. Documents live in Word and Excel, an external DSB visits a few hours per year, and incidents are judged from memory. Time per week is small (the shadow-process survey puts it at about 2-4 hours per week per firm type: hotel 3 h, care service 4 h, tax practice 3 h, engineering office 2 h), but the risk is asymmetric: a missed 72-hour notification or an AML documentation gap is costly.
• AI value: drafting RoPA lines from a system list and contracts, proposing retention periods from a legal-basis catalogue, turning a free-text incident into a structured assessment, extracting duties from chamber circulars into a review calendar.
• Who needs it: hotel (guest data, deletion periods), Pflegedienst (health data, incidents), Steuerkanzlei (GDPR, AML, professional rules), Ingenieurbuero (GDPR).
• No sourced time-saving figure exists; the savings range in the front matter is a planning assumption to be measured against your own baseline.

Variants

• Hospitality: guest registration, booking portals, CCTV, deletion periods for guest data.
• Care and health practices: special-category data (Art. 9), incident and breach handling, DPO duty.
• Tax advisers, auditors, lawyers, notaries: AML (GwG) risk analysis, client due diligence, professional secrecy and chamber rules on top of GDPR.
• Engineering and trades: employee and project data, supplier AVVs, a light RoPA.
• Delivery models: tool used by the owner alone, or by an external DSB who serves 20-100 small clients.

How it works

1. inputs (system list, contracts, privacy notice, AML client files, incident report, circulars)
2. inventory and classification (which processing, which data categories, which legal basis)
3. draft documents (RoPA entry, deletion schedule, AML risk analysis, TOM summary) [owner/DSB reviews]
4. incident intake
5. breach assessment (risk to persons, Art. 33/34 trigger)
6. notification draft [DSB/owner decides]
7. review calendar (annual RoPA check, AML risk-analysis update, AVV renewals, training proof)
8. reminders + status dashboard + audit trail of AI drafts versus approved versions

• Drafting: an LLM fills structured templates from system metadata and uploaded contracts; unknown fields stay flagged and are never invented.
• Retrieval: statute texts, DSK/chamber guidance and the firm's own documents in a small index, so every proposal cites its source.
• Reasoning step: the breach assessment follows a fixed decision tree (risk factors from EDPB Guidelines 9/2022); the LLM structures the facts, a human decides on notification.
• Human-in-the-loop: legal basis, retention decisions, AML risk classification of clients, breach notification to the authority and every signature.

Data preparation

Which data: list of IT systems and SaaS tools, vendor contracts (AVV), the current RoPA and privacy notice, an inventory of paper files, the AML risk analysis and client classifications, the incident log and the chamber's circulars.

Where it lives: Word/Excel on a file share or Nextcloud, the PMS in hotels, the care software (e.g. a Pflege-Dokumentation system), DATEV and Kanzlei software in tax practices, the external DSB's own folders, and email.

Typical gaps: no system list at all, AVVs missing or unsigned, retention periods unknown or in conflict (tax law versus GDPR erasure), AML files without a current risk analysis, nobody who owns the topic.

Preparation steps: 1. List all systems, tools and processes that touch personal data and name an owner each (PREP-001, PREP-004). 2. Collect AVVs, the privacy notice and any existing RoPA; scan paper contracts (DOC-018 for redaction of examples). 3. Write down the retention rules the firm already follows (HGB/AO 6-10 years, personnel files, guest data). 4. For AML firms: export client list with risk class and last review date from the practice software. 5. Restrict access to the compliance folder (PREP-023) because it contains incident details.

Tools: Nextcloud or SharePoint folder, a spreadsheet inventory, an OCR tool for scans. Rough share of effort: about 40 percent inventory and clean-up, 60 percent configuration and review.

Implementation paths

Which path for whom

• SMB - Path A: the process is standard, the volume tiny and nobody has engineering skills; a DSB-led SaaS tool or a DSB service with a copilot fits. Builds (B, C) only make sense for consultants serving many clients.

Path A - Buy (recommended)

• Privacy and compliance SaaS for SMEs (DE/EU): DataGuard, heyData, Caralegal, ISMS/DSMS tools from 2B Advice and Proteus-Cortex style products, Privacy-Cockpit-type tools, Datenschutz-Management modules of IT service providers. Many now add an AI assistant for RoPA drafts, policy text and incident checklists; test the claims on your own data.
• AML: GwG modules in practice software of the profession (DATEV Kanzlei-Rechnungswesen add-ons, chamber templates and questionnaires) and specialised KYC portals; AI is mostly a drafting aid.
• General assistants: Microsoft 365 Copilot or Gemini for Workspace with a vetted prompt library and checklists, for firms that only need drafts.
• Check: EU hosting, AVV with the vendor, export of the RoPA in an open format, whether the vendor states that legal content is reviewed by lawyers.
• Choose A when: under ~50 staff, fewer than ~30 systems, no engineers.

Path B - Build on cloud APIs

• LLM via EU-region endpoints (Mistral, Azure OpenAI EU, Claude or Gemini via EU regions) with templates for RoPA, retention and breach assessment, n8n/Power Automate for the calendar.
• Sensible for a DSB or consultancy that serves many small firms and wants standardised output.

Path C - Self-host (open source)

• Open-weight 8-30B model (Mistral Small, Qwen) on HW2 with a small vector index over statutes and guidance; Nextcloud Assistant for the front end. Worth it only when incident data (health data in care) must not leave the premises.

Path D - Custom training

Not justified; templates and retrieval give nearly all the value.

State of the art (2026)

• Drafting RoPA entries, retention tables and policy text from structured inputs is feasible and commonly offered; assistants inside DSB tools are new and uneven in quality.
• Weak spots: legal assessment (is the legal basis valid, is a breach reportable) is still where LLMs sound confident and err; AML risk judgement for a specific client is not delegable.
• Regulatory moving parts: the BStBK interpretation notes on the GwG were updated in 2026 and EU AML rules (AMLA guidelines on risk analysis) are being finalised, so templates age quickly; the copilot must show which version of a rule a draft rests on.
• Automatic submission to authorities (DSB notification portals, goAML/FIU) is not an AI task and stays manual or in certified software.

Shared resources & combinations

• SEC-018 shares the RoPA and DSAR logic at enterprise scale; SEC-009 covers ISO 27001/NIS2 evidence for firms that fall under it; SEC-017 adds data discovery; SEC-022 the AI Act register that the same owner must keep; SEC-024 staff training proof.
• KNOW-009 / KNOW-014: the same retrieval index over rules and own procedures serves quality-manual and organisational-memory use cases.
• LANG-040: incident analysis for care services feeds the breach intake.
• One small LLM server and one vector index can serve all of the above for a single firm.

Effort, cost & KPIs

• Path A: days to set up, 1-2 months to get the RoPA and deletion concept to a clean state; SaaS prices in the low hundreds of euros per month (estimate, quote-based).
• Path B/C: weeks of engineering plus review of templates by a lawyer or DSB.
• KPIs: RoPA coverage (systems mapped/known), days since last verification, share of vendors with a valid AVV, time from incident to breach decision (target well below 72 h), AML risk analysis age, overdue reviews.

People & change

Involve early: the owner/management (accountable), the DSB (internal or external) as process owner, IT for system lists, and department leads (reception, care lead, partner) for their processes. A DPO is mandatory under section 38 BDSG with 20 or more persons constantly processing personal data automatically, or where a DPIA is required [4].

Works council: depends. The tool maps systems and documents, not staff behaviour. Co-determination under section 87(1) no. 6 BetrVG becomes relevant only if incident logs or training records are evaluated per employee; section 90(1) no. 3 BetrVG still requires timely information. Most small firms have no works council.

Data protection: the incident files contain sensitive details; conclude an AVV with the tool provider and keep access narrow.

AI literacy: Art. 4 AI Act (applicable since 2 Feb 2025; reportedly softened by the 2026 AI Omnibus - check the current wording) calls for AI-literacy measures for staff using the tool; a 1-hour introduction on checking AI drafts is enough.

Pilot: start with the RoPA for three core processes, then the deletion schedule, then incident assessment as a dry run on past cases. Name one owner. Typical concerns: liability ("who is responsible if the draft is wrong?" - the signing human) and fear of over-documentation.

Risks, regulation & compliance

• EU AI Act: minimal risk; no Annex III category. Art. 4 literacy applies.
• GDPR: Art. 30 RoPA (the exemption for under 250 employees does not apply for non-occasional processing or special-category data, which covers most firms in practice) [3], Art. 33/34 breach notification within 72 hours [2], Art. 28 for the tool vendor, Art. 5(2) accountability.
• GwG: section 5 requires a documented, regularly reviewed risk analysis, available to the supervisor on request [1]; tax advisers are supervised by their Steuerberaterkammer.
• Professional secrecy (section 57 StBerG, section 203 StGB, section 43a BRAO): sending client data to an LLM needs a lawful setup; use an EU endpoint with confidentiality obligations.
• Hallucinated law: drafts must cite the statute or guidance used; never accept uncited legal claims.
• False comfort: a complete-looking document is not compliance; reality must match the paper.

Getting started

1. Measure the baseline: age of RoPA, number of AVVs missing, last AML risk-analysis date, open incidents.
2. Write the system list; run a test of 2 tools with your own anonymised inputs.
3. Let the copilot draft the RoPA for three processes; have the DSB review and compare effort.
4. Replay two past incidents through the breach assessment.
5. Set the review calendar (annual RoPA, AML analysis, AVV renewals) and a named owner.

Sources

1. GwG section 5 (Risikoanalyse: documentation, review, supervisor access) - https://www.gesetze-im-internet.de/gwg_2017/__5.html
2. EDPB - Guidelines 9/2022 on personal data breach notification under GDPR (v2.0, 2023) - https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en
3. GDPR Art. 30 (German text, RoPA contents and exemption in para. 5) - https://gdpr-text.com/de/read/article-30/
4. BDSG section 38 (DPO appointment, 20 persons) - https://www.gesetze-im-internet.de/bdsg_2018/__38.html
5. BStBK - Auslegungs- und Anwendungshinweise zum Geldwaeschegesetz (69 pages) - https://www.bstbk.de/downloads/bstbk/recht-und-berufsrecht/fachinfos/BStBK-Hinweise_Auslegungs-_und_Anwendungshinweise_Geldwaeschegesetz.pdf
6. TLfDI Thueringen - Hinweise zum Verarbeitungsverzeichnis - https://www.tlfdi.de/fileadmin/tlfdi/datenschutz/hinweise_verarbeitungsverzeichnis.pdf