Sample report: readiness for a German SME

Sample company

Example GmbH · 42 employees · B2B/B2C · Germany

Management summary

The sample company is in scope for e-invoicing receipt and for BFSG. AI Act exposure depends on the AI tools in use (currently medium risk). NIS2-Light baseline controls exist, but documented evidence is missing.

Top risks

• No documented receipt channel for structured e-invoices (XRechnung / ZUGFeRD 2.x).
• Website / shop without accessibility statement and without documented WCAG baseline check.
• No internal AI usage policy per EU AI Act, Art. 4.
• Backup restore has not been tested in the last 12 months.

Next steps (top 3)

1. 1Set up an e-invoice inbox and assign an internal owner.
2. 2Publish an accessibility statement and document a WCAG 2.1 AA baseline check.
3. 3Roll out an AI usage policy and short AI-literacy training.

Deadline calendar

• E-Invoicing2025-01-01
• BFSG Accessibility2025-06-28
• EU AI Act2026-08-02

Evidence checklist

• Screenshot / configuration of the e-invoice inbox
• URL of the published accessibility statement
• AI tool inventory (table with purpose & risk class)
• Latest backup restore test report
• MFA activation for admin accounts (screenshot)

Rules referenced

Rule set: EUReady Rules v1.0. Per-rule details:

• einv-001E-invoice receiving readinessv1.0 · 2026-01-10

  Bundesministerium der Finanzen — Wachstumschancengesetz

  KonformPass · einv-001 Open source
• bfsg-001Website / online shop scopev1.0 · 2026-01-10

  Barrierefreiheitsstärkungsgesetz (BFSG)

  KonformPass · bfsg-001 Open source
• ai-001AI tool inventoryv1.0 · 2026-01-10

  EU AI Act (Regulation 2024/1689)

  KonformPass · ai-001 Open source
• nis2-001MFA / backup / incident contact baselinev1.0 · 2026-01-10

  NIS2-Umsetzungsgesetz (Entwurf) / BSI-Empfehlungen

  KonformPass · nis2-001 Open source