What is compliance? Definition & meaning

What is compliance? Definition and meaning

What is compliance? The term refers to adherence to all laws, regulations, contracts, and self-imposed rules that apply to a company and its employees. The German term for it is Regelkonformität or Regeltreue. Compliance thus covers both the observance of external requirements – for example from data protection, employment, or competition law – and adherence to internal policies such as a code of conduct.

The term describes not only a state but also the entirety of the organizational measures with which a company ensures that rules are known and followed. These include policies, training, controls, and reporting channels.

Conformity to rules, duty of legality, and GRC

A number of fixed terms have become established around compliance. Regelkonformität and Regeltreue are the common German translations and are mostly used synonymously.

The duty of legality describes the responsibility of management to ensure that the company acts lawfully. It derives from the general management and due diligence responsibility of the corporate bodies – for example from the diligence of a prudent and conscientious manager under the Stock Corporation Act (AktG) or the managing director's duty of care under the Act on Limited Liability Companies (GmbHG). For management, compliance is therefore not an optional additional task but part of its organizational responsibility. In addition, Section 130 of the Act on Regulatory Offences (OWiG) governs the operational supervisory duty of business owners and company management – the provision is one of the central legal reasons why companies set up systematic compliance management.

GRC stands for governance, risk, and compliance. The term combines corporate governance, risk management, and adherence to rules as three closely interlinked management disciplines that many organizations think of together.

Why compliance matters for companies

Compliance brings order to a broad field of mandatory topics that would otherwise stand side by side. Data protection, information security, anti-money laundering, occupational health and safety, the protection of whistleblowers under the Act for the Better Protection of Whistleblowers (HinSchG), and the prohibition of discrimination based on the characteristics listed in Section 1 of the General Act on Equal Treatment (AGG) are typical sub-areas – each with its own rules and often its own training obligations. A systematic compliance approach bundles these topics, assigns responsibilities, and makes rules traceable in everyday work.

For small and medium-sized enterprises and public administration, this is less about a large set of rules than about knowing the relevant obligations, regularly raising employees' awareness, and being able to document adherence.

Compliance management system: ISO 37301 and IDW PS 980

Larger organizations structure their compliance through a compliance management system, or CMS for short. This is the organizational framework of principles, objectives, responsibilities, and measures for adherence to rules.

Two standards shape the German-speaking region. The international standard ISO 37301:2021 describes requirements for a compliance management system and is certifiable. The auditing standard IDW PS 980 of the Institute of Public Auditors in Germany sets out principles for auditing such systems and names compliance culture as a fundamental element. Both standards are frameworks for orientation – applying them is not mandatory. The Compliance section in Bridgly Knowledge provides an overview of further compliance topics.

What does compliance mean in simple terms?

Compliance means that a company adheres to all laws, regulations, and internal rules that apply to it. The German term for it is Regelkonformität. This refers both to the state of adherence to rules and to the organizational measures, such as policies, training, and controls, with which a company ensures that rules are known and followed.

What is the difference between compliance and GRC?

Compliance is adherence to laws and internal rules. GRC stands for governance, risk, and compliance and describes the overarching interplay of corporate governance, risk management, and adherence to rules as three closely interlinked management disciplines that many organizations think of and manage together. Compliance is therefore an important building block of GRC, not its replacement or synonym.

Who in the company is responsible for compliance?

Responsibility lies first with management: its duty of legality – for example under Section 93 AktG or Section 43 GmbHG – gives rise to the obligation to ensure lawful conduct throughout the entire company. In larger organizations, this task is additionally organized and documented through a compliance management system, designated compliance functions, and regular training for all employees.

Which topics typically belong to compliance?

Compliance includes, among other things, data protection, information security, anti-money laundering, occupational health and safety, the protection of whistleblowers under the HinSchG, and the prohibition of discrimination under the AGG. Each of these areas comes with its own rules, often also its own training and documentation obligations for employees, which a company-wide compliance management system bundles and makes traceable in everyday work.

• Stock Corporation Act, Sections 76, 91, and 93 AktG (management and duty of care of the management board) – gesetze-im-internet.de, as of 7 Jul 2026.
• Act on Limited Liability Companies, Section 43 GmbHG (duty of care of the managing director) – gesetze-im-internet.de, as of 7 Jul 2026.
• Act on Regulatory Offences, Section 130 OWiG (violation of the duty of supervision in businesses and companies) – gesetze-im-internet.de, as of 7 Jul 2026.
• Act for the Better Protection of Whistleblowers (HinSchG), in force since 2 Jul 2023 – gesetze-im-internet.de, as of 7 Jul 2026.
• General Act on Equal Treatment, Section 1 AGG (protected characteristics) – gesetze-im-internet.de, as of 7 Jul 2026.
• ISO 37301:2021, „Compliance management systems – Requirements with guidance for use", International Organization for Standardization – iso.org, as of 7 Jul 2026.
• IDW PS 980 n.F. (09.2022), „Grundsätze ordnungsmäßiger Prüfung von Compliance-Management-Systemen", Institute of Public Auditors in Germany – idw.de, as of 7 Jul 2026.
• Image license: AI-generated image (prompt see field „Bild-Prompt (KI-Bild)"), full usage rights held by Bridgly; labeled "Created with AI" as an image overlay in line with Art. 50 EU AI Act after image production.