GRC software for compliance programmes:
27 providers with AI classification.

How can software support compliance programmes and whistleblowing systems?

Compliance programme software manages policies and codes of conduct with their versions and attestations, runs whistleblowing systems as the internal reporting office's channel and takes compliance cases from the first report to remediation. Depending on the provider, it also covers conflicts of interest, gifts, business partner checks or training. Four providers, mostly aimed at the financial sector, use AI to check calls and written communications, including marketing material, for possible compliance breaches.

• No specific AI function in the sources checked: 1 entry
• Only announced or in-development functions: 1 entry
• Documented AI use cases by topic, an entry can count more than once: Triaging incoming reports (8) · Answering compliance and policy questions (7) · Translating reports and case messages (5) · Analysing investigation cases (5) · Working on policy texts (2)
• Documented headquarters in Europe: 14 of 27 providers, headquarters not separately checked: 7

Questions for the demo, derived from the five criteria of the comparison:

• How are case handling, subject-matter decision and independent review separated in the access rights for whistleblowing cases?
• Where do findings from a closed case go: into a policy, a risk assessment or a measure?

Do small banks also need an internal reporting office?

Yes. For institutions within the meaning of Section 1(1b) KWG, the duty applies regardless of headcount (Section 12(3) no. 4 HinSchG). The office acknowledges receipt within seven days at the latest and gives feedback within three months of that acknowledgement (Section 17(1) no. 1 and (2)). Specific reporting procedures under Section 25a(1) KWG and Section 6(5) GwG take precedence where they set requirements (Section 4(1)).

When may AI keep a verbatim record of a whistleblowing call?

Only with the whistleblower's consent. Section 11(2) HinSchG does not distinguish between a person and software taking the record: a permanently retrievable audio recording or a complete and accurate transcript (verbatim record) is allowed only with that consent; otherwise the person in charge summarises the content. The whistleblower can review, correct and confirm the record, and an audio recording used to prepare it is deleted once the record is complete (Section 11(4)).

How often, and to whom, does the compliance function report under MaRisk?

At least once a year and whenever there is cause, to the management board, as AT 4.4.2 para. 6 of MaRisk (Circular 06/2026) requires. The report also points out deficiencies and countermeasures and is passed on to internal audit. The supervisory body receives it for information (AT 3.2 para. 2). At regular intervals and on a risk basis, the compliance function identifies the material legal rules and requirements whose non-compliance could endanger the institution's assets (AT 4.4.2 para. 2).

Which providers of GRC software for compliance programmes are headquartered in Germany, Austria or Switzerland?

Of the 27 providers, eight have a documented headquarters in Germany, Austria or Switzerland: in Germany Compliance Solutions, DHC Business Solutions, EQS Compliance Cockpit, lawcode and otris compliance SUITE; in Austria fobi solutions; in Switzerland Apiax (Behavox) and Wecan (SEALSQ). For seven further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

• Sections 4, 11, 12, 16 and 17 HinSchG (German Whistleblower Protection Act): internal reporting office for institutions without a headcount threshold, reporting channels, record-keeping, deadlines for acknowledgement and feedback, and precedence of specific procedures such as those under KWG and GwG (Source: gesetze-im-internet.de, in German)
• Art. 8 and 9 of Directive (EU) 2019/1937 (Whistleblowing Directive): internal reporting channels and procedures; the 50-worker threshold does not apply within the scope of the acts listed in Parts I.B and II of the Annex, which include financial services and anti-money laundering (Art. 8(4)) (Source: EUR-Lex)
• Section 25a(1) KWG (German Banking Act): an independent compliance function within the internal control system and a process through which staff can report breaches to appropriate bodies while the confidentiality of their identity is protected (Source: gesetze-im-internet.de, in German)
• MaRisk AT 4.4.2 and AT 3.2, BaFin Circular 06/2026 (BA): tasks, reporting line and reporting duty of the compliance function, with the report passed on to the supervisory body (Source: BaFin, in German)

Further reading on t-nex.de: Ninth MaRisk amendment, GRC software selection criteria, and T-NEX for compliance and AML teams.