Compliance refers to a company and its employees adhering to laws, regulations, standards and internal rules, as well as the organisational measures put in place to ensure such adherence. The term originates from English and literally means ‘adherence’ or ‘conformity’. In building management, compliance encompasses, amongst other things, operators’ obligations, energy and climate protection requirements, data protection and health and safety at work, compliance with which must be demonstrated in the event of doubt.
What does compliance mean in a business?
In Germany, there is no specific compliance law. The obligation arises from the management’s responsibility to ensure that the business operates lawfully. For members of the executive board, this stems from their duty of management and duty of care under the German Stock Corporation Act (Aktiengesetz); for managing directors of a limited liability company (GmbH), it stems from their duty of care under the German Limited Liability Companies Act (GmbH-Gesetz). Listed public limited companies must also establish an appropriate and effective internal control and risk management system.
In addition, there is the law on administrative offences: any business owner who fails to implement the necessary supervisory measures may be held liable if obligations are breached within the company. Many companies therefore consolidate their measures within a compliance management system, for which there is an international standard: ISO 37301.
Which compliance issues affect building operators?
For owners and operators of hotels, care homes, schools, clinics or office buildings, four areas are of particular importance:
- Operators’ responsibilities include the duty to operate buildings and technical installations safely, to carry out statutory inspections and to document these.
- Energy legislation – comprising the Building Energy Act, the Energy Efficiency Act and other regulations – sets out requirements regarding efficiency, building automation, energy audits and management systems, which often only apply once certain size or consumption thresholds are reached.
- Data protection becomes relevant as soon as systems process occupancy or usage data that can be linked to specific individuals.
- And for larger companies, sustainability reporting obligations also apply, such as those under the CSRD.
Which obligations apply in each individual case depends on the type of building, its size, legal form and use, and should be subject to legal review.
How do digital systems support compliance?
In practice, many obligations fail not because of a lack of goodwill, but because of a lack of evidence. Digital systems can ease the burden here, as they automatically record measurements, settings and events in a traceable manner. An energy monitoring system documents consumption comprehensively, whilst a building automation system logs setpoints and operating times. A CAFM system, in turn, keeps track of maintenance and inspection dates. This creates a database that is readily available for audits, enquiries from regulatory authorities or internal inspections.
However, it is important to consider the flip side: the systems themselves must comply with regulations, for example regarding data protection or data security. And no tool can replace the legal assessment of which obligations actually apply to a building.
Related terms
Sources and further information
- Betterspace: Betterspace, Regulatorik, ESG und Resilienz für Betreiber
- Betterspace: Gebäudeautomation für Unternehmen und Nichtwohngebäude
- Bundesministerium der Justiz: Aktiengesetz
- Bundesministerium der Justiz: Gesetz über Ordnungswidrigkeiten und GmbH-Gesetz
- International Organization for Standardization: ISO 37301 Compliance-Managementsysteme
- German Facility Management Association (GEFMA): Betreiberverantwortung