External officers for businesses
cogito.consulting provides external officers in three areas. Only one of them is a role governed by law. This page explains the difference and leads to the service that fits.
Data protection, artificial intelligence and compliance are often mentioned in one breath, yet they rest on different legal foundations. The data protection officer is a role governed by Articles 37 to 39 GDPR: it must be appointed under certain conditions and carries its own statutory tasks. The AI officer and the compliance officer, by contrast, are organisational governance roles. They are not mandatory for ordinary businesses, but they bundle responsibility for duties that exist regardless — measures supporting AI literacy under the AI Regulation, and the management board’s duties of organisation and supervision in the compliance field. In all three cases the same applies: an external role does not take over the responsibility of the business. cogito.consulting is a brand of COGITO Gesellschaft für computergestützte Unternehmensorganisation mbH. Legal advice in individual cases and legal representation are provided by the law firm cogito.legal under a separate engagement.
Which role suits a business depends on its size, activity, regulatory environment and risk profile. The roles can be filled individually or in combination.
Governed by law
The data protection officer under Articles 37 to 39 GDPR informs, advises and monitors compliance with data protection law. In Germany, private-sector bodies generally appoint one where at least 20 people are constantly engaged in the automated processing of personal data; further mandatory cases apply irrespective of that figure.
External data protection officer Organisational role
The AI Regulation does not define an AI officer. It does, however, require providers and deployers to take measures supporting AI literacy, and effective human oversight for high-risk systems. A named role bundles these tasks and makes them demonstrable.
External AI officer Organisational role
Ordinary businesses are under no obligation to appoint a compliance officer. The management board must nonetheless organise and supervise operations properly. A compliance function coordinates risk analysis, policies, monitoring and reporting.
External compliance officerAs at August 2026.
Only the data protection officer. Article 37 GDPR and section 38 BDSG oblige many businesses to appoint one, in particular where at least 20 people are constantly engaged in automated processing of personal data or where a data protection impact assessment is required. The AI officer and the compliance officer are organisational roles with no general statutory duty to appoint. Different requirements may apply in individual regulated sectors, for instance the money laundering officer under section 7 GwG.
That is possible and common in smaller organisations, because the subjects overlap. What matters is the independence of the data protection officer: another role must not place them in a conflict of interest, and in particular they must not themselves decide on the purposes and means of processing personal data. The allocation of roles is therefore clarified before appointment.
No. In all three areas the business remains responsible — as controller or processor under data protection law, as provider or deployer under the AI Regulation, and through the management board’s duties of organisation and supervision in the compliance field. The external role advises, coordinates, monitors and documents; it does not decide in place of the business and does not implement measures operationally.
COGITO Gesellschaft für computergestützte Unternehmensorganisation mbH, which operates as a management consultancy under the cogito.consulting brand and has supported digital projects since 1987. The same brand is used by the legally independent law firm cogito.legal, which holds it under licence and provides legal advice and representation.
With a structured review of the area in question: which processing activities, systems, processes and responsibilities exist, and what duties follow from them. The result is a prioritised overview with concrete measures. On that basis it is decided whether and to what extent ongoing external support makes sense.
Malte Rheingans
Managing Director, cogito.consulting
All three roles are coordinated from one place. For matters requiring legal advice, the law firm cogito.legal is available.
Legal services are provided exclusively through the law firm cogito.legal. No legal advice is offered on this page.
Management consultancy
We have supported digital and organisational projects since 1987. Today we advise in particular on data protection, AI governance and corporate compliance, and provide external data protection, AI and compliance functions.
cogito.consulting Legal services
A commercial law firm working exclusively for businesses. Legal advice, contract drafting and representation, in particular on data protection, AI, compliance and digital business models.
cogito.legal Shared brand
Under the cogito brand, a specialised management consultancy and a commercial law firm work side by side – separate in law, joined in practice.
cogito.deNot sure which role fits your business? Describe your situation and we will come back to you.
COGITO Gesellschaft für computergestützte