The call comes on a Tuesday afternoon. A customer does not pay, invokes a clause in their own terms and conditions, and asks whose terms actually apply. No one in the company can answer that. The order has long since been executed, the material paid for, and a six-digit amount is outstanding in the accounting system. The crucial error is fourteen months old at this point, and occurred during the order confirmation.
This is how legal problems in the SME sector almost always arise. They arise quietly, in a decision that no one perceives as a legal decision, and they become visible when the scope for action has already been exhausted. That is precisely why legal prevention is not a luxury issue for corporations but a business management issue.
clience.legal is a digital business law firm for entrepreneurs. We advise managing directors not only in the event of a dispute, but also before decisions are made, keeping your obligations, liability, and financial goals in mind at all times. This article highlights the seven risk areas that most often become costly in the SME sector, and the measures that prevent damage in advance.
The most important information at a glance
- Prevention is a duty, not an option: § 43 GmbHG requires the managing director to exercise the due care of a prudent businessperson, and § 1 StaRUG requires ongoing monitoring of developments that threaten the company’s continued existence.
- Organizational fault means personal liability: Anyone who does not organize their company in a way that prevents violations is liable under § 43(2) GmbHG and risks fines under §§ 130, 30 OWiG.
- The most expensive mistakes are inconspicuous: A missing defensive clause, a missed notification, or a payment made after the onset of illiquidity costs more than any legal fee.
- Know the thresholds: Internal reporting channel from fifty employees, duty to file for insolvency within three or six weeks, data protection fines of up to four percent of worldwide annual turnover.
- Pay attention to the cascade: Even companies that are not directly bound by regulations also receive sustainability and compliance requirements through the contracts of their large customers.
- Documentation is half the defense: In the event of liability, it doesn’t matter what you did, but what you can prove.
Why prevention is the cheaper route
Legal advice is often understood by many companies as a repair service. Something goes wrong, and the law firm repairs it. This view regularly leads to a mismatch: The cost of the repair exceeds the cost of the preventive measure many times over, and the result is still worse.
The reason lies in the order of things. Before the signature, every clause is negotiable, every risk is deferrable, and every wording is open to interpretation. After the signature, the framework is fixed, and the legal work consists of making the best possible out of a bad starting position. In addition, there are costs that do not appear in any invoice: tied lead time, delayed projects, and damaged customer relationships.
Prevention does not mean excluding every risk. Entrepreneurial action remains risky, and the law recognizes this. The point is to take risks consciously rather than unknowingly, and to document the decision in a traceable way. We describe how this is organized in day-to-day operations under external legal department.
How to recognize when it’s time
A few signals appear repeatedly in consultation sessions. If several of them apply to your company, the need for action is real and not theoretical.
- No one can say offhand which version of the company’s own terms is currently being used in sales.
- Notice periods of ongoing contracts are only noticed once the automatic renewal has already taken effect.
- Customer questions on data protection, compliance, or the supply chain are researched from scratch every time.
- Liquidity planning only extends a few weeks into the future or exists only in management’s head.
- Decisions on liability and warranty are made spontaneously during sales negotiations.
- There is no overview of who is allowed to sign what in the company.
Each of these points can be remedied with manageable effort. Together, they paint the picture of a company in which legal decisions are left to chance, and chance is the most expensive form of risk management.
The seven risk areas in medium-sized companies
1. Contracts and Terms
The most common risk and at the same time the easiest to avoid. Typical sources of error are conflicting terms and conditions, missing limitations of liability, unclear specifications of services, and contracts that were freely modified by sales. The preventive measure is unspectacular: vetted contract templates with defined negotiating margins, an overview of contract terms and notice periods, and clear approval rules. We lay the groundwork for this in our Drafting of contracts and T&Cs.
The question of whose terms apply when sets of terms conflict is particularly underestimated. Under German law, neither side prevails completely in such cases; instead, the conflicting provisions drop out and the statutory rules apply. Precisely the points one wanted to regulate are then left unregulated. A defensive clause and a deliberate approach to the other side’s purchasing terms solve this problem in advance.
2. Duties and liability of management
§ 43(1) GmbHG requires the managing director to exercise the due care of a prudent businessperson; paragraph 2 makes him personally liable for damages in the event of a breach. This liability applies not only to wrong decisions but also to deficient organization. Anyone who delegates tasks must select, instruct, and supervise. The preventive measure consists of a written allocation of management responsibilities, documented decision-making grounds for major projects, and a regular review of one’s own duties. For more detail, see our overview of personal liability in GmbH and UG and the current developments in managing directors’ liability.
3. Liquidity and early detection of crises
This is where the most serious personal risk lies. § 1 StaRUG requires ongoing monitoring of developments that threaten the company’s continued existence. If illiquidity or over-indebtedness occurs, the duty to file for insolvency under § 15a InsO applies, with a deadline of three weeks for illiquidity and six weeks for over-indebtedness. Payments made thereafter trigger the duty to reimburse under § 15b InsO. In addition, § 49(3) GmbHG requires the managing director to convene a shareholders’ meeting if half of the share capital has been lost. The preventive measure is rolling liquidity planning with fixed key figures and defined thresholds at which action is taken. We show how such a system is set up in our crisis early detection under the StaRUG.
4. Personnel and social security contributions
Employment law issues rarely threaten a company’s existence, with one exception: if social security contributions are not paid, managing directors face personal criminal liability under § 266a StGB, and management is liable for taxes under § 69 AO. Bogus self-employment among long-standing freelancers is also underestimated, because back payments are claimed retroactively. The preventive measure includes a review of the contractual relationships, clean contract templates, and, in case of doubt, a status determination procedure.
5. Data protection and IT security
The General Data Protection Regulation allows fines of up to twenty million euros or four percent of worldwide annual turnover. In practice, problems rarely arise from major data breaches, but from data subject requests, incomplete records of processing activities, and missing data processing agreements. The preventive measure is a structured self-check covering the points that are noticed first in audits, supplemented by a defined procedure for requests and security incidents.
Then there is the time factor. Data subject requests must generally be answered within one month, and reportable security incidents must be reported within 72 hours. Those who only design these procedures once an incident occurs lose the crucial first hours. A prepared response plan with designated responsible persons costs little and works exactly when it matters.
6. Supply chain and sustainability
The Supply Chain Due Diligence Act applies directly to companies with a thousand or more employees in Germany. The reporting obligation to the supervisory authority has been abolished; risk analysis, preventive measures, complaints procedures, and documentation remain. At the European level, the EU supply chain directive was significantly slimmed down by the omnibus package and will in future mainly apply to very large companies. For smaller businesses, this is no reason to relax, because the requirements reach them through the contracts of large customers and through tenders. Anyone who cannot provide proof loses the contract. More on this under Supply Chain Due Diligence Act (LkSG) and sustainability obligations.
7. Artificial Intelligence in the workplace
AI tools have long been in use, mostly without internal rules. This creates three risks: confidential data leaking into external systems, unclear rights to generated content, and liability for erroneous results that were used without review. In addition, there are the obligations under the EU AI Act, whose requirements are taking effect in stages. The preventive measure is a written usage policy with a list of approved tools, data protection rules, and a binding duty to review results before use. We support this as part of our legally compliant use of AI.
Who in the company takes responsibility for prevention
In larger companies, there are dedicated functions for this purpose. In medium-sized companies, responsibility is almost always with the management, and that is precisely the bottleneck. Legal issues compete with sales, production, and personnel there, and they regularly lose this competition because they rarely have urgent impact.
The practical solution consists of three elements. First, a designated person within the company who keeps track of everything without having to make legal decisions themselves. Second, a fixed meeting at which open issues are reviewed, usually quarterly and for no longer than an hour. Third, an attorney as contact person who knows the issues and can respond without needing time to get up to speed.
This structure costs little and noticeably changes the dynamics. Questions are asked before they become costly, because the path to getting there is short. In practice, the number of conflicts decreases significantly in the second year, because the recurring sources of error are eliminated by then.
The prevention cycle in four steps
Prevention rarely fails due to knowledge, and almost always due to implementation. A simple cycle keeps the effort manageable.
- Taking stock: Identify which contracts exist, what obligations you have, and where legal decisions are made within the company. This overview is lacking in most businesses and is the basis for everything else.
- Prioritization: Evaluate each field according to its probability of occurrence and the level of damage. Existential risks are addressed first, even if other issues appear more urgent.
- Measures: For each risk, determine a specific action with a responsible person and a deadline. Any declaration of intent without a name and date will not be implemented.
- Documentation and repetition: Keep track of what has been decided and implemented, and review the overview annually. In the event of liability, this documentation determines your defense position.
Beyond a certain size, it pays to turn this cycle into a formal system. We describe what such a system must achieve under Compliance management systems. In addition, companies with fifty or more employees need an internal reporting channel, on which you can find more information under Whistleblower systems and ISO 37301 .
What prevention costs and what it saves
For most medium-sized companies, an initial review takes a few days. After that, ongoing maintenance is required, which is significantly less work. On the other side is the cost of a single conflict: attorney and court fees, tied-up management time, provisions, delayed projects, and in the worst case, the managing director being held personally liable.
In almost all cases, the math works out in favor of prevention, because it not only avoids costs but also preserves the ability to act. A company with orderly contracts can negotiate faster, calculate more reliably, and submit the required proof in tenders. In a sale or succession, the same order has a direct effect on the price. The professional framework for this is our advice on Compliance and managing director liability.
Three mistakes that make prevention ineffective
The first mistake is the paper project. Guidelines, manuals, and forms are created that no one reads and that have no effect in day-to-day business. In a liability case, documentation that was clearly not put into practice can even be incriminating, because it shows that the risk was known.
The second mistake is the completeness trap. Anyone who wants to work on all areas at the same time gets nowhere. It makes more sense to start with the area in which the greatest damage can occur and to put the remaining topics in an order that is worked through over twelve months.
The third mistake is the lack of accountability. As long as a measure does not have a name and a date, it remains a declaration of intent. Instead, determine who is responsible, by when something is ready, and who will verify the implementation. In smaller companies, a single table is sufficient, reviewed twice a year. Those who address these six points have already reduced most of the risk. For a broader framework, see our overview of online coaching law.
Getting started with prevention is easier than it seems. Tell us your industry, the size of your company, and the three issues that make you most uneasy. We will assess which obligations actually apply to you, where there is an urgent need for action, and what can wait. To do so, schedule an free initial consultation of 15 to 20 minutes.
FAQs
What does legal prevention in the company actually mean?
Legal prevention means resolving legal issues before making a decision rather than after the conflict has arisen. This includes tested contract templates, an overview of deadlines and obligations, clear responsibilities, and comprehensible documentation. The goal is not to avoid every risk, but to consciously decide which risk the company bears. The initial effort is a few days, and thereafter it is part of ongoing maintenance operations.
Am I required as a managing director to monitor risks?
Yes. Section 43(1) of the GmbHG requires the diligence of a proper businessperson, and Section 1 of the StaRUG requires the management to continuously monitor developments that could endanger the business and take appropriate countermeasures. If this duty is violated, personal liability under Section 43(2) of the GmbHG may apply. Monitoring must be tailored to the company; a simple but documented process is sufficient in smaller businesses.
What is organizational fault?
Organizational fault refers to cases in which damage is not due to a single wrong decision, but to the fact that the company was not organized in a way that prevents violations. Tasks may be delegated, but selection, instruction, and supervision remain the responsibility of management. § 130 OWiG provides for a fine of up to one million euros for breaches of supervisory duties, and § 30 OWiG additionally allows a fine to be imposed on the company itself.
When do I need a compliance management system?
There is no fixed legal threshold. A formal system becomes useful once multiple locations, many employees, regulated activities, or clients with their own requirements come together. In smaller companies, documented guidelines, clear responsibilities, and an annual review are often sufficient. What is crucial is not the extent of the documents, but that the rules are actually applied in everyday life.
From what size must I set up an internal reporting system?
The Whistleblower Protection Act requires companies with fifty or more employees to establish an internal reporting mechanism. It must receive confidential reports, acknowledge receipt, take follow-up action, and operate in a documented manner. The task can be assigned internally or transferred to an external third party. Typical errors occur less frequently during setup than during ongoing operations, for example regarding deadlines and the protection of the reporting person.
What deadlines apply in the event of impending illiquidity?
Once illiquidity occurs, the petition for insolvency must be filed under § 15a InsO without culpable delay, at the latest within three weeks; in the case of over-indebtedness, at the latest within six weeks. These are maximum periods and may not be exhausted if restructuring is clearly hopeless. Payments made after insolvency has occurred trigger a duty to reimburse under § 15b InsO. Restructuring instruments that can avoid a filing are already available at the stage of impending illiquidity.
Does the Supply Chain Due Diligence Act also apply to smaller companies?
Companies with a thousand or more employees in Germany are directly bound. However, smaller businesses are indirectly affected, because large customers pass on their requirements contractually and demand proof in tenders. The reporting obligation to the supervisory authority has been abolished; the due diligence obligations of the companies in scope remain. It therefore makes economic sense for suppliers to keep the required proof available, even without a legal obligation of their own.
How do I regulate the use of AI tools in the company?
A written usage policy with three components makes sense: a list of approved tools, clear rules on which data may be entered, and a binding duty to review results before they are used. In addition, rights to generated content and disclosure to customers should be regulated. On top of this come the obligations under the EU AI Act, which are taking effect in stages.
How do I document prevention measures correctly?
Keep track of which risks were identified, which decision was made, on what basis, and by whom it was implemented. A concise report with date and responsible party is sufficient in most cases. Regularity is important, because a one-time inventory review loses its value after a short time. In the event of liability, this documentation determines whether you can prove that you acted carefully.
When is an attorney for legal prevention worth it?
As soon as legal decisions arise regularly and are made on the side, legal support pays off. We review your obligations, bring contracts and terms into a robust form, and set up the processes that will support your defense if it comes to it. The economic leverage lies in the conflicts that never arise and in the personal liability you keep away from yourself. Those who only call once a dispute has arisen usually pay significantly more for a worse result.
