Internal projects

Planning internal projects without a dedicated PMO

Software rollout, office move, certification, time recording or a new product line: internal initiatives often run alongside day-to-day business. Here is how to plan them so nothing important is missed.

Create a free plan Obligations by initiative

Basics

What are internal projects?

An internal project has no external client: the sponsor is your own company, usually management or a business unit. Typical examples change processes, systems or locations.

Especially in mid-sized companies there is rarely a dedicated project manager. Planning is done by someone who has another job, and the initiative competes with daily business for time and attention.

Aspect	Internal project	Client project
Sponsor	your own company	external client
Project lead	often on the side, changing	usually named
Budget	estimated internally, rarely tracked	fixed by quote and contract
Priority	competes with daily business	set by the delivery date
Typical risk	obligations and stakeholders are forgotten	change requests and delays

Examples

Typical internal initiatives

Each initiative comes with a complete sample plan created with PathHub AI, including obligations with lead times.

ERP rollout

Materials management, production, warehouse and data migration in one plan.

See the sample plan

SAP S/4HANA

Move from SAP ECC with test cycles, training and hypercare.

See the sample plan

CRM rollout

Sales at several sites, data migration and training.

See the sample plan

People

Time recording

Recording rules, works agreement and data protection.

See the sample plan

Operations

Office move

New workplaces, IT, safety instruction and moving while operating.

See the sample plan

Compliance

ISO 27001 certification

Gap analysis, measures, internal audit and certification audit.

See the sample plan

Compliance

NIS2 implementation

Registration, risk management and reporting processes.

See the sample plan

Website relaunch

CMS, accessibility, SEO migration and hosting.

See the sample plan

Cloud migration

Inventory, migration in waves, disaster recovery.

See the sample plan

Compliance

E-invoicing

XRechnung and ZUGFeRD, ERP integration and audit-proof archive.

See the sample plan

Compliance

Whistleblowing system

Internal reporting office with deadlines and data protection.

See the sample plan

People

Recruiting

Job ads, selection, works council and onboarding.

See the sample plan

Operations

Access control

Access and video surveillance with DPIA and works agreement.

See the sample plan

Strategy

New product line

Recipe, label, production and retail listing.

See the sample plan

Strategy

Online shop relaunch

Shop system, payment provider and accessibility.

See the sample plan

Root causes

Why internal projects fail

Rarely for lack of skill. Almost always because of things that get lost in daily business before the project really starts.

The remedy: a complete plan before you start, with clear roles, obligations and lead times.

Planning on the sideWhoever leads the initiative has a full day job. The plan comes late or not at all.
Unclear responsibilitiesNobody is explicitly accountable, so decisions stall.
Forgotten stakeholdersWorks council, data protection or purchasing are involved only when it is urgent.
Obligations with lead timeA works agreement, a data processing agreement or an audit date takes weeks. Starting late pushes the go-live.
No eye on the budgetInternal hours and external services are not tracked; deviations show up too late.

Approach

Planning internal projects in 6 steps

Set goal and scopeWhat should be different at the end, by when, with what budget? A SMART goal helps.SMART check
Clarify stakeholders and rolesWho decides, who does the work, who is consulted, who is informed?RACI generator
Check obligations and lead timesWhich laws, agreements and approvals does the initiative trigger, and how much lead time do they need?Obligations table
Plan phases, tasks and milestonesFrom kick-off to close, with realistic buffers and dependencies.Templates
Estimate budget and risksLine items instead of a lump sum, risks with mitigation and an owner.Risk matrix
Execute, track, learnCompare progress and costs regularly and capture lessons for the next initiative.Kanban board

Obligations

Which obligations typical internal initiatives trigger

This is how PathHub AI shows obligations in the plan (example: Germany): marked required or important, with lead time and, under “Rule & evidence”, the rule from the compliance library, its criteria and the consequences of a breach. “Statutory” means the obligation follows directly from the law. “Guide value” is a typical duration from practice. Not legal advice.

Update the record of processing activities and check whether a data protection impact assessment is needed (GDPR Art. 30, 35)

Required 2–4 weeks before go-liveguide value

Rule & evidence

Why: The new system processes personal data of customers or employees.

Rule from the compliance library

GDPR (General Data Protection Regulation)

Criteria

Legal basis for every processing of personal data (consent, contract, legal obligation, legitimate interest)
Complete record of processing activities (Art. 30) for all processes
Data Processing Agreements (DPA) with all sub-processors
Data Protection Impact Assessment (DPIA) for high-risk processing
Technical and organisational measures (TOM) documented

If breached: Fines up to €20 million or 4% of global annual revenue — whichever is higher. Plus civil damages claims by affected individuals.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Sign a data processing agreement with the provider (GDPR Art. 28)

Required 2–6 weeks before go-livestatutory

Rule & evidence

Why: The provider processes personal data on your behalf (cloud, maintenance, support).

Legal basis: GDPR Art. 28: the contract must be in place before processing starts, including tests with real data or data migration.

Rule from the compliance library

Cloud Contract Law

Criteria

Data Processing Agreement (DPA) with cloud provider
SLA with availability, RPO, RTO
Exit and portability clause
Data localisation and transfer mechanism (SCC / adequacy)

If breached: Civil claims for data loss; recourse depends on contract. GDPR fines for non-compliance.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Involve the works council and conclude a works agreement on the system (Sec. 87(1) No. 6 BetrVG)

Important 6–12 weeks before go-liveguide value

Rule & evidence

Why: Almost any software logs user actions and is therefore suitable for monitoring performance or behaviour.

Applies: only if a works council exists

Legal basis: Sec. 87(1) No. 6 Works Constitution Act: co-determination for technical systems suitable for monitoring behaviour or performance; suitability is enough. Without agreement the system must not be introduced.

Rule from the compliance library

Works Constitution Act (BetrVG)

Criteria

Enable works council election from 5 eligible employees upward
Co-determination on working time, monitoring systems, IT rollouts (§87)
Hearing before every dismissal (§102) — written with reasons
Balance-of-interests and social plan on operational changes (§111)

If breached: Dismissals without works council hearing are void. Administrative fines up to €10,000 per violation. Criminal liability (§119) for obstructing the works council up to 1 year imprisonment.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Ensure GoBD process documentation and audit-proof archiving, test e-invoicing

Important 4–8 weeks before go-liveguide value

Rule & evidence

Why: Tax-relevant data must be retained completely, unalterably and auditably, also after the system change.

Applies: if the system processes accounting or tax-relevant data (ERP, invoices, POS)

Rule from the compliance library

GoBD and e-invoicing

Criteria

Process documentation for all tax-relevant systems and procedures
Complete and unalterable records, changes are logged
Retention of tax-relevant documents for the statutory period (generally 8 or 10 years)
Data access for tax audits possible (Sec. 147(6) German Fiscal Code)
Receipt of structured e-invoices (XRechnung, ZUGFeRD) since 1 Jan 2025
Issuing e-invoices to domestic businesses: from 2027 for prior-year turnover above EUR 800,000, from 2028 generally for all (exceptions incl. small-amount invoices, small businesses)

If breached: Formal defects can lead to the bookkeeping being rejected and the tax base being estimated (Sec. 162 German Fiscal Code); refusing data access can trigger a delay penalty (Sec. 146(2c)).

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Define recording rules for start, end, breaks and overtime, including mobile work (ArbZG)

Required 2–4 weeks before go-livestatutory

Rule & evidence

Why: The system must reflect statutory maximum hours, breaks and rest periods.

Legal basis: Since the Federal Labour Court decision of 13 Sept 2022 (1 ABR 22/21) employers must record working time systematically; time beyond 8 hours must be recorded and kept for two years (Sec. 16(2) ArbZG).

Rule from the compliance library

Working Hours Act and time recording

Criteria

Maximum 8 hours per working day, up to 10 hours with compensation within 6 months or 24 weeks (Sec. 3 ArbZG)
Breaks: 30 minutes after 6 hours, 45 minutes after 9 hours (Sec. 4)
Rest period of at least 11 hours after work ends (Sec. 5)
Systematic recording of start, end and duration of working time (Federal Labour Court, 1 ABR 22/21)
Record time beyond 8 hours and keep records for at least two years (Sec. 16(2))

If breached: Administrative offences under Sec. 22 ArbZG with fines up to EUR 30,000; intentional violations endangering health are criminal offences under Sec. 23.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Conclude a works agreement on time recording with the works council

Important 6–12 weeks before go-liveguide value

Rule & evidence

Why: Time recording is a technical system that can reflect performance and behaviour.

Applies: only if a works council exists

Legal basis: Sec. 87(1) No. 2 and 6 BetrVG: co-determination on working time arrangements and technical monitoring systems.

Rule from the compliance library

Works Constitution Act (BetrVG)

Criteria

Enable works council election from 5 eligible employees upward
Co-determination on working time, monitoring systems, IT rollouts (§87)
Hearing before every dismissal (§102) — written with reasons
Balance-of-interests and social plan on operational changes (§111)

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Settle data protection for employee data: purpose, access rights, deletion periods, DPIA where needed

Required 2–4 weeks before go-liveguide value

Rule & evidence

Why: Time recording continuously processes personal data of all employees.

Rule from the compliance library

GDPR (General Data Protection Regulation)

Criteria

Legal basis for every processing of personal data (consent, contract, legal obligation, legitimate interest)
Complete record of processing activities (Art. 30) for all processes
Data Processing Agreements (DPA) with all sub-processors
Data Protection Impact Assessment (DPIA) for high-risk processing
Technical and organisational measures (TOM) documented

If breached: Fines up to €20 million or 4% of global annual revenue — whichever is higher. Plus civil damages claims by affected individuals.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Prepare and document the risk assessment of the new workplace (Sec. 3 ArbStättV)

Required 2–4 weeks before the movestatutory

Rule & evidence

Why: New premises mean new escape routes, lighting, ventilation and workstations.

Legal basis: Sec. 3 ArbStättV: the risk assessment must be documented before work begins.

Rule from the compliance library

Workplace Ordinance (ArbStättV)

Criteria

Workplace risk assessment documented before work begins (Sec. 3)
Escape and rescue routes, emergency exits and signage (ASR A2.3)
Lighting, ventilation and room temperature according to the ASR
Ergonomic display screen workstations
Sanitary, break and first-aid rooms according to headcount

If breached: Administrative offence with fines up to EUR 5,000 per violation (Sec. 9 ArbStättV with Sec. 25 ArbSchG); intentionally endangering life or health is a criminal offence.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Instruct employees at the new site on escape routes and procedures (Sec. 12 ArbSchG)

Required up to 1 week before the movestatutory

Rule & evidence

Why: Instruction is mandatory when working conditions change.

Legal basis: Sec. 12 ArbSchG: instruction on changes before work begins.

Rule from the compliance library

Occupational Health and Safety Act

Criteria

Risk assessment for every workstation (incl. psychological stress)
Instruction on hiring, after changes, after accidents — at least annually
Safety officer and company doctor appointed (DGUV V2)
First-aid responders (min. 5% of staff) trained

If breached: Fines up to EUR 30,000 per violation (Sec. 25 ArbSchG); persistent repetition or intentional endangerment: imprisonment up to one year or a fine (Sec. 26). Personal injury can additionally lead to criminal liability under the Criminal Code.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Inform the works council and attempt a reconciliation of interests on the relocation (Sec. 111 BetrVG)

Important 8–16 weeks before the moveguide value

Rule & evidence

Why: A relocation changes commutes, workstations and procedures.

Applies: if a works council exists; reconciliation of interests for relocating the establishment in companies with more than 20 eligible employees

Legal basis: Sec. 111 sentence 3 No. 2 BetrVG: relocating the establishment is an operational change; a reconciliation of interests must be attempted beforehand.

Rule from the compliance library

Works Constitution Act (BetrVG)

Criteria

Enable works council election from 5 eligible employees upward
Co-determination on working time, monitoring systems, IT rollouts (§87)
Hearing before every dismissal (§102) — written with reasons
Balance-of-interests and social plan on operational changes (§111)

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Move files and storage media in a data-protection-compliant way or have them destroyed according to DIN 66399

Important 1–2 weeks before the moveguide value

Rule & evidence

Why: During a move, documents with personal data pass through many hands.

Rule from the compliance library

GDPR (General Data Protection Regulation)

Criteria

Legal basis for every processing of personal data (consent, contract, legal obligation, legitimate interest)
Complete record of processing activities (Art. 30) for all processes
Data Processing Agreements (DPA) with all sub-processors
Data Protection Impact Assessment (DPIA) for high-risk processing
Technical and organisational measures (TOM) documented

If breached: Fines up to €20 million or 4% of global annual revenue — whichever is higher. Plus civil damages claims by affected individuals.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Sign a data processing agreement with the cloud provider and check third-country transfers

Required 2–6 weeks before go-livestatutory

Rule & evidence

Why: With the migration, the provider processes your personal data.

Legal basis: GDPR Art. 28: contract before processing starts, including before migrating real data; for providers outside the EU also secure third-country transfers (Art. 44 ff.).

Rule from the compliance library

Cloud Contract Law

Criteria

Data Processing Agreement (DPA) with cloud provider
SLA with availability, RPO, RTO
Exit and portability clause
Data localisation and transfer mechanism (SCC / adequacy)

If breached: Civil claims for data loss; recourse depends on contract. GDPR fines for non-compliance.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Update the record of processing activities and check whether a DPIA is needed (GDPR Art. 30, 35)

Required 2–4 weeks before go-liveguide value

Rule & evidence

Why: Storage locations, sub-processors and access paths change.

Rule from the compliance library

GDPR (General Data Protection Regulation)

Criteria

Legal basis for every processing of personal data (consent, contract, legal obligation, legitimate interest)
Complete record of processing activities (Art. 30) for all processes
Data Processing Agreements (DPA) with all sub-processors
Data Protection Impact Assessment (DPIA) for high-risk processing
Technical and organisational measures (TOM) documented

If breached: Fines up to €20 million or 4% of global annual revenue — whichever is higher. Plus civil damages claims by affected individuals.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Document risk management and supply chain security for the cloud service (NIS2)

Important 4–8 weeks before go-liveguide value

Rule & evidence

Why: NIS2 requires risks from service providers to be assessed and contractually covered.

Applies: if the company falls under NIS2 (e.g. from 50 employees or EUR 10m turnover in covered sectors)

Rule from the compliance library

NIS2 Directive

Criteria

Documented IT risk management reviewed annually
Business continuity plan and disaster recovery tested
Multi-factor authentication (MFA) for critical systems
Encryption of all sensitive data (at rest + in transit)
Supplier security reviews (supply chain security)
Annual cybersecurity training for all employees

If breached: Fines up to €10 million or 2% of global annual revenue. Personal liability of management for gross negligence.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Involve the works council and conclude a works agreement on the cloud services

Important 6–12 weeks before go-liveguide value

Rule & evidence

Why: Services such as Microsoft 365 record employees' usage data.

Applies: only if a works council exists

Legal basis: Sec. 87(1) No. 6 BetrVG: cloud services with logs and analytics are suitable for monitoring performance or behaviour.

Rule from the compliance library

Works Constitution Act (BetrVG)

Criteria

Enable works council election from 5 eligible employees upward
Co-determination on working time, monitoring systems, IT rollouts (§87)
Hearing before every dismissal (§102) — written with reasons
Balance-of-interests and social plan on operational changes (§111)

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Check job ads and selection process for non-discrimination (AGG)

Required 1–2 weeks before job ads are publishedstatutory

Rule & evidence

Why: Phrases like "young team" are frequent triggers of compensation claims.

Legal basis: Secs. 1, 7, 11 AGG: job ads must be free of discrimination; compensation claims must be raised within two months (Sec. 15(4)).

Rule from the compliance library

General Equal Treatment Act (AGG)

Criteria

Non-discriminatory job ads (m/f/d)
Structured, anonymisable selection process
Complaints office for discrimination set up (§13 AGG)
Training of all managers on AGG obligations

If breached: Damages up to 3 months' salary for non-hiring due to discrimination. Additional compensation for severe personality rights violations.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Process applicant data compliantly: GDPR Art. 13 information, delete rejected applications after about 6 months, consent for talent pools

Required 1–2 weeks before job ads are publishedguide value

Rule & evidence

Why: Applications may only be kept as long as AGG deadlines justify.

Rule from the compliance library

GDPR (General Data Protection Regulation)

Criteria

Legal basis for every processing of personal data (consent, contract, legal obligation, legitimate interest)
Complete record of processing activities (Art. 30) for all processes
Data Processing Agreements (DPA) with all sub-processors
Data Protection Impact Assessment (DPIA) for high-risk processing
Technical and organisational measures (TOM) documented

If breached: Fines up to €20 million or 4% of global annual revenue — whichever is higher. Plus civil damages claims by affected individuals.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Ask the works council for consent before each hire (Sec. 99 BetrVG)

Important 1–2 weeks before hiringstatutory

Rule & evidence

Why: Without consent or court replacement the person must not be employed.

Applies: if a works council exists and the company has more than 20 eligible employees

Legal basis: Sec. 99 BetrVG: works council consent to every hiring; it can object within one week.

Rule from the compliance library

Works Constitution Act (BetrVG)

Criteria

Enable works council election from 5 eligible employees upward
Co-determination on working time, monitoring systems, IT rollouts (§87)
Hearing before every dismissal (§102) — written with reasons
Balance-of-interests and social plan on operational changes (§111)

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Document essential working conditions on time (NachwG)

Required up to 1 week before hiringstatutory

Rule & evidence

Why: Missing or late documentation is subject to fines.

Legal basis: Sec. 2 NachwG: pay, working time and parties on the first working day, further information by the seventh calendar day, the rest within one month; text form possible since 2025.

Rule from the compliance library

Documentation of Employment Conditions Act (NachwG)

Criteria

Names and addresses of the parties, pay and working time on the first working day at the latest
Start, fixed term, place of work, duties, probation and rules on on-call work and overtime by the seventh calendar day
Other information (e.g. leave, dismissal procedure, references to collective agreements) within one month
Text form possible since 2025 if the document can be stored and printed and receipt is confirmed; written form on request
Written form still required in sectors under Sec. 2a of the Act to Combat Undeclared Work (e.g. construction, hospitality)

If breached: Administrative offence with fines up to EUR 2,000 per violation (Sec. 4 NachwG).

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Set up the internal reporting channel, appoint the responsible persons and define the process with deadlines (HinSchG)

Required 4–8 weeks before go-livestatutory

Rule & evidence

Why: The channel must work independently, confidentially and with fixed deadlines.

Legal basis: HinSchG: internal reporting channel from 50 employees; acknowledgement within 7 days, feedback within 3 months (Sec. 17); a missing channel is subject to fines.

Rule from the compliance library

Whistleblower Protection Act

Criteria

Internal reporting office set up — written, phone, in-person on request
Acknowledgement within 7 days, feedback within 3 months
Confidentiality of whistleblower identity guaranteed
Case files retained for 3 years

If breached: Fines up to €50,000 for missing reporting office. Obstructing a report or retaliation up to €500,000. Plus damages liability.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Define confidentiality, access rights and retention of reports, check whether a DPIA is needed

Required 2–4 weeks before go-liveguide value

Rule & evidence

Why: Reports contain highly sensitive data about whistleblowers and accused persons.

Rule from the compliance library

GDPR (General Data Protection Regulation)

Criteria

Legal basis for every processing of personal data (consent, contract, legal obligation, legitimate interest)
Complete record of processing activities (Art. 30) for all processes
Data Processing Agreements (DPA) with all sub-processors
Data Protection Impact Assessment (DPIA) for high-risk processing
Technical and organisational measures (TOM) documented

If breached: Fines up to €20 million or 4% of global annual revenue — whichever is higher. Plus civil damages claims by affected individuals.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Sign a data processing agreement with the platform provider or ombudsperson

Important 2–4 weeks before go-livestatutory

Rule & evidence

Why: External channels process the reports on your behalf.

Applies: if an external platform or ombudsperson is used

Legal basis: GDPR Art. 28: contract before processing starts.

Rule from the compliance library

Cloud Contract Law

Criteria

Data Processing Agreement (DPA) with cloud provider
SLA with availability, RPO, RTO
Exit and portability clause
Data localisation and transfer mechanism (SCC / adequacy)

If breached: Civil claims for data loss; recourse depends on contract. GDPR fines for non-compliance.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Involve the works council in the reporting procedure and platform

Important 4–8 weeks before go-liveguide value

Rule & evidence

Why: Procedural rules affect workplace conduct.

Applies: only if a works council exists

Legal basis: Depending on the design (conduct rules, technical platform), co-determination rights under Sec. 87(1) No. 1 and 6 BetrVG may apply.

Rule from the compliance library

Works Constitution Act (BetrVG)

Criteria

Enable works council election from 5 eligible employees upward
Co-determination on working time, monitoring systems, IT rollouts (§87)
Hearing before every dismissal (§102) — written with reasons
Balance-of-interests and social plan on operational changes (§111)

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Engage the certification body or auditor and fix the audit date (record standard and scope)

Required 2–4 months before the certification auditguide value

Rule & evidence

Why: Certification bodies and auditors are often booked months ahead; without a fixed date the whole initiative slips.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Run an internal audit or self-assessment against the standard and close nonconformities before the certification audit

Required 4–8 weeks before the certification auditguide value

Rule & evidence

Why: Common certification standards require internal audits; open nonconformities put the certificate at risk or lead to follow-up audits.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Create and check the label with mandatory particulars, allergens and nutrition values before printing (FIC Regulation)

Required 4–8 weeks before placing on the marketstatutory

Rule & evidence

Why: Faulty labels lead to recalls, and print lead times take weeks.

Legal basis: Reg. (EU) 1169/2011: mandatory particulars, emphasised allergens and nutrition declaration must be in place when placed on the market, online before purchase.

Rule from the compliance library

Food labelling (FIC Regulation)

Criteria

Mandatory particulars under Art. 9 complete
The 14 major allergens emphasised in the ingredients list (Annex II)
Nutrition declaration (Art. 30)
Minimum font size and legibility (Art. 13)
Mandatory information available before purchase in distance selling (Art. 14)

If breached: Fines under the LFGB and the national implementing ordinance, warning letters from competitors, withdrawal or recall of mislabelled goods.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Update and validate HACCP for the recipe and production process

Required 2–6 weeks before placing on the marketstatutory

Rule & evidence

Why: New ingredients and steps bring new hazards and critical control points.

Legal basis: Art. 5 Reg. (EC) 852/2004: HACCP must be updated for new products, recipes or processes before production.

Rule from the compliance library

Food hygiene and HACCP

Criteria

Establishment registered with the competent authority, significant changes notified (Art. 6 Reg. 852/2004)
HACCP: hazard analysis, critical control points, limits, monitoring, corrective actions, verification and records (Art. 5)
Hygiene training documented, instruction under Sec. 43 Infection Protection Act before first work
Traceability one step back and one step forward (Art. 18 Reg. 178/2002)
Cleaning and pest control plan

If breached: Fines and penalties under the German Food and Feed Code (LFGB), official orders up to closure, recalls.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Notify a new site or changed activity to the food control authority

Important 1–2 weeks before placing on the marketstatutory

Rule & evidence

Why: The authority must always know what is produced where.

Applies: if a new site is used or the activity changes significantly

Legal basis: Art. 6 Reg. (EC) 852/2004: establishments and significant changes in activity must be notified to the food control authority.

Rule from the compliance library

Food hygiene and HACCP

Criteria

Establishment registered with the competent authority, significant changes notified (Art. 6 Reg. 852/2004)
HACCP: hazard analysis, critical control points, limits, monitoring, corrective actions, verification and records (Art. 5)
Hygiene training documented, instruction under Sec. 43 Infection Protection Act before first work
Traceability one step back and one step forward (Art. 18 Reg. 178/2002)
Cleaning and pest control plan

If breached: Fines and penalties under the German Food and Feed Code (LFGB), official orders up to closure, recalls.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Important 1–2 weeks before placing on the marketstatutory

Rule & evidence

Why: Without registration, selling is prohibited.

Applies: if the product reaches private end consumers in packaging

Legal basis: Packaging Act: LUCID registration and system participation before first placing on the market.

Rule from the compliance library

Packaging Act

Criteria

Registration in the LUCID packaging register before placing on the market
System participation (licensing) of sales packaging subject to participation with a dual system
Identical volume reporting to LUCID and the dual system
Declaration of completeness when statutory volume thresholds are exceeded
Observance of take-back and deposit obligations (e.g. one-way deposit)

If breached: Sales and distribution ban for non-registration. Fines up to €200,000.

Evidence: In PathHub you tick off the criteria and attach evidence to each item as a file, link or note. Everything exports as a PDF evidence report.

Tools

Tools for internal projects

Project plan generatorFrom one sentence to a complete plan with obligations and lead times.Requirements spec generatorCapture requirements for vendors in a structured way.Free toolsRACI, risk matrix, Kanban, SMART check and more, with export.TemplatesProject charter, project plan, status report as Word and Excel.Case studies6 real AI project plans for typical initiatives.AI project managementWhat AI takes over in project management today and where its limits are.

FAQ

Frequently asked questions

What is an internal project?

An initiative a company carries out for itself, without an external client. Examples are introducing new software, an office move, a certification or a new product line.

Who should lead an internal project?

A named person with enough time and backing from management. Without a clear lead, decisions stall and the project only runs on the side.

Do internal projects need their own budget?

Yes. Even if most effort is internal hours, plan external services, licences and a buffer and track actual costs, otherwise deviations show up too late.

When does the works council need to be involved?

In Germany, if a works council exists: among others for technical systems that can monitor behaviour or performance (Sec. 87(1) No. 6 BetrVG), for operational changes such as relocations (Sec. 111 BetrVG) and for hiring (Sec. 99 BetrVG). In good time means before decisions are final.

How do I plan an internal project with AI?

Describe the initiative in one sentence. PathHub AI creates phases, tasks with owners, schedule, budget frame, risks, stakeholders and obligations with lead times. You can try it without sign-up.

What is your next initiative?

Describe it in one sentence. In a few minutes you have a complete plan, free and without sign-up.

Create a free plan →