Can a compliance programme let the company argue it did its best to prevent a breach?

The law leaves room for this: the proviso in Article 13-4 of the Trade Secrets Act, which Taiwan's Intellectual Property Office says a company can invoke by showing it has implemented a compliance programme; Article 50 of the Personal Data Protection Act, which spares representatives who can show they fulfilled the duty to prevent; and the adequate-procedures defence in section 7 of the UK Bribery Act. Whether it succeeds depends on records and is for legal counsel to judge case by case.

What does a whistleblowing system need?

For listed companies, Article 23 of the Ethical Corporate Management Best Practice Principles: confidentiality of the whistleblower's identity and report, anonymous reports, protection from improper treatment, investigation procedures and kept records; ESG indicator S-9 requires disclosure on the company website. EU subsidiaries with 50 or more workers also need internal reporting channels under the Whistleblower Directive.

When customers ask us to sign security, privacy, AI or anti-bribery clauses, what should the General Counsel check first?

Whether the promises can be kept: audit rights, notification deadlines and obligations to flow down to our own suppliers need a system and records behind them. For example, Article 28(3) GDPR requires processors to allow for and contribute to audits by the controller; listed companies' contracts should include integrity and termination clauses under Article 9 of the Ethical Corporate Management Best Practice Principles. What liability caps and indemnities are acceptable is for legal counsel to judge case by case.

If we hold ISO certificates, are we compliant with EU law?

No. GDPR, NIS2 and the EU CRA have no standalone certificate: GDPR compliance is shown through records of processing, DPIAs, processor contracts, transfer mechanisms and breach records; the EU CRA needs conformity assessment by product category and CE marking. ISO 42001 certification is not EU AI Act compliance either.

What laws and standards is a General Counsel or Chief Compliance Officer accountable for? 10 requirements explained

Direct answer: in most companies, General Counsel or Chief Compliance Officer is not a statutory title. Among the Taiwanese rules reviewed for this page, three roles are written down: the corporate governance officer of a listed company (one route to qualify is at least three years as head of a legal, compliance or similar unit), the dedicated ethical-management unit and whistleblowing system, and the chief compliance officer of a bank or financial holding company. What the General Counsel really has to decide is what evidence the company can produce, when it is investigated, prosecuted or sued by a customer, to show that it did what it could to prevent the breach: Article 13-4 of the Trade Secrets Act and Article 50 of the Personal Data Protection Act both contain such a proviso, and section 7 of the UK Bribery Act has an adequate-procedures defence. The second is contracts: the security, privacy, AI and anti-bribery clauses customers ask for, including liability caps, indemnities and audit rights, have to match what the company can actually do. GDPR, NIS2 and the EU CRA have no standalone certificate, and an ISO certificate is not legal compliance. Whether liability arises is for legal counsel to judge case by case.

The General Counsel and compliance officer in corporate governance: roles and responsibilities in writing

Who	Rule	Key wording	What it means for the General Counsel
Listed companies	Corporate Governance Best-Practice Principles for TWSE/TPEx Listed Companies, Article 3-1	Appoint one corporate governance officer as required by the regulator; qualified as a lawyer or CPA, or with at least three years as head of a legal, compliance, internal audit, finance, shareholder services or corporate governance unit at a securities, finance or futures institution or a public company; duties include helping directors comply with laws	Legal or compliance heads are typical candidates; keep this role distinct from board support duties
Listed companies	Corporate Governance Best-Practice Principles, Article 30	Should engage qualified lawyers to provide appropriate legal advice to the company	How outside counsel is engaged and work is split
Listed companies	Ethical Corporate Management Best Practice Principles for TWSE/TPEx Listed Companies, Article 9	Before dealing, consider the legality of counterparties and whether they have engaged in unethical conduct; contracts shall include compliance with the ethical management policy and a right to terminate or rescind at any time if the counterparty engages in unethical conduct	Required clauses in agent, supplier and customer contracts
Listed companies	Ethical Corporate Management Best Practice Principles, Articles 17, 20 and 23	A dedicated unit under the board reports to the board at least once a year; internal audit plans audits based on the risk of unethical conduct and may engage a CPA; whistleblower identity is kept confidential, anonymous reports are allowed and whistleblowers are protected from improper treatment	Who owns ethical management and whistleblowing, and how records are kept
Public companies	Regulations Governing Establishment of Internal Control Systems by Public Companies, Article 3	The objectives of internal control include compliance with applicable laws and regulations	Compliance is an internal control objective, not a separate system
Banks and financial holding companies	Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries, Articles 16 and 54	Set up a dedicated compliance unit reporting to the president and appoint a chief compliance officer at senior vice president level or equivalent, reporting at least every six months to the board and supervisors or audit committee; adjust to comply by 31 December 2027	Compliance heads in banking have a set rank and reporting frequency
All companies	Trade Secrets Act, Article 13-4; Personal Data Protection Act, Article 50	A company is not fined if its representative did their best to prevent the offence; representatives of a non-government entity are fined the same amount unless they can show they fulfilled the duty to prevent	"Did our best to prevent" needs a system and records
Private legal entities in the EU with 50 or more workers	EU Whistleblower Directive (EU) 2019/1937, Articles 8 and 9	Establish internal reporting channels and procedures; acknowledge receipt within seven days and give feedback within three months	EU subsidiaries' reporting channels must meet the transposing law of their Member State

Rules for public and listed companies do not apply to non-public companies, which may follow them voluntarily. The chief compliance officer rule applies to banks and financial holding companies; for other financial sectors, follow the text of their own rules. "General Counsel" is not a title used in any of the rules above. Partial amendments to the Personal Data Protection Act promulgated on 11 November 2025 take effect on a date set by the Executive Yuan; until then the current text applies.

TWSE ESG evaluation: indicators the General Counsel should watch

From 2026 the ESG evaluation replaces the corporate governance evaluation and covers listed companies. The first round (2026) has 75 indicators across three dimensions, with results published by the end of April 2027; the 2027 indicators were published on 30 October 2026. Apart from S-7, the wording below is the same in both years.

Indicator	Content (summary)	Bonus	Related service
S-7	Board-approved ethical management policy, a dedicated (or part-time) unit, how it is implemented, and a report to the board at least once a year (2027 wording; 2026 splits it into S-7 and S-8)	—	ISO 37001
S-9	Detailed disclosure on the company website of the whistleblowing system for insiders and outsiders on illegal (including corrupt) and unethical conduct	—	ISO 37001
S-13	A personal data protection policy and how it is implemented	—	GDPR, ISO 27701
S-15	A supplier management policy requiring suppliers to follow rules on topics such as information security and privacy	—	TISAX, NIS2
S-10	An IP management plan linked to business goals and its implementation, reported to the board at least once a year	One extra point for third-party certification to TIPS, ISO 56001 or a similar standard	Trade secret protection
G-18	Risk management overseen by the audit committee or a board-level functional committee, reported to the board at least once a year	AA item; one extra point if met	ERM

The whistleblowing system in S-9 and the dedicated unit in S-7 are exactly what Articles 17 and 23 of the Ethical Corporate Management Best Practice Principles require, and they usually sit with the legal or compliance function. Non-public companies are not evaluated but may use the indicators voluntarily.

The 10 requirements at a glance

EU regulation (5)

Requirement	What it means for the General Counsel	Certificate?
GDPR and ISO 27701	Fines up to EUR 20 million or 4% of worldwide annual turnover; processor contracts and transfer mechanisms with EU customers	ISO 27701 yes; GDPR has no official certificate
EU CRA	Who is the legal manufacturer and how ODM and OEM contracts split liability; Article 14 reporting has applied since 11 September 2026	No standalone certificate; conformity assessment by product category and CE marking
EU AI Act and ISO 42001	Provider or deployer role, AI supply contracts; fines up to EUR 35 million or 7% of worldwide annual turnover	ISO 42001 yes; not EU AI Act compliance
NIS2	Management body liability for entities in scope; as a supplier only, requirements reach you through customer contracts	No
DORA	ICT providers serving EU financial entities take on audit rights, data portability, business continuity and exit strategy clauses in contracts	No

Management systems and programmes (5)

Requirement	What it means for the General Counsel	Certificate?
ISO 37001	Records that anti-bribery procedures run; anti-bribery clauses in agent and customer contracts	Yes, third-party certification; does not guarantee no bribery
Trade secret protection	Whether a court will find reasonable secrecy measures when you sue; company liability when a new hire brings in someone else's secrets	The Trade Secrets Act has no certificate
ERM (compliance risk)	Compliance risk on the same risk map and in the same board report	No
TISAX	Carmakers assess suppliers' sites for information security, often written into contracts with confidentiality requirements	Assessment and exchange mechanism, not an ISO certificate; results shared as labels, valid 3 years
ISO 27001	Security clauses, audit rights and incident liability in customer contracts need a system behind them	Yes, third-party certification

One by one: what the General Counsel decides, what comes first, how long it takes

Each service has its own page that answers your role’s questions one by one.

How this fits your existing systems

New requirements should be folded into existing internal control, ethical management, risk management and compliance systems, not built as a separate set.

Existing system and basis	What you already have	How the new requirements fit in
Internal control regulations, Article 3	Internal control with compliance as one objective, and the annual self-assessment	Map EU and management-system obligations to control points in existing cycles and include them in the self-assessment and audit plan
Ethical Corporate Management Best Practice Principles, Article 9	Counterparty assessment and integrity clauses in contracts	Fold ISO 37001 third-party due diligence and anti-bribery clauses into the same assessment and contract templates
Ethical Corporate Management Best Practice Principles, Articles 17 and 23	A dedicated unit, an annual report to the board, a whistleblowing system	Route bribery, trade secret and privacy reports and investigations through the same channel and procedure
Risk Management Best Practice Principles, Article 18	A compliance risk category	Put GDPR, NIS2, EU CRA and EU AI Act fines and market access on the same risk map
Implementation Rules, Articles 16 and 17 (banks and financial holding companies)	A dedicated compliance unit, six-monthly reports and self-assessments	Fold compliance assessments for EU rules and ISO systems into the existing compliance self-assessment and reports

These rules apply to public companies, listed companies or banks and financial holding companies; non-public companies are not bound by them and may follow them voluntarily. For the work on each item, see ISO 37001, trade secret protection, GDPR, EU CRA, EU AI Act and ERM.

How Winners Consulting works

This is Winners Consulting's own account. Test us, and any other consultant, with the questions above.

Who leads: VP- and director-level consultants run every engagement personally and do not outsource; the team holds ISO lead auditor qualifications
Applicability first: we confirm customer, tender, regulator and export-market requirements, decide which laws and standards really apply, then set the scope
Contracts matched to the system: for example, reviewing GDPR standard contractual clauses and keeping cross-border transfer records; four sets of trade secret confidentiality templates for joining, employment, leaving and third parties; EU CRA ODM contracts that set scope, support period and reporting-cooperation deadlines
Division of work: we build the system and the chain of evidence; legal opinions come from partner lawyers; certification is done by a third-party certification body, and we accompany you without auditing on its behalf
First step: the first mechanism diagnosis is free

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.