Direct answer: the timeline depends on whether you implement stand-alone or integrate with ISO 27001, and on how complex your personal-data processing scenarios are. What is certain is the order of the stages: inventory and define roles first, then design controls, operate for a period to leave records, and only then enter certification.
Five stages, each depending on the last
- Scope and role definition: confirm which business activities and systems are included, and whether you are the PII controller or the PII processor in each scenario.
- Personal-data inventory and risk assessment: inventory the categories, flows and purposes of personal data, and assess risk on that basis.
- Control design and documentation: select the applicable controls by role and map them to the applicable regulations.
- Operation and internal audit: the system must actually run and leave records; complete the internal audit and management review.
- Certification audit: performed by the certification body.
What cannot be compressed: step 1 decides the target of every later control; step 4 needs real operating records that cannot be written up afterwards; step 5 depends on the certification body's schedule.
Winners' view
The step whose time is most often underestimated is step 2. Most companies discover during their first inventory that personal data is scattered across unmanaged systems and outsourced vendors; done thoroughly, this step keeps the later control design from being revised again and again. Companies that already hold ISO 27001 can combine step 4 with their existing internal audit and management review.
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.