Board Decision: Compliance Officer Mandate 

Facts/Problem 

Following the 2026 Board election, the Board continues with a reduced composition of six members and therefore a limited capacity to directly cover all previous fields of responsibility at Board level. During the previous term, responsibilities related to ethical compliance, legal and regulatory monitoring, conflict of interest frameworks, trusted reporting mechanisms, and representation in European regulatory working groups were actively managed and require continuity.

These topics are increasingly relevant due to evolving European regulation (for example cybersecurity, digital compliance, accessibility, AI-related regulation), growing governance expectations for mature open-source organizations, and the need to maintain trusted internal processes.

Keeping all operational ownership of these topics within a lean Board risks capacity constraints, delays, and loss of continuity. A dedicated mandate outside the Board structure would allow continuity of expertise while preserving the Board's strategic focus and collective accountability.

Objective 

The decision should establish a dedicated Compliance Officer mandate in order to:

• ensure continuity of ethical and legal compliance responsibilities previously handled at Board level
• strengthen the Association's readiness for relevant European regulatory developments
• maintain and improve frameworks related to conflicts of interest, trusted reporting, and institutional trust
• preserve TYPO3's active representation in relevant external working groups and policy discussions
• reduce operational workload on a six-member Board
• allow the Board to focus on strategic leadership while retaining collective oversight

If approved, the Association gains a clearer operating model, better continuity, and stronger institutional resilience.

Obligations to cooperate 

The following parties are directly concerned and should cooperate as needed:

• Board (mandate owner, annual review, strategic oversight, prioritization)
• Compliance Officer (execution of mandate, reporting, recommendations, external representation)
• Ombudsperson Group (trusted reporting mechanisms, process feedback, coordination where relevant)
• DPO and other mandate holders (cooperation on overlapping legal/compliance topics)
• TYPO3 GmbH representatives where topics require coordination
• Relevant committees or working groups

The decision positively affects the wider Association membership through stronger trust, continuity, and regulatory preparedness.

Financial and human resources impacts 

No additional headcount is required.

A compliance-related budget line already exists. It is proposed to fund the mandate through:

1. existing compliance budget allocation; and
2. reallocation of the remaining three quarters of the Board compensation previously budgeted for the former Board mandate holder.

Under this model, no additional unplanned expense would be created for the 2026 budget.

Long-term costs remain controllable and can be reviewed annually through the standard review and outcome agreement process.

Resolution/Petitum 

The Board resolves to create the mandate of Compliance Officer for the TYPO3 Association with effect from 22 of April 2026.

The Board further resolves to appoint Rachel Foucard to this mandate for an initial term ending on [21 of April 2029], subject to annual review.

The mandate shall cover the scope, responsibilities, governance framework, and reporting duties as defined in the attached 2026 04 Compliance Officer Mandate, which forms an integral part of this decision.

The Board retains collective responsibility and oversight for all matters within the mandate.

Funding for 2026 shall be covered through the existing compliance budget and reallocation of the remaining three quarters of the previously budgeted Board compensation.

Discarded alternatives 

• Keep all responsibilities within the Board. Discarded because a six-member Board has limited operational capacity and should prioritize strategic leadership.
• Redistribute responsibilities among existing Board members. Discarded because this increases workload concentration and risks inconsistent continuity.
• Create multiple smaller mandates. Discarded because it would add complexity, coordination overhead, and fragmentation.
• Suspend the responsibilities until a future Board expansion. Discarded because regulatory, trust, and compliance matters require ongoing continuity.
• Use only ad hoc volunteers or informal support. Discarded because these responsibilities require accountability, continuity, and a clear mandate.

Attachments 

1. [Link to original concept paper detailing the Compliance Officer mandate; board-internal]

Comments 

None