diff --git a/backend-compliance/compliance/api/ai_routes.py b/backend-compliance/compliance/api/ai_routes.py
index 6e2997f9..5e31818b 100644
--- a/backend-compliance/compliance/api/ai_routes.py
+++ b/backend-compliance/compliance/api/ai_routes.py
@@ -162,7 +162,7 @@ async def update_ai_system(
     db: Session = Depends(get_db),
 ):
     """Update an AI system."""
-    from datetime import datetime
+    from datetime import datetime, timezone
 
     system = db.query(AISystemDB).filter(AISystemDB.id == system_id).first()
     if not system:
@@ -226,7 +226,7 @@ async def assess_ai_system(
     db: Session = Depends(get_db),
 ):
     """Run AI Act risk assessment for an AI system."""
-    from datetime import datetime
+    from datetime import datetime, timezone
 
     system = db.query(AISystemDB).filter(AISystemDB.id == system_id).first()
     if not system:
diff --git a/backend-compliance/compliance/api/canonical_control_routes.py b/backend-compliance/compliance/api/canonical_control_routes.py
index a8f80cdd..cac566fb 100644
--- a/backend-compliance/compliance/api/canonical_control_routes.py
+++ b/backend-compliance/compliance/api/canonical_control_routes.py
@@ -47,6 +47,8 @@ from compliance.services.canonical_control_service import (
     _control_row,  # re-exported for legacy test imports
 )
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter(prefix="/v1/canonical", tags=["canonical-controls"])
 
 
diff --git a/backend-compliance/compliance/api/dashboard_routes.py b/backend-compliance/compliance/api/dashboard_routes.py
index a4d2fd79..88034085 100644
--- a/backend-compliance/compliance/api/dashboard_routes.py
+++ b/backend-compliance/compliance/api/dashboard_routes.py
@@ -14,7 +14,7 @@ Endpoints:
 """
 
 import logging
-from datetime import datetime, date, timedelta
+from datetime import datetime, date, timedelta, timezone
 from calendar import month_abbr
 from typing import Optional, Dict, Any, List
 from decimal import Decimal
diff --git a/backend-compliance/compliance/api/dsfa_routes.py b/backend-compliance/compliance/api/dsfa_routes.py
index 024737fe..1bc0fe0c 100644
--- a/backend-compliance/compliance/api/dsfa_routes.py
+++ b/backend-compliance/compliance/api/dsfa_routes.py
@@ -26,10 +26,11 @@ versions). Module-level helpers re-exported for legacy tests.
 import logging
 from typing import Any, List, Optional
 
-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Depends, HTTPException, Query
 from pydantic import BaseModel
 from fastapi.responses import Response
 from sqlalchemy.orm import Session
+from sqlalchemy import text
 
 from classroom_engine.database import get_db
 from compliance.api._http_errors import translate_domain_errors
@@ -484,6 +485,7 @@ async def list_dsfas(
 async def create_dsfa(
     request: DSFACreate,
     tenant_id: Optional[str] = Query(None),
+    db: Session = Depends(get_db),
     service: DSFAService = Depends(get_dsfa_service),
 ) -> dict[str, Any]:
     """Neue DSFA erstellen."""
diff --git a/backend-compliance/compliance/api/routes.py b/backend-compliance/compliance/api/routes.py
index a3693475..c0a20760 100644
--- a/backend-compliance/compliance/api/routes.py
+++ b/backend-compliance/compliance/api/routes.py
@@ -24,6 +24,7 @@ from fastapi.responses import FileResponse
 from sqlalchemy.orm import Session
 
 from classroom_engine.database import get_db
+from ..db.models import EvidenceDB
 
 from .audit_trail_utils import log_audit_trail
 from ..db import (
@@ -310,6 +311,7 @@ async def list_controls_paginated(
 )
 async def get_control(
     control_id: str,
+    db: Session = Depends(get_db),
     svc: ControlExportService = Depends(get_ctrl_export_service),
 ) -> ControlResponse:
     """Get a specific control by control_id."""
@@ -354,6 +356,7 @@ async def get_control(
 async def update_control(
     control_id: str,
     update: ControlUpdate,
+    db: Session = Depends(get_db),
     svc: ControlExportService = Depends(get_ctrl_export_service),
 ) -> ControlResponse:
     """Update a control."""
@@ -443,6 +446,7 @@ async def update_control(
 async def review_control(
     control_id: str,
     review: ControlReviewRequest,
+    db: Session = Depends(get_db),
     svc: ControlExportService = Depends(get_ctrl_export_service),
 ) -> ControlResponse:
     """Mark a control as reviewed with new status."""
diff --git a/backend-compliance/compliance/api/vvt_routes.py b/backend-compliance/compliance/api/vvt_routes.py
index 66e44f6e..0cbb8d83 100644
--- a/backend-compliance/compliance/api/vvt_routes.py
+++ b/backend-compliance/compliance/api/vvt_routes.py
@@ -21,7 +21,7 @@ Phase 1 Step 4 refactor: handlers delegate to VVTService.
 import logging
 from typing import Any, List, Optional
 
-from fastapi import APIRouter, Depends, Query, Request
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import StreamingResponse
 from sqlalchemy.orm import Session