AI Compliance OS
Built for the EU AI Act, the NIS2 directive, DORA and the Cyber Resilience Act.
One minute through the real product, paced so you can read every screen: the score, the clocks, the graph, the audit pack.
How it works
No consultant on site and no hundred-page questionnaire. You give the software four kinds of information, and it checks every legal requirement that applies to you against them.
About five minutes
Where you are based, your sector and size, and whether you use or build AI. From these answers the software works out which EU laws apply to you.
Twenty yes-or-no questions
Short questions drawn from the laws in scope. They give you a first picture of where to focus, before any evidence is in.
Microsoft 365 and GitHub today
You grant read-only access and the software checks your real settings — for example, whether every user and administrator signs in with multi-factor authentication. It never changes anything.
Upload or type in
Upload your policies and link each one to the requirement it covers. Then add what no tool can see: people and training, suppliers and certificates, AI systems, assets and risks.
The scan
Every requirement gets a verdict — proven, partly proven, out of date or missing — with the evidence behind it.
Where a record and the evidence disagree, you get a finding: an expired supplier certificate, an AI system with no risk level.
Every gap becomes a task with a due date, and your compliance score rises as you close them.
Every requirement ends up as one of
Your data
It runs on your own data, inside your own workspace, and nothing it reads ever leaves. Here is what it does, step by step.
It connects
It checks
It scores
It plans
An AI-driven connection to the tools you already use, GitHub and Microsoft 365 today. It only reads. It never changes anything, and it never interferes with your privacy.
Every check is saved as a piece of evidence with a source, a time and a tamper-proof seal. Nothing is ever overwritten, so an auditor can see what was true and when.
It works out exactly which requirements of each EU law apply to your company and gives you a personal compliance score. Every verdict shows its reasoning, so you can see why.
Then it turns every gap into a clear list with a timeline and a course of action. Your score, your trust center and your audit pack all read the same record.
An AI-driven connection to the tools you already use, GitHub and Microsoft 365 today. It only reads. It never changes anything, and it never interferes with your privacy.
Every check is saved as a piece of evidence with a source, a time and a tamper-proof seal. Nothing is ever overwritten, so an auditor can see what was true and when.
It works out exactly which requirements of each EU law apply to your company and gives you a personal compliance score. Every verdict shows its reasoning, so you can see why.
Then it turns every gap into a clear list with a timeline and a course of action. Your score, your trust center and your audit pack all read the same record.
Real screens from a demo organisation, not mock-ups. This is what the system builds for you, and what a compliance officer sees every day.
We build your trust centre
The one the NIS2 directive expects, and the one your customers ask for when they check their own suppliers. Published from your dashboard, at the level of access you choose.
Your personal compliance score
Our AI system works out exactly which requirements of each EU policy and law apply to your company, and scores you against them, with the reasoning shown rather than hidden.
A clear plan, with dates
Then it turns every gap into a list: what to do, in what order, by when. Statutory deadlines are counted for you from the moment something happens.
Eight screens
Click a screen to view it.
Eight screens — use the arrows to see each one.
Screen 1 of 8
Screen 1 of 8
A page where customers and auditors find your security documents themselves, instead of sending you the same questionnaire again.
Four answers. The same rules the onboarding wizard runs, against the real obligation library.
Choose a sector to see your scope.
The same rules run in the onboarding wizard. A starting point, not a legal determination.
Sixteen modules reading the same evidence: four to prove it from the law, ten to run the organisation the regulations assume, two to publish what is true. Each one carries five marks showing which European laws it reads from — pick one below to see how far it reaches.
Each card's five marks read left to right: NIS2 · GDPR · EU AI Act · CRA · DORA.
Turn the law into obligations and the evidence into verdicts.
Run the organisation the regulations describe: incidents, suppliers, AI, people, risk.
Show buyers and auditors what is true, at the right level of access.
Three views of the same evidence. Each one is a real screen in the platform, not a persona on a slide.
Managing director
One compliance score, the open incidents with their statutory clocks, and every high risk on a single screen. Drill down when the board asks why.
In the platform: Executive overview
Today
NIS2 early warning
3h left · Art 23(4)(a)
Overdue: MFA for admin accounts
Task · due 2 days ago
Policy claims ISO 27001, cert expired
Policy vs evidence · supplier
AI literacy: 5 of 7 trained
Art 4 · 2 reminders sent
Compliance officer
Statutory clocks first, then overdue tasks, then every place a policy claims one thing and the evidence on file shows another.
In the platform: Workspace
IT and security lead
The AI-driven connection reads GitHub and Microsoft 365 and turns each check into sealed, dated evidence. The MFA question is answered by the system, not by email.
In the platform: IT and security view
Tap a tier. The same evidence, revealed to the right audience.
Gate
No gate. Indexed by search engines and AI assistants.
Buyers research you before they contact you.
4 of 12 items visible at this tier
Statutory clocks, live
incident detected 45 min before you opened this page
NIS2 · Early warning
NIS2 Art 23(4)(a)
NIS2 · Incident notification
NIS2 Art 23(4)(b)
NIS2 · Final report
NIS2 Art 23(4)(d)
DORA · Initial notification
DORA Art 19(4)(a); Del. Reg. (EU) 2025/301
DORA · Intermediate report
DORA Art 19(4)(b)
DORA · Final report
DORA Art 19(4)(c)
GDPR · Breach notification
GDPR Art 33(1)
The same rules run on every incident you record. The platform counts the duty down; it is not the channel that discharges it.
Every verdict shows its chain
A real obligation, a real check. Rules decide; nothing here was written by a model.
Regulation
Directive (EU) 2022/2555 (NIS2)
Source: regulations/text/NIS2.txt:1745
Obligation
NIS2-021-2j · Article 21(2)(j)
Multi-factor authentication or continuous authentication
Control
MFA enforced for all users
Direct evidence of Art 21(2)(j)
Evidence
github · 99% · today
18/19 members (95%) have 2FA enabled; 0 of 2 owners lack 2FA
Verdict
SATISFIED
Verified via github today at 99% confidence.
77 obligations across 6 regulations, each citing the exact regulation, article and source line it comes from, traceable to the official EUR-Lex text.
Explore the obligation library →77
obligations
A rough estimate, not a guarantee. It assumes a live trust center replaces about 75% of the time spent answering a security questionnaire from scratch.
~108 hours/year
Estimated from the assumption above. Adjust the numbers to match your own team.
Each page runs the scope finder with a typical profile for that industry, so what you see is computed from the rules, not asserted.
No. Your management system stays the system of record for controls and risks. This is the evidence and proof layer: it decomposes the law into obligations, checks the evidence, and shows the result to buyers, auditors and the board without duplicating the ISMS.
The AI system does the legwork: it connects to your systems, collects the evidence, works out which requirements apply to you, scores you and schedules what needs doing. Every verdict is decided by rules you can inspect, and every one shows its reasoning from the article of law to the evidence, so nothing is a black box. There is also an AI register for the AI tools your company uses.
The EU AI Act, NIS2 and Implementing Regulation 2024/2690, DORA and Delegated Regulation 2025/301, GDPR and the Cyber Resilience Act: 77 obligations, each cited to the official EUR-Lex text and source line.
The database is PostgreSQL on Supabase in Frankfurt (eu-central-1), with each company's data kept strictly separate at the database level. Application compute runs on Vercel, currently in US East. The security page says exactly what is and is not in place.
Nothing today. The platform is free for design partners while it is early, with every module included and no card. We give notice before any plan carries a price.
Yes. The live demo signs you into a seeded organisation, read-only, with every module populated.
No. It applies the directive's own size gate and sector lists and the onboarding wizard's rules, and it says it is a starting point. Scope determinations are yours and, where applicable, the competent authority's.
No credit card, no sales call. Sign up, upload your evidence, publish.
Get started free →