Start free

    Solutions · Compliance

    Stop re-reading every new rule.

    Ansvar tracks what changed across Europe, maps it to the controls you already run, and writes down the gaps with their sources. Your team reviews and decides.

    See it in the demoStart free: one assessment a month
    The repeating façade of the Berlaymont building, home of the European Commission, Brussels.
    Photo: Axel Kirch · CC BY-SA 4.0

    Sound familiar?

    • NIS2, DORA, the CRA and the AI Act overlap, and each one is read on its own.
    • A control is mapped in a spreadsheet nobody can trace back to the law.
    • A correction lands in the Official Journal and nobody notices.

    Every gap comes with the paragraph it rests on.

    This is what one line of a gap analysis looks like. Missing evidence stays a gap, never a pass.

    Example finding · incident reportingBuilt from Ansvar's recorded control mapping, 28 Oct 2026
    Requirement
    NIS2 Art. 23(4): early warning in 24 hours, notification in 72 hours, final report within one month, source 1
    Control in place
    NIST SP 800-53 IR-6, incident reporting: overlaps the requirement, source 2
    Result
    IR-6 sets internal reporting only. The statutory deadlines are not covered.
    Gap
    Sources. Click a numbered square.
    (a) … within 24 hours of becoming aware of the significant incident, an early warning […]; (b) … within 72 hours … an incident notification […]; (d) a final report not later than one month after the submission of the incident notification under point (b). NIS2, Article 23(4) · EUR-Lex
    Mapping IR-6 → NIS2 Art. 23: intersects, reviewed. Gap stated: “No prescribed 24-hour early warning, 72-hour notification … one-month final/progress reporting …” Ansvar control library · NIST OSCAL 5.2.0
    Open NIS2 Art. 23 on EUR-Lex
    Showing passage 1

    One control, many frameworks.

    Implement a control once and see where it counts. We propose the mappings and review them, and you can overrule them.

    Mappings available · ISMS as Code as a design-partner pilot
    IR-6 maps toRelationReview
    NIS2 Art. 23overlapsapproved
    NIS2 Art. 21relatedapproved
    DORA Art. 19overlapsapproved
    DORA Art. 17overlapsapproved

    Mappings proposed by AI, then reviewed. NIS2 and DORA are not treated as equivalent.

    See what changes, and when.

    New acts, corrections and application dates across Europe, each with its date and official source.

    7 Aug 2026

    Correction to the NIS2 technical-rules regulation (EU) 2024/2690, published in the Official Journal.

    11 Dec 2027

    The Cyber Resilience Act applies in full: conformity assessment and CE marking for products with digital elements.

    Start small.

    Free

    One assessment a month on a system you describe: a NIS2, DORA, CRA or AI Act gap analysis, a DPIA or a threat model. No card.

    Premium

    More assessments, the full catalogue, and court cases and guidance in your answers.

    Team

    Assessments on your own documents, shared across your team.

    Company plans, ISMS as Code and private deployment by agreement.

    See plans

    Try a NIS2 gap analysis on your setup.

    Start freeBecome a design partner