EU regulation engines

Ask whether an EU regulation applies to you, how DORA and NIS2 differ on one topic, what evidence an auditor will want, and which articles an ISO 27001 control helps with.

Plan Team and Company.

Try it

Using Ansvar, check which EU regulations apply to a Swedish company that sells a connected home camera with a companion app in the EU, and list what you still need from me to settle anything unresolved.

More examples:

Using Ansvar, compare how DORA, NIS2 and GDPR treat incident reporting, with the article and deadline for each.

Using Ansvar, list the audit evidence DORA expects for ICT risk management and the questions an auditor will ask.

Using Ansvar, map ISO 27001 control A.5.24 to the NIS2 articles it helps with and mark full or partial coverage.

What comes back

An applicability check returns a verdict per regulation with the articles it rests on, and tells you which facts would settle anything it could not decide. The other engines return article numbers and short extracts your assistant can open in full.

For developers, the fields to read:

• Applicability, profile input: per instrument a verdict (applies, may_apply, does_not_apply, exempt, unresolved, conflict), temporal state, confidence, basis and exclusion articles, and the fields that would settle an unresolved verdict
• Applicability, sector input: one cited row per applicable regulation with confidence and basis article
• Comparison: per regulation, requirement extracts, article numbers and timelines
• Evidence: artefact names, examples, retention periods, auditor questions and maturity expectations
• Control mapping: control by control, full, partial or related coverage with the articles

Which plan

Team and Company. On Premium, a deferral dossier workflow uses the applicability check for you during the run; the other engines need Team.

Tools

• check_applicability decides which EU regulations apply to a product, service or company.
• compare_requirements compares how two or more regulations treat one topic.
• get_evidence_requirements lists the evidence an auditor expects for a regulation or article.
• map_controls maps ISO 27001 or NIST CSF controls to EU regulation articles.
• get_regulation_guide gives an orientation guide to one regulation.

Limits

• A fact you leave out counts as unknown, never as false. Expect unresolved verdicts until you supply it.
• A regulation with no verdict was not assessed. That is not a negative answer.
• The engines cover EU-level law. National law and transpositions come through the normal search.
• An engine result helps your analysis. Have a qualified person review an applicability conclusion before you rely on it.