Do you cover the DORA technical standards, not just the regulation?

Yes. The eleven RTS/ITS instruments are each addressable as their own scope — ICT-risk-management, subcontracting, incident classification and reporting, threat-led penetration testing, the register-of-information ITS, and the rest — so a gap analysis tests against the detail a supervisor actually checks.

Is this a vulnerability scanner?

No. The effective-risk capability re-scores vulnerabilities your existing scanners already found, adding exploitation and asset context (CISA KEV, EPSS, NVD) so DORA ICT-risk decisions are reproducible and cited. It complements Tenable / Snyk / Dependabot rather than replacing them.

Which prudential regimes are emerging vs in force?

The corpus covers in-force law — DORA, MiCA, PSD2, MiFID II, CRR/CRD, Solvency II and EMIR, including the EMIR 3 amendments (Reg (EU) 2024/2987, in force since December 2024). Proposals still in the legislative pipeline (PSD3/PSR, FIDA) are tracked as emerging and are not presented as applicable law.

No. Under the EU layer, the national regulators' rulebooks for every EU-27 member state plus EFTA and the UK are served with each provision attributed to the state that issued it, and the ECB's legal acts and Banking Supervision material sit beside them. For the US, federal banking regulation (12 CFR) and securities regulation (17 CFR, including the Regulation S-K cyber-disclosure rules) come verbatim from the eCFR, with the SEC staff cyber-disclosure interpretations and the FTC data-security guidance on Premium and above.

Sector · Financial

Financial services

The whole EU financial-regulation stack at article level — including the technical standards everyone else skips.

Ansvar is a gateway for the AI assistant your team already uses — Claude, Microsoft Copilot, any MCP client. Connect it, and every answer below comes back cited to the provision or marked unresolved.

Financial regulation research, plan access and agent prompts

See full coverage

7core EU regimes, article-level

11DORA technical standards

EU · USnational rulebooks · 12 & 17 CFR

Financial services is the deepest regulatory corpus behind the gateway. DORA, MiCA, PSD2, MiFID II, CRR/CRD, Solvency II and EMIR are all addressable article by article — and DORA's eleven RTS/ITS technical standards are each a searchable scope, not a footnote. Under the EU layer sit the national regulators' rulebooks for every EU-27 member state plus EFTA and the UK, and the ECB's own legal acts and Banking Supervision material; across the Atlantic, US federal banking (12 CFR) and securities (17 CFR) regulation is served from the eCFR. Ask a question, get the provision; then run the gap analysis that turns it into a supervisor-ready register.

what we cover

The law and standards we ground on

Regulation

DORA (Reg (EU) 2022/2554)

article-level, incl. ICT third-party risk (Art. 28)

Regulation

DORA RTS/ITS — 11 technical-standard instruments

ICT-risk, subcontracting, incident reporting, TLPT, register of information — each a searchable scope

Regulation

MiCA (Reg (EU) 2023/1114) + RTS/ITS

Regulation

PSD2 (Dir (EU) 2015/2366)

incl. strong customer authentication (Art. 97)

Regulation

MiFID II / MiFIR · CRR/CRD · Solvency II · EMIR

article-level

Law

National financial rulebooks — EU-27, EFTA and the UK

the national regulators' rulebooks under the EU layer, attributed per provision to the state that issued them (Sweden's Finansinspektionen FFFS among them)

Regulation

European Central Bank — legal acts, opinions and Banking Supervision material

ECB legal acts in force and opinions on draft EU and national legislation, plus the English-language ECB and Banking Supervision guides, consultations, supervisory sanctions and cyber-resilience and payments-oversight material

Guidance

EIOPA insurance and Solvency II material

published by the European Insurance and Occupational Pensions Authority under its reuse notice

Regulation

US federal financial regulation — 12 CFR banking · 17 CFR SEC

served verbatim from the eCFR, incl. the Regulation S-K cyber-disclosure rules

GuidancePremium

US agency guidance — SEC cyber-disclosure interpretations · FTC data-security guidance

the SEC staff C&DIs on Form 8-K Item 1.05 and Regulation S-K Item 106, and the FTC business guidance on GLBA Safeguards, the Red Flags Rule and breach notification

Regulation

Horizontal: GDPR · NIS2 · EU AI Act · eIDAS2

Standard

NIST SP 800-53r5 — served as full text

the US federal control catalog itself, cited per control; US public domain

Standard

Control mapping: ISO 27001 Annex A

requirement mapping + cross-references — the ISO 27001 text itself is available only as the SIS-licensed add-on (/standards)

GuidancePremium

Case law · agency guidance · preparatory works

inside search on Premium and above

what you can do

Workflows that turn it into evidence

Team

DORA gap analysis

scoped across DORA and its RTS/ITS, with a cited gap register and export

assembledTeam

ICT third-party-risk mapping

register of information (Art. 28(3)), exit strategy (Art. 28(8)), subcontracting RTS — assembled from gap analysis + cited document review

Team

NIS2 gap analysis & ISO 27001 control mapping

for financial entities in scope of NIS2

Premium

STRIDE threat model

of payment, core-banking or trading systems

Team

DPIA — GDPR Art. 35

for customer-data and payment processing

Team

Document review, paragraph-cited

ICT outsourcing / cloud contracts against DORA, MiFID II and PSD2

Team

Effective-risk CVE rescoring

re-rank ICT-asset vulnerabilities with NVD / CISA KEV / EPSS context for DORA ICT-risk management

STRIDE threat-model workflows run on every plan against a system you describe — 1 run a month on Free, 2 on Solo, 5 on Premium, which also adds the LINDDUN and TARA families, the rendered reports, and case law inside the run. Document-grounded workflows run on Team and Company. Every tier runs the same corpora as cited research inside your own AI client.

Questions buyers ask first

Do you cover the DORA technical standards, not just the regulation?: Yes. The eleven RTS/ITS instruments are each addressable as their own scope — ICT-risk-management, subcontracting, incident classification and reporting, threat-led penetration testing, the register-of-information ITS, and the rest — so a gap analysis tests against the detail a supervisor actually checks.
Is this a vulnerability scanner?: No. The effective-risk capability re-scores vulnerabilities your existing scanners already found, adding exploitation and asset context (CISA KEV, EPSS, NVD) so DORA ICT-risk decisions are reproducible and cited. It complements Tenable / Snyk / Dependabot rather than replacing them.
Which prudential regimes are emerging vs in force?: The corpus covers in-force law — DORA, MiCA, PSD2, MiFID II, CRR/CRD, Solvency II and EMIR, including the EMIR 3 amendments (Reg (EU) 2024/2987, in force since December 2024). Proposals still in the legislative pipeline (PSD3/PSR, FIDA) are tracked as emerging and are not presented as applicable law.
Is this EU-only?: No. Under the EU layer, the national regulators' rulebooks for every EU-27 member state plus EFTA and the UK are served with each provision attributed to the state that issued it, and the ECB's legal acts and Banking Supervision material sit beside them. For the US, federal banking regulation (12 CFR) and securities regulation (17 CFR, including the Regulation S-K cyber-disclosure rules) come verbatim from the eCFR, with the SEC staff cyber-disclosure interpretations and the FTC data-security guidance on Premium and above.

Run it against your own systems

Connect the AI client you already use and ask your first cited question — Free, Solo, Premium and Team are self-serve.

Setup guide

Building financial compliance? It works today — we take on a few design partners per sector to tune it to your team.