Regulation
DORA (Reg (EU) 2022/2554)
article-level, incl. ICT third-party risk (Art. 28)
Sector · Financial
Financial services
The whole EU financial-regulation stack at article level — including the technical standards everyone else skips.
Ansvar is a gateway for the AI assistant your team already uses — Claude, Microsoft Copilot, any MCP client. Connect it, and every answer below comes back cited to the provision or marked unresolved.
7core regimes, article-level
11DORA technical standards
FreeEU regulations, every tier
Financial services is the deepest regulatory corpus behind the gateway. DORA, MiCA, PSD2, MiFID II, CRR/CRD, Solvency II and EMIR are all addressable article by article — and DORA's eleven RTS/ITS technical standards are each a searchable scope, not a footnote. Ask a question, get the provision; then run the gap analysis that turns it into a supervisor-ready register.
what we cover
The law and standards we ground on
Regulation
DORA RTS/ITS — 11 technical-standard instruments
ICT-risk, subcontracting, incident reporting, TLPT, register of information — each a searchable scope
Regulation
MiCA (Reg (EU) 2023/1114) + RTS/ITS
Regulation
PSD2 (Dir (EU) 2015/2366)
incl. strong customer authentication (Art. 97)
Regulation
MiFID II / MiFIR · CRR/CRD · Solvency II · EMIR
article-level
Regulation
Horizontal: GDPR · NIS2 · EU AI Act · eIDAS2
Standard
Control mapping: ISO 27001 · NIST
requirement mapping + cross-references, not the standard text
GuidancePremium
Case law · agency guidance · preparatory works
inside search on paid tiers
what you can do
Workflows that turn it into evidence
DORA gap analysis
scoped across DORA and its RTS/ITS, with a cited gap register and export
assembledTeam
ICT third-party-risk mapping
register of information (Art. 28(3)), exit strategy (Art. 28(8)), subcontracting RTS — assembled from gap analysis + cited document review
NIS2 gap analysis & ISO 27001 control mapping
for financial entities in scope of NIS2
STRIDE threat model
of payment, core-banking or trading systems
DPIA — GDPR Art. 35
for customer-data and payment processing
Document review, paragraph-cited
ICT outsourcing / cloud contracts against DORA, MiFID II and PSD2
Effective-risk CVE rescoring
re-rank ICT-asset vulnerabilities with NVD / CISA KEV / EPSS context for DORA ICT-risk management
Workflows run on Team and Company. Free & Premium run the same corpora as cited research inside your own AI client.
Questions buyers ask first
- Do you cover the DORA technical standards, not just the regulation?
- Yes. The eleven RTS/ITS instruments are each addressable as their own scope — ICT-risk-management, subcontracting, incident classification and reporting, threat-led penetration testing, the register-of-information ITS, and the rest — so a gap analysis tests against the detail a supervisor actually checks.
- Is this a vulnerability scanner?
- No. The effective-risk capability re-scores vulnerabilities your existing scanners already found, adding exploitation and asset context (CISA KEV, EPSS, NVD) so DORA ICT-risk decisions are reproducible and cited. It complements Tenable / Snyk / Dependabot rather than replacing them.
- Which prudential regimes are emerging vs in force?
- The corpus covers in-force law — DORA, MiCA, PSD2, MiFID II, CRR/CRD, Solvency II and EMIR, including the EMIR 3 amendments (Reg (EU) 2024/2987, in force since December 2024). Proposals still in the legislative pipeline (PSD3/PSR, FIDA) are tracked as emerging and are not presented as applicable law.
Run it against your own systems
Connect the AI client you already use and ask your first cited question — Free, Premium and Team are self-serve.
Building financial compliance? It works today — we take on a few design partners per sector to fine-tune it to your team.