NIS2 gap analysis with the policy attached — ISO 27001 via SIS in the loop
Your CISO uploads the company's information-security policy and asks for a NIS2 Article 21 gap analysis. The server-enforced workflow pairs every Art. 21(2) measure…
Use cases
Real work, really cited.
Each of these is a real run through the Ansvar gateway — the scenario, the cited answer, the source trail, and the downloadable artifact. Pick the one closest to your problem.
Gap analysis from your security policy
Your CISO needs to know how today's information-security policy maps against ISO 27001, NIS2, and DORA — without buying three separate audits.
GDPR Article 35 DPIA — full workflow run with structured report
Your HR team wants to roll out 'PeopleFlow', a US SaaS that processes payroll, performance reviews, absence data including medical certificates, and runs a 'flight-…
Swedish tender review under LOU
You are bidding on a Swedish public-sector tender. Selection criteria, award criteria, and mandatory contract clauses must align with Lagen om offentlig upphandling…
STRIDE threat model — quick narrative via search
You are designing a new B2B authentication flow using OAuth 2.1 + OIDC + Keycloak. Your security architect wants a fast STRIDE narrative grounded in OWASP and STRID…
EU AI Act high-risk classification — credit scoring
You are building a credit-scoring AI for three EU markets. This run resolves the EU AI Act's harmonised high-risk classification from fetched article text — Article…
Document review: a retention policy, paragraph-cited
Your counsel or DPO needs a defensible review of the company's data-retention policy — every finding pinned to the exact paragraph it concerns, hash-anchored so it…
ISO 27001 → NIST CSF 2.0 through the canonical control library
An ISO/IEC 27001:2022-certified company must report security posture to its US parent on NIST CSF 2.0. Instead of maintaining a hand-built mapping spreadsheet, the…
LINDDUN privacy threat model for a customer-data store
You are adding a new customer-data warehouse. The privacy team wants a LINDDUN-go privacy threat model: linkability, identifiability, non-repudiation, detectability…
What national rules apply to employee monitoring (NL, DE, FR)?
Your team is rolling out a productivity-monitoring tool to staff in the Netherlands, Germany, and France. Each jurisdiction has its own works-council and labour-cod…
The full sample deliverables
Read a finished document, end to end.
Five complete deliverables, published unsigned so you can judge the work exactly as it leaves the engine — every linked citation fetched during the run, every gap marked. All five are fictional samples and say so.
Threat model — STRIDE, LLM-backed returns API
Nine threats across four trust boundaries, control mapping, CRA duties — with unresolved rows held for review.
DPIA — GDPR Art. 35, employee wellness app
Screening, necessity, a seven-risk register, Art. 32 safeguards, and an honest Art. 36 prior-consultation call.
Gap analysis — DORA / NIS2 incident response
Requirements mapped to evidence, gaps flagged with regulatory basis, owners and remediation sequenced.
AI Act readiness — classification & obligations
Role test, high-risk classification, and the article-level obligation register that follows from it.
Deferral dossier — the vulnerability you can't patch
CRA-era deferral records over a scanner export: engine scores, credited controls, live-fetched pin-cites, the investment plan — and a VEX back into Dependency-Track.
Free templates & tools
Take something with you.
NIS2 gap analysis template
The Art. 21 measure list as a working register — XLSX and PDF, no sign-up.
DPIA template
Article 35 screening with WP248 criteria, processing description, risk register, Art. 36 check.
EU AI Act high-risk checker
Six questions, client-side only — see which way the cited provisions point for your system.
Run one of these on your own data
Bring your own documents and scope. We run it end-to-end — every finding cited and validated by the expert who delivers it.