Regulatory Gap Analysis
The base: pick a supported framework and assess its configured requirement set.
Workflow · Gap analysis
Regulatory gap analysis
Where you stand against a regulation, requirement by requirement — every finding cited to the provision it rests on, or marked unresolved.
Ansvar is a gateway for the AI assistant your team already uses — Claude, Microsoft Copilot, any MCP client. Connect it and your agent runs the workflow; the server enforces the stages and fetches every citation.
NIS2 · DORA · CRAand the AI Act, medical devices, machinery, drones
Article-levelevery finding cited to its provision, or marked unresolved
Freeone run a month, on four of the regimes
Name a framework and the run works through it. Each requirement gets a verdict: what the provision demands, what you have, what is missing. The gateway fetches each requirement as the run goes, so a finding carries the citation it came from — and where no served source grounds it, the run marks it unresolved instead of filling it in. One family covers the regimes: NIS2 and its Dutch transposition, DORA, the Cyber Resilience Act, the EU AI Act, the medical-device pair with its cybersecurity guidance, UNECE R155, the Machinery Regulation, and the two drone regimes.
the family
One assessment spine, a variant per regime
NIS2 (Directive (EU) 2022/2555 Art. 21)
The Article 21(2) cybersecurity risk-management measures.
NIS2 Netherlands (Cyberbeveiligingswet, Stb. 2026, 187)
The Dutch transposition (Stb. 2026, 187); commencement 15 August 2026.
DORA (Regulation (EU) 2022/2554)
ICT risk-management duties for financial entities.
Cyber Resilience Act (Regulation (EU) 2024/2847)
Product-security obligations for products with digital elements.
EU AI Act (Regulation (EU) 2024/1689) high-risk provider conformity
Obligations by role — provider, deployer, importer or distributor.
Medical Device Regulation (Regulation (EU) 2017/745)
General safety and performance requirements for medical devices.
In Vitro Diagnostic Regulation (Regulation (EU) 2017/746)
The same discipline for in-vitro diagnostic devices.
Medical Device Cybersecurity (MDCG 2019-16 rev.1)
Non-binding guidance, assessed as written.
UNECE R155 Cyber Security Management System (CSMS)
CSMS and vehicle-type cybersecurity requirements.
Machinery Regulation Gap Analysis — EHSRs (EU) 2023/1230
Annex III essential health and safety requirements, plus placing-on-market duties.
Drone Operator Compliance — UAS Operations (Reg (EU) 2019/947)
Operational rules for UAS operators under Reg (EU) 2019/947.
Drone Product Security Conformity — UAS Products (Reg (EU) 2019/945 + CRA + RED)
Product security, where three regimes overlap.
Where a framework leans on a standard, the run cites the requirement and maps to controls; standard text itself arrives only if you license it through the ISO standards add-on.
how a run works
What the server enforces
- 1Scope
the regime and the system or documents the assessment runs against
- 2Required fields
on a gated step the run will not advance on a half-answered requirement
- 3Verdict per requirement
with the provision fetched and cited where a served source grounds it
- 4Unresolved findings
a requirement with no served source is marked, never invented
- 5Report
coverage plus the finding register — structured for your agent, rendered for your auditor
ask your agent
Paste one of these to start
Using Ansvar, run a NIS2 gap analysis for our logistics platform against Article 21 and cite every finding to its provision.
Using Ansvar, which gap-analysis workflow types can I start, and what does each one assess?
install the skill
A prompt starts one run. The skill is the same guidance installed once — the run loop, the evidence and citation rules, and the starters — so your agent works this way in every conversation, not only the ones you remember to paste into. Install it as a skill in Claude or Claude Code, or paste the same file into Microsoft Copilot or a custom GPT's instructions.
Regulatory Gap Analysis · version 1.0.4 · SKILL.md · ZIP · how to install it
Free gets one workflow run a month and Solo two, spendable on the generic gap analysis or its NIS2, DORA, CRA and EU AI Act variants, against a system you describe, and a Free or Solo run can also return a render carrying a self-asserted banner. Premium adds the rest of the family — the Dutch NIS2, medical-device, R155, machinery and drone variants — on five runs a month. Team and Company run them against your own uploaded documents and add unwatermarked HTML, PDF and DOCX exports. Run allowances and what each tier adds live on the pricing page.
Questions buyers ask first
- Which plan do I need to run one?
- Any of them, for part of the family. Free gets one workflow run a month and Solo two, spendable on the generic gap analysis or its NIS2, DORA, CRA and EU AI Act variants, against a system you describe. The Dutch NIS2, medical-device, R155, machinery and drone variants start at Premium. Team and Company add runs grounded in documents you upload. The pricing page carries the allowances.
- Do I have to upload our policies?
- No. On Free, Solo and Premium, the run interviews you about the system and assesses what you describe. Uploading your policies is what Team adds: findings then anchor to the exact paragraph they came from, with a content hash, so a reviewer can check the verdict against your own document.
- What comes out at the end?
- Gap findings across the configured requirement set, each cited to its provision or marked unresolved, plus the share of those requirements assessed. Every plan returns the complete report as structured data, which is what your agent reads. Rendered documents are the hand-off: Team and Company export unwatermarked HTML, PDF and DOCX, and a Free or Solo run can also return a render carrying a self-asserted banner.
- Is this a compliance certificate?
- No. A gap analysis is decision-support: a cited register of where you stand, which feeds an audit, a board paper or a remediation plan. Ansvar issues no certificate and makes no conformity declaration.
- What happens when a requirement has no source we serve?
- The run marks it unresolved rather than answering from model memory. A gap analysis you hand to an auditor has to be honest about what it could not ground.
as a service
Prefer we run it?
Every workflow here is also an expert-run service: we run it against your systems, review the output as practitioners, and hand over the finished deliverable. See the services page for how engagements work, or contact us to scope one.
Related: Sample NIS2 gap analysis · Worked run, policy attached · Worked run, no upload · Free NIS2 template · NIS2 scope checker · NIS2 explained · DORA explained · CRA explained · Your first gap analysis · Have us run it
Run it against your own systems
Connect the AI client you already use and ask your first cited question — Free, Solo, Premium and Team are self-serve.