Every feature, and the law behind it

A side-by-side look at a fictional pan-European bank being worked by its Group Compliance lead and Group CISO at the same time, across the AI Act, GDPR, DORA, NIS2 and ISO 27001.

The Article 6 assessment that decides which obligations a system carries, and why the reasoning matters as much as the result.

How Articles 9 to 15 become tracked, owned, evidenced work rather than a document nobody reads.

The Article 27 assessment deployers owe before putting certain high-risk systems into use, and how it differs from a DPIA.

Tracking Articles 15 to 22 requests against the one-month statutory clock, including the automated-decision right that bites hardest on AI.

The seventy-two hour clock under Article 33, what the notification must contain, and when you must tell individuals directly.

The Article 30 record: the foundational GDPR document, and usually the first thing requested in an investigation.

The international standard for an information security management system, and how EuroCompliant tracks your Annex A controls.

The AI-specific counterpart to ISO 27001: how EuroCompliant currently supports it, and what's still coming.

The US voluntary AI risk framework's four functions, and an honest look at what the platform automates today.

What DORA requires of EU financial entities, and the real, working parts of the platform built around it: vendor criticality flags and infrastructure scanning.

The EU's cybersecurity directive for essential and important entities, fully supported in the Obligations page.

The EU's product-cybersecurity regulation for hardware and software with digital elements: secure-by-default requirements, vulnerability handling, and technical documentation.

The AICPA's Trust Services Criteria used in SOC 2 audits: the Common Criteria (security) plus, where in scope, Availability, Confidentiality and Processing Integrity. 43 tracked obligations, 12 platform-managed today, backed by real scan, audit-trail and policy-acknowledgment evidence.

The EU's regulation for electronic health record (EHR) systems and the primary and secondary use of health data. Entered into force March 2025, but doesn't apply until 26 March 2027 (staggered through 2031). This guide covers how to prepare early, not a present-tense compliance claim.

The U.S. federal standard for protecting electronic protected health information (ePHI), covering Administrative, Physical, and Technical Safeguards. Essential if you're a European health-tech vendor selling into the U.S. healthcare market.

California's privacy law, and the real strength of the platform's support: a unified request pipeline with a CCPA-specific 45-day clock.

The Article 72 duty to actively watch a high-risk system for its whole life, and why AI systems degrade without anyone changing the code.

The Article 73 duty when a high-risk AI system causes serious harm, with deadlines that tighten to two days in the worst cases.

Connecting your infrastructure for automated scanning, wiring up notifications, and tracking third-party risk.

Sync your directory automatically with SCIM 2.0 and push evidence or test results from any CI/CD pipeline into the Evidence Vault or findings log.

The cross-framework view: every deadline in one calendar, and where your overall compliance posture is measured.

Connecting an identity provider so access reviews are a dated, automated finding instead of an annual assertion.

A structured questionnaire turns a vendor register into a dated, explainable risk score per vendor.

Send the same risk questionnaire directly to a vendor's own contact, instead of assessing them on their behalf.

Approved answers to security questionnaire questions, reused automatically the next time the same question appears.

Turn obligations into trackable tasks with deadlines, dependencies, milestones, and a Gantt timeline.

Stream signed execution decisions from your autonomous-agent runtime firewall straight into tamper-evident audit evidence.

A board-level 5x5 risk heatmap with inherent vs. residual scoring, linked straight to your remediation roadmap.

Provide anonymous, safe reporting channels that meet EU Whistleblower Directive requirements.

Your six duties as a deployer of high-risk AI, shown per system so you can see exactly where gaps remain.

Log every automated decision that affects people and track contest requests and human overrides.

High and critical scan findings automatically become tracked corrective actions that require evidence to close.

Generating Annex IV technical documentation, declarations of conformity and framework records from data you have already entered.

Turning completed checklist items into artefacts a regulator can inspect, and the logging duties behind Articles 12 and 26.

Article 4 applies to nearly everyone deploying AI, it has been in force since February 2025, and it is the obligation most organisations discover last.

Inviting your team, assigning roles, organising departments, and locking down accounts with 2FA and SSO.

Generate regulator-ready documents from your own data, then download a signed PDF an auditor can verify independently.

Every regenerated policy keeps its history, and staff sign-off is tracked against the exact version they read.

Where any team member, not just admins, signs off on required policies and completes their own AI literacy check.

A public page, at your own address, answering the security questions a prospect would otherwise ask by email.

Test your team's knowledge with non-accredited online certifications and shareable PDF credentials.

Disclose AI interaction, mark synthetic content, and document deep-fake provenance.

Give a notified body or auditor read-only access to your conformity documents without an admin account.

Track general-purpose AI models and record systemic-risk assessments for high-compute models.

How scheduled scan jobs, 12 scan engines and local PII scrubbing produce dated Article 10/15 evidence without moving data outside the EEA.

Sealed documents and a tamper evident audit trail, with a verification link anyone can open in a browser. No login needed.

Connect Cursor or Claude Desktop to EuroCompliant over SSE and query compliance posture in plain language.

Turn unfinished obligations and scan findings into a Gantt-tracked plan with owners, dates, and evidence-required closure.