The enterprise showcase

Meet Nordbank Europe: a fictional pan-European bank with forty thousand employees, operations in nine countries, and AI running across credit, fraud, risk and customer service. This is what the platform looks like when a serious institution works it.

Two people run this story. Claire is the Group Head of Compliance. Marcus is the Group Chief Information Security Officer. Different remits, different frameworks, one shared tenant.

Nordbank is a credit institution, so the obligation set is wide: the AI Act for its models, GDPR for everything it processes, DORA for operational resilience, NIS2 as critical infrastructure, and ISO 27001 for its management system.

Claire and Marcus share one tenant, each with their own role and their own filtered view. Here is Claire's dashboard: the full compliance posture across every enabled framework.

The dashboard is the accountability view. Global health, frameworks on track, urgent deadlines, and a system inventory that spans the whole group.

Readiness by framework shows where the group actually stands: the AI Act, GDPR, DORA, NIS2 and ISO 27001, each scored from the real checklist work underneath.

The obligations view filters by department, so posture reads per business line: retail credit, payments, anti-fraud, human resources, and the group functions.

The compliance calendar brings every regulatory deadline into one view: the AI Act application dates, DORA's phased entry into force, NIS2 transposition, and the internal audit cycle.

The system inventory is the spine of the programme. Nordbank registers every AI system, and every system that processes personal data.

Filter by department and each business line's estate appears on its own, with risk badges on every row.

Open the credit decisioning engine. It is a high risk system under Annex three, because it decides access to credit.

The system card carries everything a regulator would ask for: owner, vendor, purpose, data processed, deployment status, and the risk classification that drives its obligations.

Every AI system needs a classification under Article six. The credit model was assessed when it went live.

High risk, with the reasons spelled out: a sector under Annex three, impact on essential services, and special category data. That classification generates the full obligation set.

The generated checklist runs the whole Annex four documentation duty: technical documentation, risk management, data governance, human oversight, and post market monitoring.

Because the model is high risk and used in a sensitive sector, a fundamental rights impact assessment is triggered under Article twenty seven. The group has a standing process for these.

Marcus is logged in as the Group CISO. His view of the same tenant is shaped by his role: DORA and NIS2 come first, because those are the frameworks that keep the bank running.

DORA treats ICT risk as a board-level concern. Marcus sees the resilience obligations across every critical system, with the evidence behind each control.

The ICT asset register is the DORA spine: every system that supports a critical or important function, classified, owned, and mapped to its resilience obligations.

Nordbank is critical infrastructure under NIS2, so the cybersecurity risk management measures are mandatory. Marcus tracks them against the directive's Annex.

The automated scanning estate feeds evidence into both DORA and NIS2. Marcus can see open findings by severity, tied to the systems they affect.

And when something happens, the incident clock starts immediately. Marcus is working a real incident now: a payment gateway anomaly flagged under Article seventy three.

The report captures what happened, the impact, and the corrective actions. The regulatory reporting deadline is counted down from the moment of awareness.

Back to the GDPR side. The privacy hub holds requests, breaches, processors and consent in one place.

A data subject request came in from a customer. Claire assigns it to the retail team, and the one month countdown is already running.

A personal data breach was logged earlier this month. The seventy two hour notification clock and the supervisory authority are both recorded against it.

The processor register under Article twenty eight tracks every third party that touches personal data, with DPA status and transfer assessments.

Consent records under Article seven capture the lawful basis for the group's marketing and profiling activity, with the evidence attached.

The group is structured into departments, and every system, obligation and member rolls up through them.

Roles are granular: Claire holds group admin, her compliance officers are editors, and each business line has its own accountable leads.

AI literacy under Article four is tracked group wide. Nordbank's programme shows the completion rate across every department.

Claire sees Marcus's incident and the AI Act obligations it triggers. They work the same tenant, so nothing is siloed.

Marcus has already logged the corrective actions, and the shared audit trail shows exactly who did what and when.

For work that is a project rather than a standing duty, the compliance plans module tracks tasks, dependencies and milestones.

The plan shows the AI Act readiness roadmap as a dependency chain, so the whole group can see what blocks what.

Vendor risk scoring works across the processor register and the ICT supply chain, feeding both GDPR and DORA.

The questionnaire engine sends real due diligence to critical vendors, and the answers land back in the vendor record.

Evidence is what turns a claim into a proof. The evidence vault holds the artefacts behind each control, linked to the systems they evidence.

Claire attaches the credit model's independent validation report to its evidence record, closing the loop on the checklist item.

And the audit trail records every action across the whole group, from Claire's DSAR assignment to Marcus's incident log.

Back on the dashboard, the group's posture has moved. Two people, different frameworks, one shared picture.

From Marcus's side, the resilience story is live: DORA and NIS2 tracked, incidents logged, evidence attached.

That is the enterprise story: a wide regulatory surface, real departments, and every framework tracked and evidenced in one place.