The enterprise showcase

Meet Nordbank Europe: a fictional pan-European bank with forty thousand employees, operations in nine countries, and AI running across credit, fraud, risk and customer service. This is what the platform looks like when a serious institution works it.

Two people run this story. Claire is the Group Head of Compliance. Marcus is the Group Chief Information Security Officer. Different remits, different frameworks, one shared tenant.

Nordbank is a credit institution, so the obligation set is wide: the AI Act for its models, GDPR for everything it processes, DORA for operational resilience, NIS2 as critical infrastructure, ISO 27001 and 42001 for its management systems, and CRA and SOC 2 for the software it ships and sells.

Claire and Marcus share one tenant, each with their own role and their own filtered view. Here is Claire's dashboard: the full compliance posture across every enabled framework.

The dashboard is the accountability view. Global health, frameworks on track, urgent deadlines, and a system inventory that spans the whole group.

Readiness by framework shows where the group actually stands across all eight: the AI Act, GDPR, DORA, NIS2, ISO 27001, ISO 42001, CRA and SOC 2, each scored from the real checklist work underneath.

Every duty is broken down to individual items, split between what the platform already handles and what the team must action, with the single next deadline surfaced up front.

The compliance calendar brings every regulatory deadline into one view: the AI Act application dates, DORA's phased entry into force, NIS2 transposition, and the internal audit cycle.

The system inventory is the spine of the programme. Nordbank registers every AI system, and every system that processes personal data.

Filter by department and each business line's estate appears on its own, with risk badges on every row.

Open the credit decisioning engine. It is a high risk system under Annex three, because it decides access to credit.

The system card carries everything a regulator would ask for: owner, vendor, purpose, data processed, deployment status, and the risk classification that drives its obligations.

Every AI system needs a classification under Article six. The credit model was assessed when it went live.

High risk, with the reasons spelled out: a sector under Annex three, impact on essential services, and special category data. That classification generates the full obligation set.

The generated checklist runs the whole Annex four documentation duty: technical documentation, risk management, data governance, human oversight, and post market monitoring.

Because the model is high risk and used in a sensitive sector, a fundamental rights impact assessment is triggered under Article twenty seven, opened here for this exact system rather than filed as a standing box-tick.

Marcus is logged in as the Group CISO. His view of the same tenant is shaped by his role: DORA and NIS2 come first, because those are the frameworks that keep the bank running.

DORA treats ICT risk as a board-level concern. Marcus sees the resilience obligations across every critical system, with the evidence behind each control.

The ICT asset register is the DORA spine: every system that supports a critical or important function, classified, owned, and mapped to its resilience obligations.

Nordbank is critical infrastructure under NIS2, so the cybersecurity risk management measures are mandatory. Marcus tracks them against the directive's Annex.

The automated scanning estate feeds evidence into both DORA and NIS2. Marcus can see open findings by severity, tied to the systems they affect.

And when something happens, the incident clock starts immediately. Marcus is working a real incident now: a payment gateway anomaly flagged under Article seventy three.

The report captures what happened, the impact, and the corrective actions. The regulatory reporting deadline is counted down from the moment of awareness.

Back to the GDPR side. The privacy hub holds requests, breaches, processors and consent in one place.

A data subject request came in from a customer.

Claire assigns it to the retail team, and the one month countdown is already running.

A personal data breach was logged earlier this month. The seventy two hour notification clock and the supervisory authority are both recorded against it.

The processor register under Article twenty eight tracks every third party that touches personal data, with DPA status and transfer assessments.

Consent records under Article seven capture the lawful basis for the group's marketing and profiling activity, with the evidence attached.

The group is structured into departments, and every system, obligation and member rolls up through them.

Roles are granular: Claire holds group admin, her compliance officers are editors, and each business line has its own accountable leads.

For anything more specific, Claire builds a custom role.

FRIA Reviewer, Retail Banking: scoped to submitting and reviewing fundamental rights assessments for one business line only.

Reviewers rarely map to just one role. Claire groups the retail-lending reviewers together and grants that group its own scoped role in one step, instead of repeating the same assignment person by person.

AI literacy under Article four applies to every employee, Claire included. The same short assessment any team member takes lives right here in her own settings, no separate admin tool required.

Claire sees Marcus's incident and the AI Act obligations it triggers. They work the same tenant, so nothing is siloed.

Marcus has already logged the corrective actions, and the shared audit trail shows exactly who did what and when.

For work that is a project rather than a standing duty, the compliance plans module tracks tasks, dependencies and milestones.

The plan shows the AI Act readiness roadmap as a dependency chain, so the whole group can see what blocks what.

Vendor risk scoring works across the processor register and the ICT supply chain.

Running the assessment feeds a live score back into both GDPR and DORA.

The questionnaire engine sends real due diligence to critical vendors.

It's sent. Once vendors respond, the answers land straight back in this record.

Evidence is what turns a claim into a proof. The evidence vault holds the artefacts behind each control, linked to the systems they evidence.

Claire attaches the credit model's independent validation report to its evidence record.

That closes the loop on the checklist item.

Generating the group's AI Governance Policy pulls straight from Nordbank's real configuration. On Enterprise, downloading it as a PDF signs it in the same step.

And requiring staff acknowledgment turns it into a tracked obligation, not just a saved file.

Inbound due-diligence questionnaires from Nordbank's own customers get the same treatment: the answer library auto-fills exact matches from past answers instantly, no re-typing the same response twice.

Marcus sees that same policy the moment it is published, on his own My Compliance page, and signs off without needing any admin access at all.

And the audit trail records every action across the whole group, from Claire's DSAR assignment to Marcus's incident log.

Back on the dashboard, the group's posture has moved. Two people, different frameworks, one shared picture.

From Marcus's side, the resilience story is live: DORA and NIS2 tracked, incidents logged, evidence attached.

That is the enterprise story: a wide regulatory surface, real departments, and every framework tracked and evidenced in one place.