Prove compliance. Manage risk. Understand your supply chain. Your European GRC platform.
Instead of serving seven frameworks separately, you keep one set of records: suppliers, risks, controls. Every piece of evidence from it counts everywhere and cuts the workload across your organisation.
Risk assessment across the entire supply chain.
Most registers stop at the direct supplier. We also assess their upstream suppliers — and show the path along which an outage reaches you.
Your chain down to tier 2+ — criticality by colour, detected risk as a red dot.
Avoid concentration risk
Too much riding on one provider or one country? Calculated from external and internal data.
See concentration risk →
When a supplier changes
Ownership structure, registry status, domicile — reconciled against GLEIF daily, every finding with source and timestamp. How much of your register is covered is stated right next to it.
See supplier monitoring →A path, not a score
Not “supplier X is critical”, but which chain it reaches you through.
Every supplier classified
The AI classifies — with reasoning, never a black box. You confirm.
Contracts reviewed
Clause by clause, with location and quotation. Today for DORA.
Questionnaires instead of email
Send them out, answers come back through the portal — and feed straight into the assessment.
Ownership changes get noticed
Daily GLEIF reconciliation with source and timestamp. The coverage rate is shown alongside.
Connected to your systems
ServiceNow, Entra ID, AWS, Cloudflare, Supabase and many more feed in automatically.
Sound familiar?
CISO under audit pressure
ICT risk / bank
SaaS under customer pressure
Product compliance, machinery
Scope by industry — all 21 sectors in detail
| Industry / Sector | NIS2 | DORA | ISO 27001 | EU AI Act | GDPR | SOC 2 | CRA |
|---|---|---|---|---|---|---|---|
| Banks & Financial Market Infrastructure | |||||||
| Insurance & Reinsurance | |||||||
| Asset Managers & Investment Funds | |||||||
| Payment Service Providers & E-Money Institutions | |||||||
| Crypto Asset Service Providers (CASP / MiCA) | |||||||
| Energy & Utilities | |||||||
| Transport & Logistics | |||||||
| Healthcare | |||||||
| IT Infrastructure & Cloud Services | |||||||
| Public Administration | |||||||
| AI Providers & Operators (cross-sector) | |||||||
| Drinking Water & Wastewater | |||||||
| Space & Ground Infrastructure | |||||||
| Managed Service Providers (MSP/MSSP) | |||||||
| Postal & Courier Services | |||||||
| Waste Management | |||||||
| Chemicals & Chemical Products | |||||||
| Food Production & Distribution | |||||||
| Manufacturing & Mechanical Engineering | |||||||
| Digital Services (Marketplace, Search Engine, Social Network) | |||||||
| Research Institutions |
On the NIS2 column: Whether an industry falls under Annex I or Annex II determines its classification — Annex II sectors never reach the highest category, regardless of size. Hover over a dot to see the assignment. In addition: you are only in scope if you also meet the size thresholds.
On the CRA column: The CRA does not bind industries, it binds manufacturers, importers and distributors of products with digital elements. Anyone who merely operates or uses such products falls under NIS2, not the CRA — so “conditional” here is not vagueness, it is the question of your role. Medical devices (MDR/IVDR) and type-approved automotive technology are among the exemptions.
ReportAct is not a consultancy. This overview is illustrative only and makes no claim to completeness or legal force. For an assessment of your specific situation we recommend legal advice. Our Terms.
The same evidence, demonstrated seven times over — and still not provable when it counts.
Evidence sprawl
Seven regimes demand essentially the same evidence — each in its own format, in separate tools.
Claiming instead of proving
Versioned documents show what was stored — not that nobody tampered with it.
Personal liability
Management is personally liable and can be barred from holding management positions.
Art. 20 NIS2 · § 38 BSIG · § 31 NISG 2026
From your existing data to audit readiness.
Creating your organisation and booking a service takes minutes. Here are the four steps where the actual work happens.
Import what you have
Connect external tools — the data master stays where it is, ReportAct only adds the compliance layer on top. Or use the guided CSV import.
Run the AI proposal
The AI pre-assesses your controls from your existing data — with reasoning, confidence and prompt hash. Nothing is changed in the process.
You decide
Change, reject or confirm every proposal. Only your confirmation seals the evidence cryptographically into the hash chain.
Audit readiness at a glance
One evidence-based readiness figure, the biggest gaps as an action list, running reporting deadlines — each linking straight into the next step.
The principle throughout: the AI proposes — sealing happens only after your confirmation. Every AI action is recorded with model and prompt hash in the tamper-evident audit log.
One service per obligation.
A new regulation means a new service — not a new tool.
Ten risk-management measures, the 24/72/30 reporting cascade, management accountability.
Learn more →ICT third-party register (XBRL) and major-incident reporting within 4 hours.
Learn more →All 93 controls as an SoA — covering roughly 70 % of NIS2 along the way.
Learn more →AI register with automatic risk categorisation and technical documentation.
Learn more →CC1–CC9 as an assessment, cross-mapped to NIS2 and ISO 27001.
Learn more →Product register and the 24 h / 72 h reporting clock — from 11 Sep 2026.
Learn more →These deadlines are running — whether you are ready or not.
The reporting duties under Art. 14 already apply from 11.09.2026 — well ahead of the full application of the remaining duties (CE conformity, technical documentation, SBOM) from 11.12.2027. Anyone starting in 2027 will miss the first deadline.
Not legal advice. Full deadlines and primary sources in the regulations overview.
Are you in scope for NIS2?
Four questions, an immediate answer, no email address. Pick your country — NIS2 only takes effect through national law.
Faster, with less effort — and proven without gaps.
Automation, deterministic workflows and generative AI work together: the routine runs by itself, every step stays traceable — and your risk becomes manageable instead of merely administered.
Automation
Connectors fetch evidence on their own, deadline clocks start with the incident. Less manual work, covered sooner.
Deterministic workflows
Concentration analysis, reporting deadlines and status changes follow fixed rules — same data, same result, traceable at any time.
Generative AI
Classification, contract analysis, drafts — always with reasoning, never a black box. You are the one who approves.
Tamper-evident
Signed and chained. Four integrity checks, publicly recomputable.
A layer over your GRC
Over 25 connectors, an API and CSV import. We seal what your stack already maintains.
Built in the EU
Developed and operated in Austria, EU data residency available.
Your first sealed piece of evidence — today.
Start without a credit card. Or take a 30-minute demo focused on your regime.