Understand your supply chain. Manage risk. Prove compliance.
Your customers ask about your supply chain, regulators ask about your security measures. ReportAct brings suppliers, risks and controls together in one evidence base — cryptographically sealed, independently verifiable. Captured once, for every regime. Coming soon.
A risk in the supply chain — you immediately see which supplier it affects you through.
Are you affected by NIS2? Find out in four questions.
Whether it affects you is decided first by your sector — not your headcount. Instant result, no email address required. Choose your country, since NIS2 only takes effect through national law.
These deadlines are running – whether you're ready or not.
Six regimes, six timelines – the full deadline history, sources and background are in the Regulations overview.
Not legal advice. Full deadlines, primary sources and the note on the EU AI Act "Digital Omnibus" are in the Regulations overview.
You prove the same evidence over and over – and when it counts, you cannot prove what applied when.
Evidence sprawl
NIS2, DORA, ISO 27001, EU AI Act, GDPR and SOC 2 all require essentially the same evidence – each regime in its own format. The same evidence up to six times, in separate tools.
Claiming instead of proving
When regulators ask "Prove what applied at point X in time", most tools produce versioned documents – but no cryptographic proof against backdating.
Management-body accountability
Management bodies must implement the risk-management measures, supervise their implementation and attend training themselves (Art. 20 NIS2 · § 38 BSIG · § 31 NISG 2026). As a last resort, supervisors may temporarily bar them from their function.
Does this sound familiar?
Six frameworks, one platform – with role-specific priorities for every team.
CISO under audit pressure
Turnkey NIS2 + ISO bridge, management-accountability records and the sealed "state-at-point-X" proof.
ICT Risk / Bank
ICT register, incident reporting to FMA/BaFin and cross-mapping to ISO 27001 and AI Act – in one pack.
SaaS CISO / DPO
Prove once across NIS2/ISO/SOC 2/GDPR plus Trust Center and verifiable evidence you can show customers directly.
Do you recognise yourself here?
Tell us about your situation – we'll show you in 30 minutes exactly what ReportAct delivers for your regime.
Book a Demo| Industry / Sector | NIS2 | DORA | ISO 27001 | EU AI Act | GDPR | SOC 2 |
|---|---|---|---|---|---|---|
| Banks & Financial Market Infrastructure | ||||||
| Insurance & Reinsurance | ||||||
| Asset Managers & Investment Funds | ||||||
| Payment Service Providers & E-Money Institutions | ||||||
| Crypto Asset Service Providers (CASP / MiCA) | ||||||
| Energy & Utilities | ||||||
| Transport & Logistics | ||||||
| Healthcare | ||||||
| IT Infrastructure & Cloud Services | ||||||
| Public Administration | ||||||
| AI Providers & Operators (cross-sector) | ||||||
| Drinking Water & Wastewater | ||||||
| Space & Ground Infrastructure | ||||||
| Managed Service Providers (MSP/MSSP) | ||||||
| Postal & Courier Services | ||||||
| Waste Management | ||||||
| Chemicals & Chemical Products | ||||||
| Food Production & Distribution | ||||||
| Manufacturing & Mechanical Engineering | ||||||
| Digital Services (Marketplace, Search Engine, Social Network) | ||||||
| Research Institutions |
On the NIS2 column: whether a sector falls under Annex I or Annex II determines its classification — Annex II sectors never reach the top category, regardless of their size. Hover over a dot to see the mapping. In addition: only entities that also meet the size thresholds are affected.
ReportAct is not a consulting firm. This overview is provided for illustrative purposes only and does not claim to be exhaustive or legally binding. For a concrete assessment of your obligations, we recommend seeking legal advice. Our Terms & Conditions apply.
One evidence base. Every regime. Provable.
Prove once – run anywhere. No tool switching, no rip-and-replace.
Prove once
Capture evidence once. Framework packs credit it across all regimes – one control, one proof, deduplicated across NIS2, DORA, ISO 27001 and the AI Act.
Cryptographically seal
Every piece of evidence is signed with RSA-PSS-SHA256 and chained blockchain-style – each entry binds content, timestamp and predecessor hash. Any modification, deletion or backdating breaks the chain and is immediately visible.
Verify independently
Every sealed piece of evidence receives a public Verify URL. Regulators, auditors or business partners verify cryptographically – without a ReportAct account, without platform access. Four verification points: content, chain hash, signature, predecessor link.
One use case per obligation – sorted by framework.
Every obligation is its own use case – the engine behind it counts every control automatically across all booked use cases. New regulation means a new use case, not a new tool.
The ten risk-management measures under Art. 21(2) NIS2, CIR controls and the 24/72/30 notification cascade – with automatic deadline tracker, asset register for essential and important entities (Annex I/II) and management-accountability records for governing bodies.
Learn more →ICT risk management, complete third-party register (RT.02.xx ESMA ITS, XBRL export), major ICT incident management (Art. 17–23) with 4-hour classification deadline and TLPT documentation – with cross-mapping to ISO 27001 and AI Act.
Learn more →All 93 controls of ISO/IEC 27001:2022 as a complete SoA, asset register (Annex A) and risk register per ISO 27005. Covers approximately 70 % of NIS2 requirements – maintained once, automatically credited across all active packs.
Learn more →AI system register with AI-assisted risk categorisation (Art. 6–7, Annex III), conformity assessments, Fundamental Rights Impact Assessment and post-market monitoring (Art. 72) – technical documentation (Annex IV) as sealed evidence. Cross-mapping to DORA.
Learn more →Records of processing activities (ROPA Art. 30), Data Protection Impact Assessment (DPIA Art. 35) with AI-assisted drafting, DSAR inbox with public request form (/dsar/[slug]) and TOM assessment under Art. 32 – seamlessly linked to ISO 27001.
Learn more →All nine categories CC1–CC9 (Common Criteria) as a structured assessment, fully cross-mapped with NIS2 and ISO 27001. Sealed evidence as the basis for Type II reports – usable directly in customer questionnaires and Trust Center.
Learn more →Supply chain security you can prove.
Your suppliers are your biggest evidence risk — and your customers are already asking about them. One register serves NIS2, DORA and ISO 27001 at the same time.
Every supplier captured and classified
AI classifies each supplier as critical or non-critical — with a traceable rationale, never a black box. You confirm, the system documents.
Concentration risk at a glance
Too much riding on one provider or one country? Calculated from your register — not estimated — and filed as sealed evidence.
Contracts checked automatically
AI checks supplier contracts clause by clause against your obligations — with a source reference and quote. Today for DORA, more frameworks to follow.
Questionnaires instead of email ping-pong
Send security questionnaires per supplier, answers come back through a portal — you also answer your customers' questionnaires from the same pool.
Connected to your systems
ServiceNow, Microsoft Entra ID and AWS feed data in automatically — connectors for further systems such as SAP and Google are in progress.
Coming soon: the supplier database
Certificates, regulatory obligations and ownership structure per supplier — with proactive alerts when something changes, and automatic reassessment. That's the direction we're building toward.
Compliance you can prove.
Proof instead of assertion – for every regime, not just the supply chain.
Every piece of evidence is signed with RSA-PSS-SHA256 and chained blockchain-style. Four integrity checks – content, chain hash, signature, predecessor link – make it publicly verifiable without having to trust ReportAct.
Tamper-proof & verifiable
RSA-PSS-SHA256 signed, chained blockchain-style. Four integrity checks: content, chain hash, signature, predecessor link. Every piece of evidence receives a public Verify URL – no account required.
Learn more →Evidence layer over existing GRC
Over 25 connectors plus REST API and CSV import with AI column mapping. ReportAct seals what your existing stack already maintains – no rip-and-replace.
Learn more →Built in the EU
ReportAct is developed and operated in Austria. EU data residency is available – the cryptographic evidence chain makes the content and timing of every piece of evidence verifiable independently of the hosting environment.
Your first sealed record – today.
In a 30-minute call we show you what ReportAct delivers for your regime – NIS2, DORA, ISO 27001, GDPR or SOC 2 – no obligation, tailored to your situation.