DORA and NIS2 compliance both depend on evidence: proof that risk-management measures exist and operate, that incidents were handled and reported on time, and that resilience was tested. This system gathers that evidence from the tools that hold it and maps it to each requirement, so the people accountable can review rather than hunt.
NIS2 (Directive (EU) 2022/2555) requires essential and important entities to take cybersecurity risk-management measures across areas such as incident handling, business continuity, supply-chain security, vulnerability handling, access control and encryption, and to report significant incidents in stages: an early warning within 24 hours, a notification within 72 hours and a final report within a month. Management bodies must approve the measures and can be held liable. DORA (Regulation (EU) 2022/2554), which has applied to EU financial entities since January 2025, sets out ICT risk management, incident classification and reporting, resilience testing and a register of ICT third-party arrangements.
None of that can be met by a document written once. Supervisors ask whether controls operate, and the evidence (tickets, scan results, access reviews, test reports, training records, supplier contracts) is scattered across Jira or ServiceNow, Tenable or Qualys, the identity provider, SharePoint and inboxes. Assembling it by hand before every audit is slow and leaves gaps undiscovered until someone asks.
tickets, scans, IAM, policies, contracts
on schedule, with source and time
to NIS2 measures and DORA articles
controls without current evidence
reviews, accepts, signs
DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), applies to EU financial entities such as banks, insurers, investment firms and payment institutions, and to critical ICT providers designated under it. Compliance means having an ICT risk-management framework, classifying and reporting major ICT incidents, testing operational resilience, managing ICT third-party risk with a register of arrangements, and being able to evidence all of it to supervisors.
NIS2 is a directive covering cybersecurity across many sectors, transposed into each member state’s national law. DORA is a regulation that applies directly to the financial sector and goes further on operational resilience, testing and third-party ICT risk. For financial entities within DORA’s scope, DORA generally takes precedence as the more specific law. Which applies to you is a legal determination.
The regulation and its technical standards effectively define one: ICT risk management, incident management and reporting, resilience testing, third-party risk and information sharing, each with detailed requirements. A checklist is a starting point; what supervisors look for is evidence that each item operates. That is the part this system automates, while the interpretation stays with your compliance function.
No tool can. Compliance depends on real controls operating in your organisation, decisions by an accountable management body and judgements about scope and significance that are yours. AI reduces the labour of finding, organising and keeping evidence current, and makes gaps visible earlier. The assessment and the sign-off remain with people.
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
We start by mapping the evidence you already produce against the requirements, and showing the gaps.
30-minute technical call · no deck