The evidence lives in spreadsheets
When the auditor asks, someone spends a week chasing email. In the EU's DORA dry run, only 6.5% of registers passed every data-quality check.
Roles · Compliance & risk
Every requirement owned. Every answer proven.
NIS2, DORA, GDPR and the AI Act all land on the same desk. Paragraf turns each requirement into an owner, a routine and evidence you can show, so you walk into the audit or the board meeting with proof, not spreadsheets.
NIS2DORAGDPRAI ActISO 27001
Requirement · NIS2 Art. 21(2)(d)
- OwnerHead of Risk
- RoutineSupplier review · yearly
- Evidence14 of 14 suppliers
- LoggedYes
The pressure
More rules. The same team.
Management is now accountable
Under NIS2 Art. 20 and DORA Art. 5, the management body approves the measures and answers for them. They will ask you where you stand.
Every new rule becomes a new list
The same control gets documented again for each framework, by different people, in different places.
How it works
Example: the board asks where you stand on NIS2.
Step 1 of 4
Requirements become controls.
NIS2 is already built in, article by article. You map each duty to a control once, and reuse the control for DORA, GDPR and ISO 27001.
Control · Supplier security
- NIS2Art. 21(2)(d)
- DORAArt. 28
- ISO 27001A.5.19–5.22
Step 2 of 4
Every control gets an owner and a date.
The routine runs as a flow. People get a task when it is their turn, not a spreadsheet to update.
Routine
- OwnerHead of Risk
- RunsEvery year · March
- NextIn 21 days
Step 3 of 4
Evidence is collected where the work happens.
Signed contracts, completed training and approved reviews attach themselves to the control. Nobody chases anything by email.
Evidence
- Supplier reviews14 of 14
- Training96% completed
- Approved byCISO
Step 4 of 4
The board sees the same truth you do.
A live report shows status per article, what is missing and who owns it. Management approval is logged, as NIS2 Art. 20 requires.
Board report · NIS2
- Controls in place38 of 41
- Gaps3, all with owners
- Approved by managementLogged
Works with or without Luis. Everything above your team can do on its own. Luis finds the gaps faster, drafts the summary for the board and answers with the source.
Check yourself
Five questions. Two minutes.
Answer honestly. You get one recommended place to start. Nothing is saved or sent.
Where most teams like yours start
Prepare for NIS2
Map the duties once, give every one an owner and let the evidence build up as the work gets done.
Before you decide
Make it a safe decision.
- Start with one regulationA limited first scope with acceptance criteria agreed up front.
- Hosted in the EUOr on your own servers, with local AI.
- Your data stays yoursExport everything, any time, in open formats.
- No AI requiredEvery step works by hand. AI only makes it faster.
We have no budget for another system.
Then don't buy another one. Start with the regulation in front of you. The next requirement lands on the same foundation instead of in a new tool, so the cost goes down over time.
We already have it in Excel and SharePoint.
Keep the content. We import your requirements, policies and contracts. What changes is the follow-up: who does what, by when, and what proves it, without anyone updating a list.
Can we trust the AI?
You don't have to. Nothing depends on it. When you use Luis, every answer shows its source and stays within your permissions, and a person approves what counts as evidence.
Where is our data, and which certifications do you hold?
Data is hosted in the EU, or on your own servers. ISO 27001, ISO 9001 and ISO 14001 are in progress, and we tell you exactly where we are. The Trust center has the details, and we answer your security questionnaire in writing before you decide.
For the buying group
What you can tell the others.
You rarely decide alone. One foundation means each colleague gets their own part, and everyone sees the same truth.
- To the CISOSupplier security under NIS2 sits in the same thread as the contracts.
- To LegalContract obligations become controls, with evidence attached.
- To managementYou approve the measures. Now you can see them, live.
- To the CFOOne foundation instead of a new tool for every rule.
- To ITEU hosting or your own servers, with permissions and a full log.
Send a short summary to a colleague.
Go deeper
- Prepare for NIS2Duties mapped, owners assigned, evidence ready→
- Meet DORAICT contracts, register and exit plans in one place→
- ComplianceFrom requirement to Control to evidence→
Next step
Walk in with proof.
Book a walkthrough with your own requirements. We show you the thread from requirement to evidence, on your material, before you decide anything.