Early, not after the audit
The owner hears about the change while there is still time to act – not when the auditor asks.
Solutions · Regulatory change
The law changed. Did your contracts?
Know which laws apply to you, hear when they change, and see what each change hits – the requirements, the Controls and the contracts that rest on them.
NIS2DORAGDPRLaw monitoring
Applicability · Nordbank AB
- NIS2Essential entity
- DORAFull framework · Articles 5–15
- NoteDORA replaces NIS2 art. 21 and 23
- Confirmed byHead of Compliance
Sound familiar?
Sound familiar?
“We find out about a new requirement when the auditor asks.”
“Our contracts were signed under last year's rules.”
“Nobody can say which agreements a change in the law affects.”
Why now
Rules change faster than contracts.
NIS2, DORA and the AI Act have changed the rules for thousands of organisations in a few years – and more will follow. Every change can reach requirements you already meet, routines that run today and contracts signed long ago. The cost is rarely the change itself. It is finding out too late.
Today's alternatives and what good looks like
How it is usually solved
- A newsletter from a law firmTells you what changed – not what it means for your contracts.
- A legal databaseHolds the law, not your Controls or your agreements.
- A yearly reviewFinds the gap a year after it opened.
What good looks like
- You know which laws apply – and why.
- A change shows what it hits before anyone asks.
- Contracts and Controls are checked against the new rule.
How it runs in Paragraf
From a change in the rules to contracts and Controls that follow it.
Step 1 of 5
Know which laws apply – and why.
From your facts – country, size, sectors and type of financial entity – Paragraf decides whether NIS2 and DORA apply, and how. Every outcome has its reason, and a person confirms it.
Applicability · Nordbank AB
- NIS2Essential entity
- DORAFull framework · Articles 5–15
- NoteDORA replaces NIS2 art. 21 and 23
- Confirmed byHead of Compliance
Step 2 of 5
Hear when the rules change.
Law monitoring follows the laws and standards in your register and tells the owner when one changes – what changed, when it applies and what it hits.
Law monitoring
- ChangeISO/IEC 27001 Amd 1:2024 · climate
- Hits2 requirements · 1 Control
- OwnerCISO
- StatusNot assessed
Step 3 of 5
See exactly what changed.
Compare with shows what was added, removed and changed since the edition before – and warns first where a removed requirement was met by one of your Controls.
Compare with · ISO/IEC 27001
- Added2 requirements
- Without a Control1
- Removed0
- Controls affectedContext of the organisation
Step 4 of 5
Check contracts against the rule.
Write the requirement into your Playbook and every new contract is reviewed against it before signing. Security promises in signed contracts are matched with your routines, and the gaps show.
Playbook review · DPA, CloudOps AB
- Approval of sub-processorsMissing
- Audit rightsIn place
- Data in the EU/EEAIn place
Step 5 of 5
Turn the change into work.
Every gap becomes a decision with an owner – change the routine, renegotiate or accept the risk with a reason – and the decision is logged.
Gap · Approval of sub-processors
- ChoiceRenegotiate
- OwnerHead of Procurement
- DueIn 30 days
- LoggedWho and when
Coming next
Next: your whole portfolio, kept up to date.
These are on their way and not live yet. Join early, and help shape how they work on your own contracts.
- ComingCheck your whole portfolio
When a law or your Playbook changes, re-check every signed contract against it – and see which ones no longer hold.
- ComingFind contracts on old terms
See which agreements rest on an earlier template, clause or Playbook version, and which to bring up to date at renewal.
What you get
Three things that change.
From change to consequence
Every change is linked to the requirements, Controls and contracts it reaches, so nobody has to work it out by hand.
Decisions, not alerts
A change ends in a decision with an owner and a reason – not in another unread notification.
Hear about the change before the auditor does.
The owner gets the change, what it hits and what to decide – not a newsletter to interpret.
Before you decide
The questions that usually hold teams back.
Changing how work is followed up is a real decision. Here is how we make it a safe one.
Where do we start?
With one situation, not the whole organisation. We go through your systems and requirements together, set up the first flow with you, and then your teams build further on their own.
Do we have to change how we work?
No. Start from the contracts, templates and policies you already have. Paragraf takes over the follow-up – who does what, by when, and what proves it.
What happens to our data?
It stays yours. Everything follows your permissions, sensitive data is masked on the server and every change is logged. Ask us where data is stored and how export works – we answer in writing before you decide.
What if it isn't right for us?
Start with a limited first scope and clear acceptance criteria, agreed up front. You evaluate on your own data before you expand.
For the buying group
Everyone in the decision gets an answer.
A decision like this involves many people. This is what each of them can say when they bring it to the others.
- General Counsel“Our legal risk goes down, and I can show it.”
- Compliance“I can show evidence to the auditor or supervisor whenever they ask.”
- CISO“It follows our permissions and gives one log for people, systems and AI.”
- Procurement“Supplier terms, dates and reviews have owners, not reminders.”
- CEO“Management can see that we are in control – without asking around.”
Related
- Prepare for NIS2Duties mapped, owners assigned, evidence ready→
- Meet DORAICT contracts, register and exit plans in one place→
- Legal AIReview and negotiate within your mandate→
Next step
Fewer systems.
More control.
Book a walkthrough of your systems and requirements. We show you the thread from requirement to proof – with your own requirements.