Pain-free DORA evidence and ICT risk management.

Operational resilience compliance for financial institutions and their ICT providers. DORA today. UK and Swiss rules next.

Talk to usSend us one open finding

Fed up with what you’ve got in place? That’s the conversation we want.

Who it’s for
Who it’s for

Both sides of the DORA contract.

ComplianceOS produces regulator-grade evidence where a regulator demands it. Today that is DORA, for financial institutions and for every ICT provider they outsource to. Next: the UK and Swiss operational resilience regimes.

Financial institutions under DORA

Banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and fund managers.

Your register of information, your Article 30 contracts and your ICT risk framework, checked and cited before your supervisor checks them.

The financial institutions use case

ICT and service providers to those institutions

Cloud, SaaS, managed services, data and outsourced operations.

Your bank and insurer customers are sending DORA addenda and evidence requests, each with a deadline. Answer them once, with evidence they can file.

DORA or NIS2: which applies to you?

A financial institution’s critical ICT providers are NIS2 entities too, and the same evidence covers them.

Two ways to start

A fixed-scope sprint first. Continuous monitoring after.

One-off remediation

Readiness sprint

A cited gap report against DORA, plus a client-facing compliance statement. Every finding is traced to the clause, the page and the article.

€4,500 excl. VAT

Standard vendor readiness review

Book a readiness review

Platform subscription

Continuous monitoring

ComplianceOS re-checks your contracts, register data and policies as they change and as the rules move, and keeps the evidence current for the next supervisory request.

€18k a year

Platform subscription

Talk to us
ComplianceOS by Practicl AI

An audit-grade compliance and evidence engine for regulated firms.

ComplianceOS, by Practicl AI, produces regulator-grade evidence where a regulator demands it. Today that is DORA, for financial institutions and for every ICT provider they outsource to. Next: the UK and Swiss operational resilience regimes.

Built for the regulations you have to evidence

DORADORA for ICT providersMiCADue diligence
Book a Live Demo Speak to our team

Every finding is cited back to the exact source.

Different mandates, the same problem: too much to read, and too much riding on a missed line. Meet four of the people ComplianceOS was built for.

Élise Moreau

Head of Third-Party ICT Risk

Sofia Lindqvist

Head of Customer Assurance

Mathias Brandt

Partner, Financial Regulation

Marcus Feldt

Principal, Venture Capital

Élise Moreau

Head of Third-Party ICT Risk

Lúmen Banque, a fictional EU bank

Paris · 1,400 ICT vendors

DORA Art. 28 to 30Register of InformationConcentration risk

“The regulator wants every critical vendor contract to prove it has audit rights, exit plans and incident SLAs. I have 1,400 of them.”

Her problem

Under DORA, Élise must maintain a Register of Information covering every ICT third-party arrangement, and prove that contracts for critical or important functions actually contain the mandatory provisions in Article 30: audit and access rights, sub-outsourcing limits, exit strategies, incident-reporting SLAs, data location, and termination rights.

Today that means her team opens each MSA, DPA and SLA by hand, hunts for the clause, copies it into a spreadsheet, and hopes nothing was missed. Across 1,400 vendors and chains of subcontractors, a single overlooked exit clause can become a finding in the next supervisory inspection.

What ComplianceOS does for her

A DORA playbook for every contract

Upload the vendor pack once. An Article 30 playbook checks each contract for the mandatory provisions and reports them present, partial or missing, clause by clause.

Gaps with the evidence attached

Every finding links to the exact quote, page and section. “No audit rights in §11” is backed by the source text, so she can challenge a vendor or brief the board without re-reading the contract.

Feeds the Register of Information

Findings export as a structured grid that maps onto the Register and concentration-risk view, turning weeks of manual extraction into a reviewable afternoon.

Élise enters supervisory dialogue with a citation-backed gap report, not a half-finished spreadsheet.

Sofia Lindqvist

Head of Customer Assurance

Northbridge Cloud Services, a fictional managed cloud provider

Stockholm · 30 bank and insurer customers

DORA Art. 30Register dataCustomer evidence requests

“Every bank we host has sent us a DORA addendum and an evidence questionnaire, each with its own deadline. My team answers the same questions thirty times.”

Her problem

Sofia’s customers are financial entities. DORA does not regulate her firm directly, but it regulates every one of them, and they cannot comply without her. Each must hold the Article 30 provisions in its contract with Northbridge, record Northbridge in its register of information, and evidence its oversight: audit and access rights, incident notification terms, sub-outsourcing, exit plans.

So the requests arrive: addenda to negotiate, questionnaires to fill in, evidence to supply, each on a deadline set by a customer’s supervisor. Answered by hand and from scratch every time, they consume her team, and a slow or inconsistent answer puts a renewal at risk.

What ComplianceOS does for her

Her contracts read against Article 30

Upload the master agreement, the DPA and each customer’s addendum. An Article 30 playbook shows which provisions are present, partial or missing, clause by clause, with the page cited.

One evidence base for every customer

Answers and the documents behind them are kept once and reused, so the thirtieth questionnaire takes a fraction of the time of the first, and every answer matches the last.

A statement her customers can file

A cited readiness report and a client-facing compliance statement that her customers can put straight into their own register and oversight file.

Sofia answers DORA requests in days rather than weeks, the same way every time, and turns resilience evidence into a reason her customers renew.

Mathias Brandt

Partner, Financial Regulation

Whitmore Vance LLP, a fictional law firm

Frankfurt · advising an EU crypto-asset firm

MiCADORAContinuous monitoring

“My client is a European crypto-asset service provider, a CASP. The rules don’t sit still, and “compliant in March” means nothing to a supervisor in September.”

His problem

Mathias advises a crypto-asset service provider authorised under MiCA and squarely in scope for DORA. Neither is a point-in-time regime: both demand continuous monitoring. When an RTS lands, a MiCA Level-2 measure is finalised, or an incident classification threshold shifts, his client’s policies and vendor contracts have to be re-tested against the new text.

Re-reviewing a full document set every time the law moves doesn’t scale on a partner’s billing rate. So the honest answer clients usually get is “we’ll look at it at renewal”, which is exactly the gap that becomes a regulatory problem.

Why ComplianceOS is a game-changer

Playbooks that track the legislation

His regulatory playbooks are wired to the underlying legal sources. When monitored legislation changes, the playbook flags it and can update itself, so continuous monitoring becomes a setting, not a heroic effort.

Re-run the whole book in minutes

When the rules move, he re-runs the playbook across the client’s entire policy and contract set at once and sees only what changed, every finding cited back to the document and the regulation.

Advice he can defend

Each conclusion carries the verbatim source and a confidence score, so his memo to the client is evidence-backed, not a black-box opinion a regulator can pick apart.

Mathias offers continuous assurance instead of an annual scramble, and his client stays ahead of the next RTS, not behind it.

Marcus Feldt

Principal, Venture Capital

Greycastle Ventures, a fictional VC

London · Series B diligence

Data-room diligenceCross-document inconsistenciesRed flags

“Diligence is hours of reading 300 documents hoping to notice that the ARR in the deck doesn’t match the model. It’s tedious, until it costs you.”

His problem

Marcus lives in data rooms: SAFEs and the cap table, customer contracts, the financial model, IP assignments, board minutes. The value isn’t in any one document. It’s in the contradictions between them. An exclusivity clause that conflicts with another customer. A liability cap that undercuts the warranties. A revenue figure in the deck the model quietly disagrees with. Founder IP that was never actually assigned to the company.

Finding those needs a tired human to hold 300 documents in their head at 11pm. Miss one and it surfaces after the wire has cleared.

How ComplianceOS makes his life easier

Reads the whole room at once

Connect the data room and ask questions across every document together. ComplianceOS surfaces the contradictions between files, not just a summary of each one.

Inconsistencies, side by side

When the deck says one ARR and the model says another, he gets both quotes next to each other with their sources, so a five-second check replaces an hour of cross-referencing.

A red-flag report he can forward

Cross-document findings export into a structured grid that drops straight into the IC memo, every flag traceable to the exact page it came from.

Marcus spends the evening deciding on the deal, not playing spot-the-difference across a data room.

Your data stays sovereign

We don't train on your documents. We don't share them. We don't keep them longer than necessary.

GDPR-Compliant by Design

Designed to meet EU and UK data protection requirements.

ISO 27001-Aligned

Building towards ISO 27001 certification.

Encrypted

All data encrypted at rest and in transit.

EU-Sovereign Hosting

Your choice of sovereign EU infrastructure or AWS. Your data stays in the EU.

No Training on Your Data

Documents are never used to train models.

Partnerships

Your methodology. Your brand. Our engine.

We partner with law firms, compliance consultancies and audit firms. Our playbook engine encodes your own review methodology, so your IP stays yours: you deliver audit-grade compliance and evidence to your clients under your own brand, on recurring terms. We supply the engine; you keep the expertise.

Become a partner Explore the partner programme

[email protected]

Common questions

Different mandates. The same engine underneath.

Whether it’s a DORA clause, a shifting MiCA obligation or a contradiction buried in a data room, ComplianceOS reads the documents, checks them against the questions that matter, and shows its work. Every answer carries the exact quote, the page, and a confidence score you can verify in seconds. It is model-agnostic, running across several frontier models on EU-sovereign infrastructure.

100%

Findings backed by a verbatim citation

12×

Faster than manual document review

EU

Sovereign hosting · no training on your data

Book a Live Demo Speak to our team