Submit initial notification
Article 5(1)(a)As early as possible; within four hours of major classification and no later than 24 hours after awareness.
EU Regulatory change intelligence
The regulation changed. Know exactly what changed—and what it touches.
NeoGRC turns official regulatory text into trackable obligations, isolates material change, identifies the affected controls, policies, risks and owners, and prepares an attributable decision for human review.
Book a focused demoDORA liveHuman review built inHosted in the European Union
AI identifies. Humans decide.Everything remains traceable.
LIVE REVIEW DEMO · DORA ARTICLE 19Major ICT incident reporting
Review readyOfficial sourceOpen EUR-Lex ↗
Commission Delegated Regulation (EU) 2025/301
“within four hours from the classification … and no later than 24 hours”
4hfrom major classification24hfrom awareness72hintermediate report1 monthfinal report
Verified regulatory text. Organisational records in this demo are illustrative.
Structured obligations
3 extractedThree reporting duties, retained with source context
Submit intermediate report
Article 5(1)(b)Within 72 hours of the initial notification, including where incident handling has not changed.
Submit final report
Article 5(1)(c)No later than one month after the intermediate or latest updated intermediate report.
Semantic comparison
Material detailDORA set the sequence. The technical standard makes it operational.
Initial notification, intermediate report and final report; time limits to be specified under Article 20.
4h / 24h initial deadline, 72h intermediate deadline and one-month final deadline.
Materiality assessment
96% confidenceOperational deadline introduced—not editorial movement
Incident procedures need explicit timers, escalation points and evidence of submission.
Triggered after the incident is classified as major under DORA.
Align policy, control design, playbook and evidence retention to the new deadlines.
Connected impact
6 objectsConcrete records affected by the reporting timetable
Starts at awareness, records classification time and escalates before the 4h / 24h boundary.
Pending reviewSection 6.4 must state the initial, intermediate and final reporting deadlines.
Pending reviewResidual risk requires reassessment after the timer and escalation control is updated.
Pending reviewRetain competent-authority receipt, submission timestamp and approved report version.
Pending review
EFElena FischerHead of Operational Resilience · accountable owner
MNMartin NovakICT Risk Manager · control owner
SLSofia LaurentCompliance Officer · reviewer
SLYOU ARE REVIEWING ASSofia Laurent · Compliance Officer
Recommended verdict
Approve a controlled update to policy and incident reporting controls.
- Add explicit 4h / 24h / 72h / one-month timers to the playbook.
- Configure escalation to Operational Resilience and Compliance.
- Retain submission receipts and approved report versions as evidence.
Nothing is published until you decide.
✓
WORKFLOW RESULTDecision recorded
JUST NOW · SOFIA LAURENTHuman review opened
Audit trailThe recommendation remains staged and attributable.
The NeoGRC regulatory intelligence pipeline
From official regulation to accountable action.
See what changed, why it matters, what it touches and who needs to decide next - without breaking the chain back to the official source.
01 · Ingest
Official source
Bring the raw PDF, HTML, delegated act or publication into a versioned library.
✓ Source retained02 · Parse
Trackable obligations
Break dense regulatory text into individually reviewable obligations with source context.
✓ Structured03 · Compare
Version intelligence
Identify additions, amendments and removals against prior regulatory versions.
✓ Change isolated04 · Prioritise
What actually matters
Separate substantive regulatory change from drafting and editorial movement.
✓ Noise reduced05 · Impact
Organisational effect
Surface affected policies, controls, risks, systems, evidence and owners.
✓ Context mapped06 · Route
Accountable ownership
Route affected work to the right owners, business units and assurance teams.
✓ Ownership assigned07 · Human review
Accountable decision
Approve, modify, reject or request further analysis before action.
✓ Human sign-off08 · Trace
Defensible record
Preserve the source, analysis, reviewer, rationale and resulting action.
✓ History retainedBring one live regulatory change
Book a regulatory change sessionStart with the update your team is working through now.
See how the change is structured, how organisational impact is identified and how it is routed for accountable review.
Connected GRC
Visualise your entire GRC structure.
Move beyond isolated registers. Explore how regulations, obligations, risks, controls, policies, evidence, actions and accountable people connect across the organisation.
DORA + GDPR: both regulatory structures are highlighted. Clear either filter to fade its exclusive records.
NIS2 · Coming soonEU AI Act · Coming soonMiCA · Coming soonCSRD/CSDDD · Coming soon
Drag nodes · scroll to zoom · drag the canvas to pan · select any node for details
Every relationship is navigable, attributable and ready for evidence—not another flat register to reconcile manually.
Risk Management
Risk should change decisions - not just populate a register.
Build a living risk environment where risks, controls, indicators, incidents and treatment actions remain connected as regulations, suppliers, technologies and operating conditions change.
Enterprise riskOperational riskICT & cyber riskThird-party riskEmerging riskRisk assessmentsRCSARisk appetiteKRIsControl mappingTreatment plansIssue management
Risk profileHigh inherent risk
Critical ICT Service Disruption
Inherent riskHighControl effectivenessModerateResidual riskMedium
03Regulations
07Controls
02Critical suppliers
04Open actions
1 KRI threshold breached Owner review required
Obligation statusReview required
DORA · ICT risk obligation
Maintain resilient ICT systems and controls proportionate to operational exposure.
03Mapped controls
05Evidence items
01Evidence item stale
Compliance Management
Compliance should begin with the obligation, not the spreadsheet.
Create a traceable line from regulatory source to obligation, control, policy, evidence and accountable owner. When requirements change, see whether existing controls still address them.
Regulatory inventoryObligation registersControl mappingCompliance assessmentsControl ownershipPolicy mappingEvidence managementAttestationsExceptionsMonitoring & testingIssues & remediationReporting
Audit Management
Give Internal Audit the context behind the control.
Plan audits against the risks that matter, execute consistently and maintain evidence from planning through remediation. Auditors begin with connected context instead of rebuilding it for every engagement.
Audit universeRisk-based planningRolling audit plansEngagementsAudit programmesWorkpapers & testingSamplingEvidence requestsFindingsRoot causeManagement actionsClosure validation
Active engagementFieldwork
ICT Third-Party Risk Audit
68%Fieldwork
04Findings
01High-risk issue
12/14Evidence received
Planning complete
5 management actions in follow-up
Connected impact
One regulatory change. Every affected relationship.
Make the consequences of change visible in one view so teams can coordinate remediation instead of discovering impact independently.
DORA RTSMaterial update detected
Obligations2 changed
Risk1 reassessed
Controls4 impacted
Policies7 reviewed
Owners3 notified
Evidence6 requested
Audit1 affected
Actions2 assigned
EU Regulatory Intelligence
Europe does not have a shortage of regulation. It has a shortage of regulatory context.
Follow the requirements affecting your organisation, understand how they evolve and connect obligations to the risks, controls, policies and evidence used to demonstrate compliance.
EU regulationLive
DORA
Digital Operational Resilience ActBanks, insurers, investment firms and ICT third parties
EU regulationLive
GDPR
General Data Protection RegulationAny organisation processing EU personal data
EU regulationComing
NIS2
Network and Information Security DirectiveEssential and important entities across critical sectors
EU regulationComing
AI ACT
EU Artificial Intelligence ActOrganisations developing or deploying AI systems in the EU
EU regulationComing
MiCA
Markets in Crypto-AssetsCrypto-asset issuers and service providers
EU regulationComing
CSRD / CSDDD
Sustainability reporting & due diligenceLarge EU companies and qualifying non-EU organisations
Recognised GRC practices
Built around recognised GRC practices.
NeoGRC supports programmes aligned to recognised risk, compliance, audit, security and resilience frameworks while allowing each organisation to tailor methodology, scoring, ownership and evidence.
Risk
ISO 31000 · IEC 31010
Compliance
ISO 37301 · ISO 37001
Audit
IIA Global Internal Audit Standards · ISO 19011
Security & resilience
ISO/IEC 27001 · ISO 22301
Also configurable around NIST CSF, COBIT, COSO and SOC 2 mappings where relevant. Alignment support does not imply NeoGRC certification.
Explore framework coverageBusiness outcomes
Less chasing. More judgement. Better evidence.
Understand how a connected GRC model improves the work - without unsupported efficiency claims.
Know sooner
Identify regulatory and risk changes before they become last-minute remediation exercises.
Respond faster
Route work to the people responsible for the affected control, policy, risk or obligation.
Reuse evidence
Connect common controls and evidence across regulations and assurance programmes.
Prove decisions
Retain the source, analysis, reviewer, rationale, action and final decision.
Built for accountable teams
Built for the people accountable when something changes.
Each stakeholder gets the connected context and decision path relevant to their responsibility.
Chief Risk Officer
See enterprise exposure, control effectiveness and treatment priorities.
Chief Compliance Officer
Understand obligations, ownership, gaps and regulatory change.
Head of Internal Audit
Build risk-based assurance programmes and track remediation.
CISO / ICT Risk
Connect cyber risks, obligations, controls and resilience requirements.
DPO / Privacy
Maintain privacy obligations, assessments, controls and evidence.
Board / Executive
See what requires attention without navigating operational detail.
Industry context
Designed for organisations where accountability matters.
Sector-specific regulatory pressure and operating-risk context shape the way GRC should work.
Banking & Financial Services
DORA · GDPR · AI Act · ICT risk · outsourcing · operational resilience
Insurance
Operational resilience · third-party risk · data governance · assurance
Fintech & Payments
DORA · payments ecosystem · GDPR · cyber risk · vendor dependency
Technology & SaaS
NIS2 · GDPR · AI Act · ISO 27001 · customer assurance
Critical & Essential Services
NIS2 · resilience · operational risk · continuity · incident governance
Human-in-the-loop by design
AI can analyse the obligation. It should not own the decision.
NeoGRC accelerates document analysis, comparison, impact identification and recommendation. Accountability remains with the organisation.
AI identifies. Humans decide. Everything remains traceable.See the review workflow
ApproveModifyRejectRequest further analysis
Regulatory sourceDORA RTS · Article 19
System recommendationUpdate incident response policy
ReviewerAccountable owner
RationaleRequired before decision
Resulting actionPending human review
One platform · two operating modelsFor Enterprise For GRC Consultants
Operate NeoGRC around the way you deliver GRC.
The platform depth stays the same. The difference is who controls the workspace and how work is delivered.
One organisation. Shared accountability.
Multiple business units, regulations, owners and assurance functions in one organisation-wide operating model.
Explore NeoGRC EnterpriseMany secure client workspaces. Your advisory model.
Regulatory activation, advisory delivery and multi-engagement management with fully white-labelled portals.
Explore NeoGRC for ConsultantsCustomer evidence
Show how GRC work changes in practice.
NeoGRC will publish named customer stories, approved screenshots and verified outcomes only when permissions exist. No fabricated logos, anonymous quotes or invented efficiency metrics.
Evidence standard
A small amount of real proof is more valuable than large unsupported claims.
01Context02Challenge03NeoGRC intervention04Verified result05Approved proof
Founding Partner Programme Trust by architecture
GRC contains your most sensitive governance data. Treat it accordingly.
Architecture-led controls for security, privacy and procurement stakeholders.
EU data residency
Platform data hosted in European Union.
Tenant isolation
Row-level workspace isolation enforced at the database layer.
Decision history
Attributable change, review and approval records remain preserved.
Controlled deployment
Versioned configuration, controlled change and rollback.
Human review
Material AI-supported decisions enter accountable review workflows.
European GRC Intelligence
Practical intelligence for European GRC teams.
A structured knowledge centre for regulatory and implementation questions, built around primary sources, dated review and practitioner context.
Regulatory change
Material European regulatory updates with source links and review dates.
Implementation guides
DORA, NIS2, AI Act, GDPR, MiCA and sector-specific operating guides.
GRC practice
Risk appetite, RCSA, control testing, audit planning and evidence management.
Regulation comparisons
Practical mappings across regulations, standards and frameworks.
Templates & tools
Registers, control libraries, gap assessments and applicability tools.
Regulatory tracker
Effective dates, delegated acts, RTS/ITS and national implementation changes.
Questions enterprise teams ask
Understand NeoGRC before the first conversation.
Concise answers to the questions that shape a serious GRC platform evaluation.
What is a GRC platform?+
A GRC platform connects governance decisions, risk exposure, compliance obligations, controls, evidence, audit assurance and remediation in one operating model.
How does NeoGRC track regulatory change?+
NeoGRC ingests official sources, structures obligations, compares versions, isolates material change, analyses organisational impact and routes the result for accountable human review.
Can NeoGRC compare different versions of an EU regulation?+
Yes. Version-aware comparison links additions, amendments and removals back to the relevant source text and review history.
How does NeoGRC connect regulations to risks and controls?+
Obligations are related to organisational risks, controls, policies, evidence, audits and actions so downstream impact remains visible.
Can NeoGRC support multiple EU regulations at the same time?+
NeoGRC is regulation-agnostic by design, allowing common controls and evidence to be reused as regulatory coverage expands.
How does human review work when NeoGRC uses AI?+
Material outputs enter an attributable workflow where a responsible person can approve, modify, reject or request further analysis.
Can NeoGRC support ISO 31000, ISO 37301 and internal audit programmes?+
NeoGRC can be configured around recognised risk, compliance and audit practices without imposing one rigid methodology.
Where is NeoGRC data hosted?+
NeoGRC platform data is hosted in the European Union. Deeper architecture and data-handling details are available in the Security section.
A focused first conversation
When regulation, risk or assurance changes, know your next move.
Bring us the regulation, risk programme, compliance challenge or audit workflow creating friction. We will explore how information flows today, where accountability or evidence breaks down and how a connected GRC operating model could improve it.
Book a focused GRC session No generic sales presentation. Start with your actual GRC challenge.