Regulations & directives
- EUAI Act
- EUNIS2
- EUCRA
- EUDORA
- EUGDPR
- EUESG / CSRD
- EUMachinery Reg. 2023/1230
AI-native compliance engine
Your entire compliance posture, on one screen.
Kansa reads your documentation, assesses it against any regulation, and returns cited, audit-ready findings in minutes — not weeks. One engine. Every framework. Nothing hidden.
- Time to assess
- 9m was weeks
- Requirement coverage
- 100% by design
- Throughput / team
- 3–5× vs. manual
Compliance posture
Tenant · Acme Industrial GmbH · illustrative
214
controls compliant
38
partial / in review
11
gaps to close
Coverage matrix — frameworks × control domains
| Framework | Gov. | Access | Ops | Resil. | Supply | Report |
|---|---|---|---|---|---|---|
| ISO 27001 | Governance: OK | Access: OK | Operations: PT | Resilience: OK | Supply chain: OK | Reporting: OK |
| NIS2 | Governance: OK | Access: PT | Operations: OK | Resilience: PT | Supply chain: OK | Reporting: GAP |
| DORA | Governance: OK | Access: OK | Operations: OK | Resilience: OK | Supply chain: GAP | Reporting: PT |
| EU AI Act | Governance: OK | Access: OK | Operations: PT | Resilience: — | Supply chain: PT | Reporting: OK |
| TISAX® | Governance: OK | Access: OK | Operations: OK | Resilience: OK | Supply chain: PT | Reporting: — |
| IEC 62443 | Governance: PT | Access: OK | Operations: OK | Resilience: GAP | Supply chain: OK | Reporting: OK |
- Compliant
- Partial
- Gap
- Not in scope
01 — The engine
How the engine runs
Four stages, one continuous pipeline. Every run is structured, repeatable and traceable end to end.
-
Upload
Drop in any documentation — PDF, Word, Excel, PowerPoint. Kansa converts and reads all of it.
-
Understand & assess
Requirements and evidence are evaluated against your chosen regulation — requirement by requirement.
-
Get clarity
A structured, audit-ready review — every finding cited to its source paragraph. No black boxes.
-
Act
Prioritised, actionable recommendations to close gaps — plus AI chat grounded in your own evidence.
02 — Coverage
One engine. Every framework.
Kansa is regulation-independent. The same assessment method runs across directives, management systems and standards — and any custom framework you define.
Management systems
- ISO27001
- ISO27701
- ISO42001
- ISO9001
- ISO50001
- IEC62443
- VDATISAX®
Standards & frameworks
- AICPASOC 2
- BSIC5
- ISO22301
- ISO37301
- ISACACOBIT
- CSACCM
- OECDAI Principles
- ··+ any custom framework
03 — Evidence
Every verdict is cited
Each finding traces back to the exact paragraph it came from. Requirement, the source it was read against, and a verdict you can defend in an audit.
Secure authentication is enforced for access to systems and applications.
“All administrative access requires multi-factor authentication via the corporate identity provider; sessions expire after 15 minutes of inactivity.”
InfoSec Policy v4.2 — §3.1, p.12
Activities are monitored and anomalies acted upon.
“Security events are logged centrally. Alerting thresholds are defined for production, with staging coverage planned for Q3.”
Monitoring Standard v2.0 — §5.4, p.7
RecommendExtend alerting coverage to staging to close the scope gap.
Critical ICT third-party arrangements are governed and exit-tested.
No evidence found for documented exit strategies covering critical ICT providers.
No matching source paragraph
RecommendAuthor and approve exit plans for the two critical providers in register.
Grounded AI chat answers only from your own evidence — never invented.
04 — The difference
Not a chatbot. Not just another GRC tool.
Kansa determines compliance through structured assessment — where others only generate text or manage process.
| Capability | Kansa | LLM / AI tools | GRC platforms |
|---|---|---|---|
| Core action | Determines compliance | Generates answers | Manages process & evidence |
| Method | Structured, methodology-driven | Prompt-dependent | Manual workflows |
| Consistency | Consistent by design | Varies per run | Depends on the expert |
| Traceability | Cited to source paragraph | Often a black box | Evidence stored, not assessed |
| Result | Immediate, usable in minutes | Needs verification | Weeks of expert effort |
05 — Operational impact
From cost center to scalable engine
GRC delivery stops being consultant-bottlenecked. The numbers, measured in the field.
80%+
reduction in delivery time
weeks of work → minutes
3–10×
more assessments / consultant
capacity unlocked, not replaced
100%
requirement coverage
by design, every run
60%+
gross-margin potential
on compliance delivery
Reference projects span enterprises up to ~600,000 employees.
06 — Security & sovereignty
Sovereign by design. Compliant by default.
Your data stays yours — processed in the EU, never used to train any model. Ever.
Your data stays yours
Content is never used to train any AI model — and processed in real time, never stored permanently.
EU infrastructure
Hosted in leading European cloud regions. Data stays in the EU, with no transfer outside.
Encrypted & isolated
TLS 1.2+/1.3 in transit, AES-256 at rest. Enterprise SSO (SAML 2.0 / OIDC), RBAC, strict tenant isolation.
ISO/IEC 27001 certified
GDPR compliant, with continuous monitoring, regular vulnerability assessments and independent security testing.
Sovereign deployment
Not tied to one hyperscaler — AWS, Azure, STACKIT or regional / sovereign providers.
European digital sovereignty
One platform connecting European regulations, sovereign frameworks and operational standards.
Take control
Put your whole posture on one screen.
See Kansa run a live assessment against your own frameworks — from weeks to minutes.