Five regulations, one question: can you prove it?
ENS, NIS2, DORA, the AI Act and the Cyber Resilience Act each ask you, in their own way, to know your exposure and prove it to an auditor. Each page covers the obligation, what HodeiShield measures and what stays outside.
Start from your role
Each role meets one or more regulations. Pick yours and go straight to the page that fits.
Public administration and public-sector suppliers
Information systems under Royal Decree 311/2022, with limited IT staff and a conformity audit on the calendar.
Regulations
Related solutions
CISO of a mid-sized regulated company
Dozens or hundreds of ICT suppliers, supply-chain obligations to meet and a board that asks for numbers.
Related solutions
Financial entity
An ICT third-party register, incident classification and indicators for the supervisor, without a large bank's third-party engineering team.
Regulations
Related solutions
Multi-framework compliance lead
Several audits a year with the same controls repeated in each framework and evidence scattered around.
Related solutions
Organisation adopting AI
Uses or integrates AI systems and needs to know which frameworks apply and what can be measured today.
Regulations
Related solutions
Software manufacturer, importer or integrator
Products with digital elements built on third-party components, which have to be explained: what is inside.
Regulations
Related solutions
Or start from the regulation
Each page cites the official text, summarises what it requires without giving legal advice, and maps every obligation to a concrete capability and its phase of the cycle.
ENS
Royal Decree 311/2022 (National Security Scheme)
Who it reachesThe public sector and suppliers that provide it with services or solutions
ApplicationIn force since 5 May 2022
What HodeiShield measures74 HodeiShield controls based on ENS Annex II, by basic, medium and high category
Open the pageNIS2
Directive (EU) 2022/2555
Who it reachesEssential and important entities in the sectors of its annexes
ApplicationTransposition due before 18 October 2024
What HodeiShield measuresThe ten Article 21 measures, with the supply chain at the centre
Open the pageDORA
Regulation (EU) 2022/2554
Who it reachesFinancial entities and their ICT providers
ApplicationApplicable since 17 January 2025
AI Act
Regulation (EU) 2024/1689
Who it reachesProviders and deployers of AI systems
ApplicationPhased application from 2025 to 2030
What HodeiShield measuresAI Act and ISO/IEC 42001 coverage; AI governance module in preparation
Open the pageCRA
Regulation (EU) 2024/2847 (Cyber Resilience Act)
Who it reachesManufacturers, importers and distributors of products with digital elements
ApplicationConformity assessment bodies (Ch. IV) from 11 June 2026; reporting (Art. 14) from 11 September 2026; the rest from 11 December 2027
What HodeiShield measuresSupplier SBOM ingestion, per-component alerts and SBOM download
Open the page
Informational summaries, not legal advice. Exact dates and scope are in the official texts and in the national transposition law.
How to read each page
They all follow the product cycle, so you can see where each obligation lands in HodeiShield.
- SENSE
Gather evidence
Which signals and documents feed the obligation: SBOMs, scans, questionnaires, uploaded evidence.
- PREDICT
Quantify
What is measured: exposure in euros, concentration, posture per framework.
- ACT
Propose and approve
What the platform proposes and what a person with a write role approves.
- ATTEST
Prove
What you can show a third party and exactly what it proves, no more.
Questions about the use cases
What people usually ask before requesting a demo.
Does HodeiShield guarantee compliance with these regulations?
No. The platform measures your posture against the evidence you provide and points out what is missing. Being ready for an audit depends on your evidence and your decisions, not on the tool.
How is coverage measured for each framework?
HodeiShield covers 17 frameworks, including ISO/IEC 42001 and the EU AI Act. For all of them, coverage is reported as measured against each framework's canonical controls, without claiming to cover every requirement of the rule.
Is this legal advice?
No. We summarise each obligation to orient you and cite the official text. Scope, deadlines and penalties for your organisation are for your legal counsel to set from the current text and national transposition.
My regulation is not listed here.
The platform has 17 frameworks, including GDPR, ISO/IEC 27001, SOC 2 and NIST CSF 2.0. Tell us your mix of frameworks in the demo and we will say what is measured and what is not.
Tell us which regulation applies to you
In the demo we go through your mix of frameworks, the evidence you already have and what HodeiShield would measure from day one.
A conversation with a person, no commitment.