Governance modules.
One compliance record.

Answer structured questions across the assessment areas your organisational context activates. Maturity is indicated by Priventia from your responses, never self-declared, and stated in bounded language rather than as a score.

Remediation actions drawn from the obligations indicated for your organisation, each citing the obligation it addresses. The Compliance Intelligence Report carries the roadmap today; the workspace roadmap is being rebuilt from Gap Assessment findings.

DPIA, LIA, TIA, and PIA with structured question frameworks and risk-scored outcomes. Residual risk is assessed using likelihood and severity matrices, never declared by the user. DPO sign-off workflow built in.

Full RoPA lifecycle with Article 30 compliant record structure, DPIA screening triggers, transfer impact assessment flags, and jurisdiction-specific fields for POPIA and Kenya DPA requirements.

Receive, verify and respond to data subject requests through a managed lifecycle: public intake with configurable settings, identity verification, jurisdiction-specific deadline rules, and documented responses. Reporting shows request volumes, timeliness and outcomes across all active jurisdictions.

Schedule monitoring activities against specific controls. Log findings. Track remediation. Evidence accumulates automatically into your compliance record, building an auditable chain from obligation to corrective action.

A current view of obligations, controls, evidence and open findings across all active jurisdictions, with maturity indications over time, open roadmap items and overdue monitoring activities.

The platform’s regulatory ontology functions as a queryable knowledge graph. The Regulatory Impact Capability surfaces six analytical scenarios: regulatory alerts with due-date tracking, enforcement cascade analysis tracing how a single ruling ripples through obligations and controls, control reuse intelligence showing which controls satisfy multiple regulations simultaneously, jurisdiction impact queries showing the full regulatory burden of entering a new market, and an instruments overview across all supported regimes.

One-click export of your complete compliance record with full regulatory traceability. Every control links to a legal obligation. Every obligation links to a source law. Every conclusion is supported by evidence. Structured for supervisory authority review.

Structured AI governance through inventory, risk classification, conformity assessment readiness, and ongoing monitoring aligned with global AI governance frameworks. Register all AI systems, classify by risk tier (prohibited, high-risk, limited, minimal), apply governance controls per tier, prepare high-risk systems for conformity assessment (self-assessment or notified body) and track its completion and certificate expiry, and monitor throughout the AI lifecycle.

Create and maintain a centralised supplier registry. Capture supplier name, country, industry, supplier tier, and products supplied. The registry forms the foundation for risk-based due diligence across your supply chain, traced to obligations under CSDDD, LkSG, UK MSA, and UNGPs.

Priventia assesses supplier risk based on geography, sector, commodity, and labour risk indicators. Each supplier is assigned a risk tier (Low, Medium, High) that determines the intensity of due diligence required. Risk classification drives the controls applied downstream.

Structured risk assessment covering forced labour, child labour, environmental harm, indigenous land rights, and worker safety. Each supplier receives a risk profile based on assessment outcomes. Assessment questions map to specific obligations under CSDDD, LkSG, and UNGPs.

Implement operational controls traced to legal obligations: supplier code of conduct, contractual due diligence clauses, audit rights, and corrective action procedures. Each control is linked to the specific obligation it addresses and the regulation that imposes it.

Schedule and track monitoring activities: supplier audits, compliance questionnaires, and site inspections. Findings are logged, categorised by severity, and linked to the controls and obligations they relate to. Frequency escalation rules apply to high-risk suppliers.

Track the full grievance lifecycle: complaint submitted, case opened, investigation, remediation plan, closure. Accessible to workers, NGOs, unions, and community members. Required by CSDDD (complaint procedure for affected stakeholders), UNGPs (operational grievance mechanisms), LkSG (complaint procedure), and OECD guidelines (remediation process).

Where adverse impacts are identified through monitoring or grievance mechanisms, remediation measures are documented and tracked: supplier corrective action plans, termination of relationship, or compensation and remedy. Supplier disengagement as a last resort follows responsible exit procedures.

Export your complete CDG compliance record with full regulatory traceability. Includes: supplier risk register, due diligence process, monitoring records, grievances received, remediation actions, and evidence. Annual due diligence reports and modern slavery statements generated from platform evidence. Structured for supervisory authority review.

Govern cybersecurity risk management through structured control frameworks, regulatory obligation mapping, and continuous assurance monitoring aligned to NIS2 and DORA. Track board-level accountability, control implementation status, and evidence of risk treatment across all critical systems.

Track and evidence incident reporting obligations under NIS2 and DORA, including regulatory notification timelines, incident classification documentation, and supervisory authority reporting records. Governs the multi-stage reporting lifecycle from early warning through final report submission.

Govern and evidence operational resilience testing obligations under DORA, including TLPT programme requirements. Track test schedules, findings, remediation actions, and evidence of testing completion for supervisory review.

Maintain an ICT third-party oversight register aligned to DORA and NIS2 supply-chain obligations, including contractual clause tracking, concentration risk visibility, and monitoring evidence. Governs the compliance lifecycle for critical ICT service providers.

Evidence compliance with resilience and recovery obligations under NIS2, DORA, and CER through structured documentation, testing records, and monitoring of continuity controls. Tracks business continuity plans, disaster recovery procedures, and crisis communication evidence.

Governance of content moderation policies, illegal-content notice mechanisms, and user complaint handling. Moderation decisions are logged with traceable reasoning, notices are triaged within defined timeframes, and complaint outcomes are recorded for audit.

Transparency reporting on moderation activity, cooperation with supervisory authorities, and researcher data access governance. Reporting evidence accumulates on the platform so the annual obligations are compiled from records, not reconstructed.

Trader traceability for marketplaces and protection against manipulative interface design. Covers know-your-business-customer verification, and the design review that keeps choice architecture free of dark patterns.

Recommender system transparency and, for very large platforms, systemic risk assessment and mitigation governance. Algorithm transparency obligations are evidenced alongside the risk assessments that supervisory review expects.

Risks surfaced anywhere on the platform converge into one register: gap assessments, impact assessments, monitoring findings and supplier due diligence all feed it. Each risk links to the controls that treat it and the monitoring that watches it, with likelihood and severity ratings and tracked actions.