Four governance domains.
One compliance record.

Answer structured questions across 44 compliance domains. Maturity scores are determined by Priventia based on your responses, not self-declared. Scores are weighted by enforcement severity and regulatory priority per jurisdiction.

Gap findings automatically become prioritised roadmap actions, sorted by enforcement severity and regulatory risk weight. Each action links to the specific obligation that triggered it and the control it addresses.

DPIA, LIA, TIA, and PIA with structured question frameworks and risk-scored outcomes. Residual risk is assessed using likelihood and severity matrices, never declared by the user. DPO sign-off workflow built in.

Full RoPA lifecycle with Article 30 compliant record structure, DPIA screening triggers, transfer impact assessment flags, and jurisdiction-specific fields for NDPA, POPIA, and Kenya DPA requirements.

Schedule monitoring activities against specific controls. Log findings. Track remediation. Evidence accumulates automatically into your compliance record, building an auditable chain from obligation to corrective action.

Real-time compliance posture across all active jurisdictions. Board-ready analytics showing maturity trajectory, enforcement exposure, open roadmap items, and overdue monitoring activities.

The platform’s regulatory ontology functions as a queryable knowledge graph. The Regulatory Impact Capability surfaces six analytical scenarios: regulatory alerts with due-date tracking, enforcement cascade analysis tracing how a single ruling ripples through obligations and controls, control reuse intelligence showing which controls satisfy multiple regulations simultaneously, jurisdiction impact queries showing the full regulatory burden of entering a new market, and an instruments overview across all supported regimes.

One-click export of your complete compliance record with full regulatory traceability. Every control links to a legal obligation. Every obligation links to a source law. Every conclusion is supported by evidence. Structured for supervisory authority review.

Structured AI governance through inventory, risk classification, conformity assessment, and ongoing monitoring aligned with global AI governance frameworks. Register all AI systems, classify by risk tier (prohibited, high-risk, limited, minimal), apply governance controls per tier, complete conformity assessments for high-risk systems, and monitor throughout the AI lifecycle.

Create and maintain a centralised supplier registry. Capture supplier name, country, industry, supplier tier, and products supplied. The registry forms the foundation for risk-based due diligence across your supply chain, traced to obligations under CSDDD, LkSG, UK MSA, and UNGPs.

Priventia assesses supplier risk based on geography, sector, commodity, and labour risk indicators. Each supplier is assigned a risk tier (Low, Medium, High) that determines the intensity of due diligence required. Risk classification drives the controls applied downstream.

Structured risk assessment covering forced labour, child labour, environmental harm, indigenous land rights, and worker safety. Each supplier receives a risk profile based on assessment outcomes. Assessment questions map to specific obligations under CSDDD, LkSG, and UNGPs.

Implement operational controls traced to legal obligations: supplier code of conduct, contractual due diligence clauses, audit rights, and corrective action procedures. Each control is linked to the specific obligation it addresses and the regulation that imposes it.

Schedule and track monitoring activities: supplier audits, compliance questionnaires, and site inspections. Findings are logged, categorised by severity, and linked to the controls and obligations they relate to. Frequency escalation rules apply to high-risk suppliers.

Track the full grievance lifecycle: complaint submitted, case opened, investigation, remediation plan, closure. Accessible to workers, NGOs, unions, and community members. Required by CSDDD (complaint procedure for affected stakeholders), UNGPs (operational grievance mechanisms), LkSG (complaint procedure), and OECD guidelines (remediation process).

Where adverse impacts are identified through monitoring or grievance mechanisms, remediation measures are documented and tracked: supplier corrective action plans, termination of relationship, or compensation and remedy. Supplier disengagement as a last resort follows responsible exit procedures.

Export your complete CDG compliance record with full regulatory traceability. Includes: supplier risk register, due diligence process, monitoring records, grievances received, remediation actions, and evidence. Annual due diligence reports and modern slavery statements generated from platform evidence. Structured for supervisory authority review.

Govern cybersecurity risk management through structured control frameworks, regulatory obligation mapping, and continuous assurance monitoring aligned to NIS2 and DORA. Track board-level accountability, control implementation status, and evidence of risk treatment across all critical systems.

Track and evidence incident reporting obligations under NIS2 and DORA, including regulatory notification timelines, incident classification documentation, and supervisory authority reporting records. Governs the multi-stage reporting lifecycle from early warning through final report submission.

Govern and evidence operational resilience testing obligations under DORA, including TLPT programme requirements. Track test schedules, findings, remediation actions, and evidence of testing completion for supervisory review.

Maintain an ICT third-party oversight register aligned to DORA and NIS2 supply-chain obligations, including contractual clause tracking, concentration risk visibility, and monitoring evidence. Governs the compliance lifecycle for critical ICT service providers.

Evidence compliance with resilience and recovery obligations under NIS2, DORA, and CER through structured documentation, testing records, and monitoring of continuity controls. Tracks business continuity plans, disaster recovery procedures, and crisis communication evidence.