Compliance Scanner

Frameworks covered

GDPR and UK GDPR, CCPA as amended by the CPRA, SOX section 302 and 404 documentation requirements, ISO/IEC 27001:2022 Annex A, HIPAA privacy and security rules, and the EU AI Act obligations that apply to deployers of high-risk systems. Each framework is expressed as a set of discrete, testable control statements rather than as chapter headings.

How a gap is identified

For each control, the scanner looks for documentary evidence that the control exists and is described. Where it finds evidence, it links the control to the passage. Where it finds nothing, or finds language that contradicts the control, it raises a gap with a severity rating and a short explanation of what is missing.

Because the mapping is to passages rather than documents, a change to one paragraph of one policy re-opens exactly the controls it affects, and no others.

Evidence packs and audit season

When an auditor or a supervisory authority asks how you meet a requirement, the answer is usually spread across four documents and two people’s memories. The scanner assembles an evidence pack per control: the current text, its version history, the owner, the last review date and the linked remediation history.

Remediation that closes the loop

Gaps become tasks with an owner and a due date. When the underlying document is updated, the control is re-tested automatically and the task closes on evidence rather than on assertion. Board reporting is generated from the same data, so the number in the pack and the number in the tool are the same number.