Intake of your controls
Upload your current policies and controls, or answer a questionnaire. Nothing is shared outside the review.
Regulatory gap check / Fixed fee
NIS2, DORA and AI-governance gap check, fixed fee.
A gap check compares your current policies and controls with one framework’s requirements, NIS2, DORA or the EU AI Act, and lists what is missing, with citations to the regulation text. A human reviewer signs off, and you get the report in five business days.
Built for companies selling into EU regulated customers who need to answer "are you compliant?" with a clear plan. It is not legal advice, it is not a certification, and it does not guarantee a compliance outcome.
One framework per order · Human reviewer sign-off · 5 business days
Section 03 / 05
Ranked fix list, mapped to the framework’s articles
01 · Gap listCited to regulation text
02 · Ranked fixesBy impact and effort
03 · Policy skeletonFor the top gaps
04 · Reviewer sign-offNamed human
Pick one frameworkNIS2DORAEU AI Act / AI governance
01 / The deliverable
Gaps, citations, and what to fix first.
One framework per order. You get a written report your team can act on and show to a customer’s security reviewer.
01
02
Gap list with citations
Each gap maps to the framework's requirement, with a citation to the regulation text.
03
Ranked fix list
Ordered by impact and effort, so the first week of work is obvious.
04
Draft policy skeleton
A starting structure for the policies behind your top gaps, ready for your counsel to edit.
05
Human reviewer sign-off
A person reviews every finding before delivery.
06
Delivery in 5 business days
From the day your intake is complete.
02 / The process
Five steps. No access to your systems.
We work from the documents and answers you provide.
01
Order
Choose NIS2, DORA or EU AI Act.
02
Intake
Upload policies or answer the questionnaire.
03
Map
We map your controls to the framework's requirements.
04
Review
A human reviewer checks every finding.
05
Report
Gap list, fixes and policy skeleton.
Fixed fee
One framework, one price.
A one-time project, not a retainer. Not legal advice and no certification or compliance guarantee.
One framework per order
Fixed fee confirmed on request
- Gap list with citations to the regulation text
- Ranked fix list
- Draft policy skeleton for the top gaps
- Human reviewer sign-off
- Delivery in 5 business days
Questions go to fuseini.metadata@gmail.com. Refund policy.
03 / Starting checklists
What each framework asks for, in plain terms.
A short orientation, written from the regulation text. The gap check goes much further: it maps your own controls to each requirement. Not legal advice.
NIS2 compliance checklist
Directive (EU) 2022/2555, Article 21(2), lists the minimum risk-management measures:
1. Risk analysis and security policies. 2. Incident handling. 3. Business continuity, backups and crisis management. 4. Supply chain security. 5. Secure acquisition, development and vulnerability handling. 6. Ways to assess whether the measures work. 7. Cyber hygiene and training. 8. Cryptography and encryption. 9. HR security, access control and asset management. 10. Multi-factor authentication and secured communications.
Article 23 sets incident reporting: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.
DORA compliance checklist
Regulation (EU) 2022/2554 covers financial entities and their ICT providers across five areas:
1. ICT risk management. 2. ICT-related incident management and reporting. 3. Digital operational resilience testing, including threat-led penetration testing for some entities. 4. Management of ICT third-party risk, including a register of information on providers. 5. Information sharing.
If you sell to banks, insurers or investment firms, expect their questions to follow these five areas.
EU AI Act compliance for high-risk AI
Regulation (EU) 2024/1689 sets requirements for high-risk AI systems, including:
1. A risk management system (Article 9). 2. Data and data governance (Article 10). 3. Technical documentation (Article 11). 4. Record-keeping (Article 12). 5. Transparency for deployers (Article 13). 6. Human oversight (Article 14). 7. Accuracy, robustness and cybersecurity (Article 15). Providers also need a quality management system (Article 17).
Check the current application dates for your use case before planning work.
AI governance policy template
A usable policy skeleton has these sections:
1. Purpose and scope. 2. Roles and owners. 3. Inventory of AI systems in use. 4. Risk classification of each system. 5. Data governance. 6. Human oversight and escalation. 7. Vendor and model review. 8. Incident handling. 9. Monitoring and periodic review.
The gap check delivers a draft skeleton like this, tailored to your top gaps.
04 / FAQ
Straight answers.
Is this legal advice?
No. It is a structured gap review with a human reviewer. Have counsel review before you rely on it.
Does it certify us?
No. NIS2, DORA and the EU AI Act do not have a certificate we can issue, and we guarantee no compliance outcome.
Can I pick two frameworks?
Each order covers one framework. Order again for another.