Start free checkFree check Book a demo

The compliance operating system for European companies.

The EU AI Act, GDPR, NIS2 (Sweden), DORA and ISO 27001, 42001 and 9001 in one EU-hosted platform. An AI assistant beside every page tells you what is due, and agents turn what they find into actions. Your people make the calls.

Book a demoStart free readiness check

Built in Göteborg. Hosted in the EU, and so is the AI.

Fidureon dashboard for a demo energy company: the navigation with modules from Dashboard and Action Center to Processes, Information Types, Assets, Suppliers, Privacy and the AI Register; a notice board announcing a stage 1 ISO 27001 audit in March 2027; and a readiness overview at 59 % compliance-ready with 20 open risks, 35 active controls and 6 reviews overdue.
The AI assistant pane beside the dashboard: “Your briefing”, prepared automatically, “Hi Elin, here is what needs your attention. 1 item is overdue, 4 more are due within 30 days.”, listing a control review overdue by 35 days, a NIS2 incident-reporting exercise due in 9 days, an acceptable-use policy approval due in 12 days, finalising the Statement of Applicability in 25 days and a management training in 30 days.
The dashboard, with the AI pane’s briefing built from what is due for you. Product screens show a fictional demo company.Your briefing in the AI pane, built from what is due for you. Product screens show a fictional demo company.

7 frameworks, one platform.

Link a control once to the requirements it meets in every framework you run, by hand or from AI suggestions you accept, and the same work and evidence count everywhere. How one control counts across frameworks

Also available: CRA, EU Data Act, PCI DSS 4.0.1, TISAX, MVSP and custom frameworks.

How it works

From scope to proof, in one place.

Map what applies, close the gaps, then keep the programme assured while agents do the upkeep.

Map

Know what applies.

Answer a short scoping questionnaire and rules mark each Annex A control applicable or not. Your Statement of Applicability records the decision and the reason for it.

Statement of Applicability for ISO 27001:2022 Annex A at a demo company: 92 applicable, 1 excluded, 56 complete and 37 in progress, with an Export CSV button and a table of controls A.5.1 to A.5.5 showing applicability, justification (Risk, Contractual) and status.
The Statement of Applicability, one row per Annex A control.

Close gaps

Turn gaps into a plan.

Gaps become actions on a compliance plan, one plan per goal, such as ISO 27001 certification or NIS2. Each action moves from proposed to committed to done.

Action Center for a demo company with tabs for compliance plans (AI Act readiness, NIS2 / Cybersäkerhetslagen programme, ISO 27001 certification 2027) and a board of actions in Proposed, Committed, In progress and Done, with plan progress at 38 %.
Proposed gap actions on a compliance plan, ready to add to it.

Assure & run

Keep it current.

Control owners review their controls on a cycle and record a self-assessment, so you can show the work is still done. The AI pane reminds each person what is overdue, and agents propose what changes.

The Review tab of a control drawer: next review date, last reviewed by the owner, a control self-assessment card with outcome Effective and a Mark as Reviewed button, and the review history.
A control’s review cycle and its owner’s self-assessment.

Processes and registers

Document what you do. Get your registers.

Draw how you work on the process canvas. Create assets, information types and suppliers right on the canvas. The links fill themselves in, and your Article 30 register builds from them.

The Meter-to-cash (billing) process on the canvas: from Start through Collect hourly readings, Validate and estimate gaps, an Anomaly? decision, Calculate invoice, Send invoice and Payment and reminders to End, each step connected to the register records it uses: assets such as Smart meter head-end and ERP, information types such as Hourly consumption data, suppliers such as Mätpunkt Data AB, the AI system Meter anomaly detection, an input and an output.
  1. This node is the information type Hourly consumption data from your register. Pick an existing record, or create a new one here with Quick Create.
  2. Save, and the process is linked to every record on it. The lines between suppliers, assets and information types link those records too.
  1. A real register record. This node is the information type Hourly consumption data from your register. Pick an existing record, or create a new one here with Quick Create.
  2. Links made on save. Save, and the process is linked to every record on it. The lines between suppliers, assets and information types link those records too.
One process, drawn with the real records each step uses.
Play the recording: create a record right on the canvas
Adding a record on the canvas: create the information type, link it to the step that uses it, save.
  • Draw the process Steps and decisions, with the assets, information types, suppliers and AI systems each step uses, from one palette.
  • Create records where you draw Quick Create makes the real register record and links it to the node in one step. Drawing alone never adds a row to a register.
  • Save, and the links are made The process is linked to every record on it, and the lines you draw link information types and suppliers to the assets they touch.
Information Types register right after the canvas quick-create: “Field inspection photos”, Confidential, now listed beside Customer billing details, Hourly consumption data and Payment and invoice history.

In the register straight away.

The information type created on the canvas is listed with the others, already linked to the process that uses it.

Processes list for a demo company: five active processes such as Payroll, Outage management and Customer service, and Meter-to-cash (billing) with a GDPR badge, owner CFO and “2 assets · 3 data” derived from its diagram.

Every process shows what it links.

The process list counts the assets and information types on each diagram, and a GDPR badge marks the ones you flag as personal-data processing, the same flag the Article 30 register reads.

Your Article 30 register builds from it.

Mark a process as personal-data processing and it appears in the Article 30 register with its purpose, the personal information types linked on the canvas, their retention and the suppliers that process them. Export it as CSV whenever you need it.

Or ask the AI Process Builder, an experimental feature, to draft the diagram. It links only to records that already exist.

The Article 30 register for GDPR
Article 30 register entry for a demo company’s Meter-to-cash (billing) process: owner CFO, Active, processing purpose “Meter reading, billing and payment collection for electricity and grid customers.”, and its PII information types, starting with Hourly consumption data, retention 3 years, processed by the supplier Mätpunkt Data AB.
The Article 30 register entry for a process, with the information types and supplier linked on its canvas.

AI throughout

An assistant beside every page.

The AI pane sits next to your work. It opens with a briefing built from what is due for you and suggests questions for the page you are on.

Risk register with the AI assistant pane open: risks such as “AI Act high-risk obligations missed for grid AI” and “Critical ICT provider outage halts billing and metering” with their categories, and, in the pane, the same automatic briefing plus suggestions for this page: “Show me all high risks”, “Which risks have no controls?” and “Help me add a risk”.
The risk register with the AI pane beside it: your briefing, then questions about your risks.On the risk register, the pane suggests questions about your risks.
  • A briefing built from what is due for you What is overdue and what is due in the next 30 days, for the person signed in.
  • Questions for the page you are on On the risk register it suggests risk questions; on controls, control questions.
  • Ask about your own work Ask it what to do first, what is due this week or which controls are overdue for review.

It gets to know you

You can teach it about your organisation, and about you.

Switch on personalisation and teach the assistant: an admin describes the organisation, each person adds why they use Fidureon, their goals and how they like answers. It uses that with your active frameworks, objectives and role.

Organisation profile for a demo company: what the AI assistant knows about your organisation, which everyone benefits from and only admins can change — the name Nordvik Energi AB, its website, the industry, electricity distribution and district heating, and a summary of what it does: a regional grid and district-heating company and an essential entity under Cybersäkerhetslagen, working towards ISO 27001 and using AI for load forecasting.
About your organisation. Industry, size, region, what you do and how you handle data. An admin keeps it; everyone benefits.
AI profile for a demo CISO: what the AI assistant knows about why you use Fidureon, which only you can see and change — run the ISMS and the NIS2 programme and get ready for the ISO 27001 stage 1 audit in March 2027 — and three goals: pass ISO 27001 stage 1 in March 2027, meet Cybersäkerhetslagen reporting duties, classify their AI systems under the AI Act.
About you. Why you use Fidureon, your goals, your experience and how you want answers. Only you can see it.

From finding to action

Agents turn findings into actions. You decide how much they do alone.

Fidureon’s agents read your documents and GitHub evidence, watch security advisories and flag gaps. What they hand you is concrete: a proposed action with its reason. At Propose & Wait, a person approves it before it lands on the Action Center.

  1. An agent proposes, with its reasons

    A proposed action, the reason in one sentence, and the arguments behind it.

    A pending proposal, create_action, with the agent-type chip Compliance operator: “Kundassistenten sends customer messages to Atlas LLM Inc. (US). The supplier has no DPA in place and no transfer mechanism is recorded.”, with the buttons Approve & Execute and Reject.
    1. A person reads the reason and approves it here, or rejects it. Only then does this proposal run.
    1. Approve & Execute. A person reads the reason and approves it here, or rejects it. Only then does this proposal run.

  2. A person approves it, and it executes

    The same proposal, now Executed, with the result it produced.

    The same create_action proposal after approval, with the agent-type chip Compliance operator: status Executed, the same reasoning about Atlas LLM Inc., and an Execution result disclosure.

  3. It becomes an action

    On the Action Center, with a priority, a due date and a Complete button for its owner.

    Action card on the Action Center: priority High, “Sign DPA and SCCs with Atlas LLM Inc. before chatbot go-live”, due 25 Oct 2026, with a Complete button.
An agent proposed this action and explained why; approved by a person, it became an action on the Action Center. Product screens show a fictional demo company.
  • Autonomy you set, agent by agent Give each agent Propose & Wait, Hybrid or Full, and change it as trust grows.
  • A queue for the calls that matter At Propose & Wait, an agent’s proposals wait for a person to approve or reject them. Approved, a proposal executes, like the one above.
  • Reasoning you can check Proposals show their reasoning and arguments and, where the agent scores it, a confidence. Every agent action is logged.
  • Your own AI tools, connected A built-in MCP server with 200+ tools works with Claude, ChatGPT and IDE agents, scoped by API key.
See the AI in the product

EU-based

Fully EU-based.

Fidureon is built and operated by CShift AB in Göteborg and hosted on Google Cloud in the EU: europe-north1 (Finland) is the primary region, and evidence files are replicated every day to europe-north2 (Stockholm). The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company.

  • europe-north1

    Finland

    Primary region: the application, the database (with regional high availability) and evidence files.

  • europe-north2

    Stockholm, Sweden

    A daily replica of evidence files, for disaster recovery.

  • Vertex AI

    EU region

    Gemini models for the assistant, agents and drafting.

  • Mistral

    EU hosting

    Selected AI flows, on Mistral’s EU hosting.

  • SV · EN

    A Swedish interface

    The interface is available in Swedish and English. The Cybersäkerhetslagen catalogue is in Swedish.

  • CShift AB

    Göteborg, Sweden

    Built and operated by CShift AB in Göteborg, Sweden.

Security and hosting How the AI is hosted

Framework depth

Every framework, with the registers it needs.

Auditors and regulators ask for specific records. Each framework comes with its own working tools, built on the same controls, risks and suppliers.

  • AI register for a demo company: Copilot for office productivity (generative AI, minimal risk, in production), CV screening assistant (NLP, high risk, retired), GridCast load forecasting (machine learning, high risk, in production) and Kundassistenten, a customer chatbot (generative AI, limited risk, pilot).

    EU AI Act

    Every AI system, classified.

    Register each system with its risk level, Annex III category and your role as provider or deployer, then export the register as a branded PDF.

    Explore EU AI Act
  • GDPR requirements for a demo company, Art. 5.1.c data minimisation to Art. 5.2 accountability, with their descriptions and a red gap marker beside Art. 5.1.f integrity and confidentiality.

    GDPR

    Every article, with its gaps in sight.

    Track the GDPR articles with a status for each, keep your Article 30 records and export them to CSV, and run DPIAs, LIAs and TIAs with autofill and AI-drafted text.

    Explore GDPR
  • Requirements view for a demo company with the source Cybersäkerhetslagen (NIS2) 2026.1.0 selected: requirements 1:3 and 2:1 with their Swedish names and descriptions.

    NIS2 (Sweden)

    NIS2, as Sweden wrote it.

    Track Cybersäkerhetslagen, the Swedish NIS2 law, requirement by requirement, next to supplier questionnaires for supply-chain security and an incident log.

    Explore NIS2 (Sweden)
  • ICT register for a demo company: ICT providers Atlas LLM Inc., Fjärrnät Telecom AB and GridSense Systems Oy with their service type and substitutability, from Easy to Not Substitutable.

    DORA

    ICT third parties, in one register.

    Record how replaceable each ICT provider is, map critical functions, plan exits and export the core EBA Register of Information templates as XBRL-CSV.

    Explore DORA
  • Gap analysis for a demo company’s ISO 27001 readiness assessment: the assessment selector, a Generate Report button and an overall score of 3.6 out of 5.

    ISO 27001

    A gap analysis that shows what is left.

    Score the clauses and Annex A controls from 0 to 5, compare with your last baseline and generate a branded PDF report.

    Explore ISO 27001
  • ISO 42001 Annex A Statement of Applicability for a demo company: controls A.2.2 AI policy, A.2.3 alignment with other organizational policies, A.2.4 review of the AI policy, A.3.2 AI roles and responsibilities and A.3.3 reporting of concerns, each with the start of its control description.

    ISO 42001

    Annex A, in its own Statement of Applicability.

    Decide applicability and justification for each ISO 42001 Annex A control, next to the AI register you keep for the EU AI Act.

    Explore ISO 42001
  • Open nonconformities card for a demo company: 4 open findings to close, listing NC-2026-001 (Major) on access reviews for OT accounts and two Minor findings.

    ISO 9001

    Non-conformities, closed properly.

    5 Whys root cause, corrective and preventive actions and an effectiveness check, next to controlled documents and quality objectives.

    Explore ISO 9001

  • And more

    Your own frameworks, too.

    Add custom frameworks and requirements next to the catalogues. These are available as well, on the same suppliers, controls and sign-in.

    • CRA50 requirements
    • EU Data Act24 requirements
    • PCI DSS 4.0.1246 requirements
    • TISAX80 requirements
    • MVSP25 requirements

Free readiness check

Know where you stand before your auditor does.

A guided, chat-led check for ISO 27001 or the EU AI Act, built on the documents you already have.

Book a demo Start free readiness check

Book a demo and we’ll set up your workspace.

  1. Pick a track

    ISO 27001: scoping questions, and rules decide which Annex A controls apply. EU AI Act: it starts with AI discovery across your use cases.

  2. Upload what you have

    Policies, procedures and other documents you already keep.

  3. See a score per requirement

    The assistant scores each requirement from your documents and your answers, so you see where you stand.

  4. Start with a head start

    When you finish, it proposes a starter workspace of risks and assets for you to accept.

For consultancies

Every client in one console.

Compliance consultancies can run their customers on Fidureon: the same platform, the same frameworks, with the engagement work built in.

  • Your customers, your console Create customer tenants, switch modules on per customer, invite their teams and apply your branding.
  • Gap engagements that show progress Run them yourself or let the customer self-assess, then compare findings against a baseline.
  • Reports with your name on them Export every engagement as a branded PDF report.
Fidureon for partners
Partner console for a fictional advisory firm: Customers (4) with a New customer button, and the customers Hälsinge Vatten AB, Kustbanken Sparbank and Lindö Logistik AB with their slug, status Active, users, frameworks and engagements.
The partner console: one advisory firm’s customers, each with its own frameworks and engagements. Fictional names.

FAQ

Fidureon questions.

What is a compliance operating system?

One platform where your frameworks, controls, risks, suppliers, documents and evidence live together. Work is linked across frameworks, an AI assistant and agents help with the continuous upkeep, and people make the decisions that matter.

Which frameworks does Fidureon support?

The EU AI Act, GDPR, NIS2 through Sweden’s Cybersäkerhetslagen, DORA’s ICT third-party and Register of Information tools, ISO 27001, ISO 42001 and ISO 9001. CRA, EU Data Act, PCI DSS 4.0.1, TISAX and MVSP are available too, and you can add custom frameworks of your own.

Does the AI change things without me?

The assistant in the AI pane briefs you on what is due and answers your questions. Agents work in the background and turn what they find into proposals, such as a new action with its reason. How far they go alone is up to you: each agent has an autonomy level, Propose & Wait, Hybrid or Full. At Propose & Wait, a person approves or rejects every proposal before it runs. Every agent action is logged.

Can one control count for several frameworks?

Yes. A control links to the requirements it meets in any framework you run, so the same work and evidence count everywhere they apply. You make the links, with AI suggestions when you import controls.

Where is my data hosted?

Your compliance records are stored in the EU. Hosted in Google Cloud europe-north1 (Finland), with a daily copy of evidence files in europe-north2 (Stockholm). Database backups stay in Google Cloud’s EU locations. The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company. The security page has the details.

Does the AI assistant know about our organisation?

Only if you turn that on. Personalisation is off by default. When it is on, the assistant uses the organisation profile an admin keeps, each person’s own AI profile with their purpose, goals and preferred kind of answer, and your active frameworks, objectives and role.

Can Fidureon build our Article 30 register?

It builds it from your processes. Draw a process on the canvas, create or pick the information types and suppliers it uses, and mark it as personal-data processing. The Article 30 register then lists it with its purpose, personal information types, retention and processors, and exports to CSV.

Will Fidureon certify us?

No. An accredited certification body certifies you. Fidureon prepares you for it: scoping, controls, evidence, gap analysis and the Statement of Applicability your auditor will ask for.

More on where the AI runs, security and hosting, and how the free readiness check works.

See Fidureon on your own frameworks.

Book a demo and we will walk through your own scope and frameworks. Or start with the free readiness check for ISO 27001 or the EU AI Act.

Book a demoStart free readiness check