Free readiness check
Know where you stand on ISO 27001 or the EU AI Act.
A guided check that runs as a chat. Answer questions or share the documents you already have, review what it proposes, and see where your gaps are.
Book a demo and we’ll set up your workspace.
- One assessment Each assessment keeps its own scores, findings, evidence and reports. The scores you give in the readiness check are kept in your current assessment.
- Compared with a baseline An assessment can name an earlier one as its baseline. Gap analysis then shows the overall score and the share of ready requirements against it.
- One assessment. Each assessment keeps its own scores, findings, evidence and reports. The scores you give in the readiness check are kept in your current assessment.
- Compared with a baseline. An assessment can name an earlier one as its baseline. Gap analysis then shows the overall score and the share of ready requirements against it.
How it works
A conversation, not a questionnaire.
The check runs as a chat, in three steps. You can stop between any of them and pick up where you left off.
-
Scoping
Tell it how you work.
Pick a track and answer a few questions. On ISO 27001, fixed rules work out which Annex A controls apply to you. On the EU AI Act, it starts by finding the AI systems you use.
In the check
Scoping applicable controls…
-
Assessing
Answer, or share what you have.
Answer questions about how you work, and the assistant records a score from 0 to 5 for each control. Or share the policies and records you already have, as PDF or DOCX, or let it look at your GitHub (read-only), and it proposes scores from them, with its reasoning and the passage it relied on.
In the check
Let's check your ISO 27001 readiness. Share your policies or documents and I'll read them and propose scores — or I'll ask you about each requirement. You can stop and come back any time.
Reading your document and proposing scores…
-
Reviewing
You make the call.
Approve, adjust or reject each score proposed from your documents. You can change any score later, including the ones from your answers.
In the check
I reviewed your evidence and proposed n scores. Review the cards below — approve, adjust, or reject each.
Welcome back — n of n controls scored, n waiting for your review, n still open. Want to keep going?
Quoted from the check itself. Shaded words are filled in as you go.
Your score
A score that shows its working.
The scores you give in the check are kept as an assessment in your workspace. Gap analysis averages them on the same 0 to 5 scale, and says how, right under the number.
-
An average, nothing skipped
The score averages every applicable requirement. Requirements nobody has assessed count as 0, so leaving questions out never lifts it.
-
Scoped by your SoA
Controls marked Not Applicable in your Statement of Applicability are left out of the average.
-
Compared with a baseline
Each assessment can be compared with a baseline assessment: the overall score, and the share of requirements that are ready. “Certification ready” in the product means scored 3 or higher; only an accredited body certifies.
Two tracks
Start with the one you are being asked about.
Each track scopes itself to you first, so you only assess what applies.
-
ISO/IEC 27001:2022 · default track
ISO 27001
For when a customer, partner or board asks for an information security management system. The check covers clauses 4 to 10 and the Annex A controls that apply to you, scoped by rules from your answers.
ISO 27001 in Fidureon93 Annex A controls30 clause requirements -
Regulation (EU) 2024/1689
EU AI Act
For when you build or use AI systems. The check starts with AI discovery: it finds the AI systems in your documents (or your GitHub) and proposes them for your AI register, for you to confirm and classify. A few questions about whether you provide or deploy AI then decide which obligations apply to you.
EU AI Act in Fidureon23 readiness requirements4 risk tiers in your AI register
GDPR, NIS2 (Sweden), DORA, ISO 42001 and ISO 9001 are not part of the check. You work on them in the platform. See all frameworks.
What you leave with
A score, and a place to start.
The check ends where the real work begins, in the same workspace you keep using afterwards.
Starter workspace
Your first risks and assets, proposed.
When you finish, and if you scored at least five controls, the check proposes up to ten risks drawn from your gaps and the systems you named as assets, if it finds any.
Your approval
Suggestions wait for you.
Scores proposed from your documents, and every suggested risk, asset and AI system, wait for someone on your team to approve, change or reject them.
Your result
See where the gaps are.
A readiness score. On ISO 27001, broken down by clause (4–10) and Annex A category. On the EU AI Act, with a summary of your declared and high-risk AI systems.
Then keep going, in the same workspace.
After the check, the work moves into the platform: controls, evidence and policies, and compliance plans in the Action Center, where actions to close your gaps move from proposed to done.
FAQ
Readiness check questions.
Is the readiness check really free?
Yes, the readiness check is free. Book a demo and we’ll set up your workspace.
Which frameworks does the check cover?
Two tracks. ISO/IEC 27001:2022, with clauses 4 to 10 and the Annex A controls that apply to you (out of 93), scoped by a few questions about how you work. And the EU AI Act, which starts with AI discovery and then asks whether you provide or deploy AI to decide which obligations apply. GDPR, NIS2 (Sweden), DORA, ISO 42001 and ISO 9001 are not part of the check; you work on them in the Fidureon platform.
How are the scores worked out?
The assistant either asks you about each control and records a score from your answer, or reads the PDF or DOCX documents you upload and proposes a score with its reasoning and the passage it relied on. You approve, adjust or reject document-based proposals, and you can change any score later.
Can I stop halfway and come back?
Yes. The check is resumable: leave mid-assessment and it is paused, and when you return it picks up at the same step, with your answers and documents still there.
What do I get at the end?
A readiness score. On ISO 27001, broken down by clause (4–10) and Annex A category. On the EU AI Act, with a summary of your declared and high-risk AI systems. When you finish, and if you scored at least five controls, the check proposes a starter workspace: up to ten risks drawn from your gaps, and the systems you named as assets, if it finds any. On the EU AI Act track, the AI systems it found are proposed for your AI register. No risk, asset or AI system is added until you approve it.
Does a high score mean we are certified or compliant?
No. The score shows how ready you are, based on the scores recorded in the check. For ISO 27001 only an accredited certification body can certify you, and EU AI Act compliance depends on your role and your AI systems. The check tells you where to start.
Where do my uploaded documents go?
Documents you share are saved in your workspace as draft policies, so you can find them later. Your documents and records are kept in the EU. Hosted in Google Cloud europe-north1 (Finland), with a daily copy of evidence files in europe-north2 (Stockholm). Database backups stay in Google Cloud’s EU locations. Reading a document is an AI step. The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company.
More on hosting and AI processing on the security page.
Find your gaps before anyone asks.
Book a demo to see the check and get access.