Compliance Uncovered

What changed in 2026, which evidence now counts, and where compliance programs keep going wrong.

Everything you should take into account when choosing software to implement NIS2 and keep the evidence defensible.

Mandatory contents, sub-processors, liability clauses, and who actually signs off when the vendor will not negotiate.

What the regulation requires, whether it applies to you, which authority supervises you, and what breaches actually cost.

Where the requirements overlap, where they do not, and the order in which to tackle them.

Ask a Compliance Expert: Kertos specialist Kutluhan Abut on the traps to avoid, whether you are buying compliance help or trusting a supplier's certificate.

How to tell whether your AI system is high-risk, and which deadlines actually apply now that the rules have moved.

Kertos specialists who guide our customers through ISO 27001, SOC 2, GDPR, NIS2 and the EU AI Act, and more, answer the questions teams actually ask.

Who it covers, the ten required measures, the reporting clock, which member state regulates you, and what non-compliance costs.

What C5 attestation is, how the process works, and how to reach it without the manual grind.

The BSI's NIS2 extension has closed. Here is what applies now, what it can cost and how to complete the registration.

What the standard requires, how the audit actually runs, and how to get certified without drowning in spreadsheets.

European data residency is no longer enough. A new wave of EU sovereignty laws means the question is no longer where your data lives, but who controls the company that holds it.

For European tech companies, compliance is the signal prospects, partners, and investors read before they decide to engage.

Seven beliefs that are leaving European organizations exposed, corrected with the facts.

Conversations with CISOs, CTOs, and Heads of InfoSec across Europe reveal an uncomfortable truth: the security workforce shortage is no longer a future problem.

Strategic agreement combines Kertos’ compliance automation platform with Axipro’s implementation and advisory expertise to help organizations respond to rising regulatory and security demands

The complete guide to scope, security measures, reporting and compliance

How German Critical Infrastructure Operators Can Achieve Full NIS2 Compliance. From Governance and Risk Management to 24-Hour Incident Reporting

What an ISMS is, what it consists of, and why startups should start earlier than they think.

The traditional approach versus the modern route. Faster certification, less effort, no chaos.

Everything you should take into account when choosing the best ISO 27001 compliance automation solution.

Everything you, as a managing director, need to know when dealing with NIS2 in order to avoid unpleasant surprises.

How companies are meeting the new enforcement focus of EDPB 2026 with genuine transparency, understandable data protection notices and clear AI communication while building trust.

A practical guide for implementing backup, recovery and crisis management obligations in accordance with NIS2 with specific steps, roles and testing procedures for real incidents.

How Kertos ensures responsible AI governance and secure compliance automation with ISO 42001.

A Letter from our CEO

How European FinTechs cut compliance staffing and audit prep time by automating controls across seven or more overlapping frameworks

How your compliance needs change as you grow, and how to keep them from growing your headcount.

Assessment levels, prototype protection requirements, and where automation actually replaces manual evidence work for suppliers

How HealthTech companies protect patient data and cut compliance effort while meeting GDPR, ISO 27001, NIS2 and MDR at once

How to run ISO 27001, GDPR, SOC 2 and PCI DSS as one program instead of four.

Where AI genuinely improves risk work, where it needs human sign-off, and how to roll it out in three phases.

How growing European companies keep GDPR under control as data multiplies — without hiring a bigger privacy team.

A data-backed look at what compliance automation saves, for a mid-sized company and a 25-person startup.

What Regulation (EU) 2024/2847 requires of manufacturers, and the two dates that decide your timeline.

A phased plan for certification and attestation audits, from planning to closing the nonconformities.

Kertos Co-founder and CEO, Dr. Kilian Schmidt, talks about the future of #EffortlessCompliance. What started with the automation of a single privacy workflow quickly evolved into an all-in-one platform that simplifies the complexities of regulations and certifications.

This is a significant moment for us at Kertos — and for the future of compliance! Companies in Europe are faced with the challenge of growing, driving innovation and scaling. Compliance shouldn't be a hurdle, but a real enabler. That's exactly why we're breaking new ground and redefining compliance: intuitive, effortless and AI-powered.

Kertos received 2.2 million euros in funding from the European Union in 2024 as part of the EUPROFIT project! These funds support our mission to automate manual and often costly compliance with data protection regulations through innovative AI solutions.

The new EU AI Act sets global standards for the regulation of AI systems. Learn how the risk-based approach works, what potential fines could be imposed, and how Kertos can support you in ensuring compliance.

Shadow IT is similar to the story of Trojan horses and insider threats in a B2B environment. Just like the inadvertent actions of guards expose the castle to intruders, employees may unknowingly open a gateway for cybercriminals.

In recent years, mobile devices have found an irresistible presence in the corporate world. The widespread adoption of mobile devices in enterprises got a boost with the COVID-led remote working trend gaining traction.

Which controls the standard defines, how many apply to you, and what the 2022 revision changed.

What you have to hand over, what you must keep despite an erasure request, and where the process breaks in practice.

Stage 1, Stage 2, nonconformities, and the deadlines your certification body is itself bound by.

Learn how ISO 27701 certification helps companies improve data protection and facilitate cross-border data transfers. Increase customer trust and open up international markets with solid data protection management.

An external data protection officer (DPO) brings expertise you would otherwise have to build in-house and is not exposed to a conflict of interest.

What clause 9.2 requires, the four steps to run an internal audit, and how it sets up your certification audit.

Why the record of processing, the access request, and the erasure all hang on the same question: where is the data?

Growing technology companies should consider SOC 2 compliance. The key benefits of SOC 2 compliance include increased customer trust and competitive advantages.

What actually separates compliance software, and how to pick the vendor that fits your audit.

Work out if the Act applies to you, classify your AI systems, and act before the deadlines.

Most often, NIS2 and ISO 27001 are intertwined together. ISO 27001 touches NIS2 at many key points that facilitate compliance with the latter if the former is achieved.