Different frameworks.
The same question.
An auditor never asks whether you have documents. They pick one statement and ask where it comes from. That question spans files, versions and systems — which is why keyword search runs out just as the conversation gets serious.
EU AI Act
Annex IV documentation is a set of documents. An audit is a series of questions about single sentences inside it.
Read the angleDORA
Mapping every Article 30 requirement to a clause in a specific contract, and naming what is missing.
Read the angleNIS 2
Answering the question that only arises where directive, national law, sector rules and contracts overlap.
Read the angleTISAX
Mapping VDA ISA control questions to real plant documentation, including the prototype-protection scope.
Read the angleGxP
Walking a single value back through batch records, deviations and validation, with each hop cited.
Read the angleISO 27001 / SOC 2
Our honest certification status — and how ARGUS supports the evidence work in your own audit.
Read the angleVerifiable AI
Access governance and answer verifiability are different problems. Here is where the line runs.
Read the angleWhy these sit on one page
They come from different places — one regulates AI systems, one financial resilience, one network security, one manufacturing supply chains, one pharmaceutical records. The work they create inside a company converges anyway, because each of them eventually stops asking whether a policy exists and asks where a specific statement comes from.
That question is the expensive one. It crosses files, versions and systems: the policy is in SharePoint, the procedure that implements it in a network share, the evidence it was followed in a ticketing system, and the version that was current at the time of the incident is not the version open in front of you. Keyword search finds the word; it does not establish which document was binding in March.
What we build sits under all five: answers with the document, section and paragraph they came from; version-aware questioning; and an explicit report when the material contains no answer at all. That last part is what an audit would have found anyway — arriving earlier, while there is still time to write the missing procedure.
Questions before you pick a framework
Do you make us compliant with these regulations?+
No, and any vendor claiming otherwise is selling you a problem. Compliance is a judgement your own people make and sign. What we do is the part underneath it: produce the evidence an assessment asks for — which document says this, in which version, who could see it, and what the system answered on what basis.
Are you certified for ISO 27001 or SOC 2?+
Not yet, and we say so on the page about it rather than displaying a badge and sorting it out later. What we can do is help with your own certification, since that is where the work actually is: mapping controls to your documents and producing the evidence for each one.
Which framework should we start with?+
Whichever one has a date attached. In practice that decides it: an audit scheduled for spring beats an interesting requirement with no deadline. If several apply at once, start with the one whose evidence overlaps most with the others — usually that is the record of who accessed which document.
Why do all these frameworks end up asking the same thing?+
Because each of them eventually stops asking whether a policy exists and asks where a specific statement comes from. That question crosses files, versions and systems, which is exactly where keyword search stops being useful — and where the conversation with an auditor tends to get serious.
Does the system decide anything on its own?+
No. It locates, cites and reports gaps. Decisions with legal consequence — for the company or for a person — need an accountable signature, not a confidence score. This is also what the EU AI Act expects of systems used in this kind of work.
Where is the data processed during this work?+
On our own hardware in the EEA, or inside your own network where documents cannot leave it. Your material is not used to train models and the processing locations are disclosed. For an institution under supervision this is usually the first question, so the answer is verifiable rather than reassuring.
What does this cost?+
Discovery with a document audit starts at €5,000 and ends with the measured share of questions your material can actually answer — the number that tells you whether an audit will go smoothly. An implementation project on existing infrastructure starts at €25,000.
One question, your documents
The fastest way to judge this is not a demo on our data. Bring a question you have already spent hours on, and the documents that should contain the answer.
Book a working session