Gap analyses against regulations
Map current processes module by module against a target process and deliver a prioritised gap list with measure and target date.
Typical obligations
What typically comes up in your engagements
Results that can be evidenced
Every statement needs its source — article, paragraph, document — and an audit trail that is still traceable later.
Many clients, strictly separated
One client’s data, knowledge base and logs must never flow into the work for another.
Keeping regulation current
New requirements, level-2 standards and consultations have to be spotted and assigned to the right clients.
How Agentic360 helps
A reviewed starting point instead of a blank page
The building blocks advisory firms and auditors can work with on the platform — each linked to its detail page.
Blueprints as the engagement baseline
Four blueprints — AML, DORA, MaRisk & BAIT, NIS2 — with 118 grounded controls between them. A map-and-gap project starts from a documented target process.
Evidence auditors can retrace
Every chat answer names its sources — document, section or page where available, excerpt and document version — plus agent, model and guardrail status, exportable as an audit PDF. Compliance scans export an audit pack with a SHA-256 manifest per file; engagements keep an append-only, hash-chained event log.
Multi-tenant and under your own brand
Every tenant gets its own key, its own index and its own audit log. Advisory firms and system integrators operate the platform under their own brand via the partner portal.
Regulation in view, audit tools connected
The Regulation Watcher maps new requirements to frameworks; findings from external testing tools reach the tenant through the MCP gateway behind a review gate.
From a running pilot
softScheck Singapore: an auditor with its own installation
softScheck tests and audits other companies’ IT security — penetration testing, security audits, ISO 27001 consulting. On its own Agentic360 installation in Singapore with local model serving, role-trained agents do the work; findings from external pentest tools arrive in the tenant via the MCP gateway. The installation runs as the APAC pilot.
Read the client storyRegulations
Relevant regulations at a glance
Applies since 17 January 2025.
BAIT only for non-DORA institutions until 31 December 2026.
BSIG in force since 6 December 2025.
Applies from 10 July 2027.
For your own firm too: AI literacy under Art. 4 since 2 February 2025.
- ISO/IEC 27001
Platform controls are ISO 27001-aligned — the platform itself is not certified.
Whether and to what extent a regulation applies to your organisation depends on size, sector and business model. This overview is orientation, not legal advice.
Related roles
Your next map-and-gap project — on a grounded basis.
30 minutes: we show a blueprint, tenant separation and how results are exported as evidence.