AI Act · NIS2 · DORA · GDPR — watched weekly at the source. Proposals are not law; no deadline moves on a press release.
The sovereign readiness platform for EU regulation

Know where you stand — before anyone asks.

Klarr maps your AI estate against GDPR, NIS2, DORA and the AI Act, watches the law weekly, and proves your readiness by hash. Days, not consultant-months.

Two-minute scope check → Or meet Saga →
Map · Watch · Prove · 45 secondsReads with sound off
🇩🇪
Hetzner Germany
German-regulated servers. No US data routing.
🇫🇷
Mistral AI France
European-native AI inference. No US hyperscalers.
🇩🇰
Cordero Management Denmark
Operated from Copenhagen, under EU jurisdiction.
🇪🇺
GDPR Native
Built under EU data protection law. No bolt-on compliance.
🤝
AI Pact applicant
European AI Office AI Pact — Pillar I member, Pillar II pledges submitted.
4
EU regimes under live watch
€35M
Maximum AI Act fine
24h
NIS2 incident early-warning duty
13
Controls, one evidence base
01

How it works

01 · Map

Your estate, against the law

One guided assessment across all four regimes. Every obligation cited to the operative article; every gap in a roadmap that is yours to execute with anyone.

02 · Watch

The law, watched weekly

EUR-Lex and Danish law at the source. When something that binds you moves, you know. Proposals are not law.

03 · Prove

Evidence that holds up

Hash-sealed attestations anyone can verify, and board-visible progress — for the customer, the investor, or the regulator who asks.

Product preview · illustrative data
What your compliance dashboard looks like
Cordero Management
Dashboard AI Systems Tasks Reports Settings
Current stage
Assessed
Next: Inventoried — begin AI system intake
AI Act · 2 gaps open NIS2 · important entity DORA · not applicable GDPR · applies
AI Systems
7
identified
High-risk
2
classified
Tasks open
4
assigned
AI Act high-risk date
—
Dec 2, 2027 (Annex III)
System name Vendor Risk tier Stage Open tasks

Every system, every obligation, every open task — visible from day one.

02

One evidence base, four regulations

Four laws, largely the same proof: thirteen controls. Fix one, close obligations in several laws at once — every reference cited to the article or Danish paragraph.

01 Regulatory classification Which laws apply to you, in what role — documented. + Which laws this serves
Risk tiers under the AI Act, entity class under NIS2, regime routing for finance, energy and telecom — each determination versioned, rationale cited to the paragraph.AI Act Art. 6NIS2 §§ 4–5DORA scoping
02 Incident detection & reporting One runbook. Three laws satisfied. + Which laws this serves
One incident-response capability, evidenced once, carries the AI Act’s serious-incident duty, NIS2’s 24h/72h/1-month chain, and DORA’s ICT-incident regime simultaneously.AI Act Art. 73NIS2 §§ 12–13DORA Art. 17–19
03 Technical documentation Design records, policies, and the technical file. + Which laws this serves
The AI Act’s Annex IV file and NIS2’s security policies draw on the same documentation discipline — maintained once, mapped to each law’s wording.AI Act Art. 11NIS2 § 6 nr. 1, 5
04 Human & management oversight Board approval, oversight roles, escalation paths. + Which laws this serves
The AI Act requires human oversight of high-risk systems; NIS2 makes the management body personally accountable for approving and supervising measures. Same governance spine.AI Act Art. 14, 26NIS2 § 7
05 Continuous monitoring Post-market surveillance and effectiveness assessment. + Which laws this serves
Monitoring systems in production and assessing whether your measures actually work — required, in different words, by three regimes.AI Act Art. 72NIS2 § 6 nr. 6DORA Art. 10
06 Regulatory registration The registers you must be in — and prove you are. + Which laws this serves
High-risk AI systems in the EU database; NIS2 entities with the competent authority within two weeks of coverage. Binary, checkable, and often overdue.AI Act Art. 49NIS2 § 10
07 Literacy & training Staff and management trained — with records to show. + Which laws this serves
AI literacy for everyone touching AI systems; cyber-risk training for the management body itself under NIS2. One training programme, two statutory duties.AI Act Art. 4NIS2 § 7 stk. 2, § 6 nr. 7
08 Transparency & disclosure Telling people what your systems are and do. + Which laws this serves
AI-interaction notices and synthetic-content labelling under the AI Act; information duties under the GDPR. Disclosure as a maintained control, not a footnote.AI Act Art. 50GDPR Art. 13–14
09 Continuity & disaster recovery Backups, recovery, crisis management — exercised. + Which laws this serves
NIS2 demands it as a named measure; DORA builds an entire resilience-testing regime on it. Evidence the capability once.NIS2 § 6 nr. 3DORA Art. 11–12
10 Supply-chain security Your vendors are your risk surface — and your sovereignty. + Which laws this serves
Vendor risk assessment under NIS2, the full ICT third-party regime under DORA — and the layer where EU-sovereignty of your stack becomes checkable fact.NIS2 § 6 nr. 4DORA Ch. V
11 Cryptography & encryption Policies for what gets encrypted, how, and by whom. + Which laws this serves
A named NIS2 measure and the canonical GDPR Art. 32 safeguard — one policy set, two regimes.NIS2 § 6 nr. 8GDPR Art. 32
12 Identity, access & assets Who can touch what — MFA, access control, asset inventory. + Which laws this serves
Personnel security, access policies and asset management under NIS2, ICT access rules under DORA. The control auditors check first.NIS2 § 6 nr. 9–10DORA Art. 9
13 Fundamental-rights impact Impact assessments where deployment demands them. + Which laws this serves
The AI Act’s FRIA for high-risk deployers and the GDPR’s DPIA are cousins — assessed with shared machinery, filed as separate artefacts.AI Act Art. 27GDPR Art. 35
Klarr Readiness Exercises

Test it in a room, not in production — a facilitated exercise for leadership, mapped to these controls.

Readiness Exercises →

From €2,400 · scoped in one call

03

Readiness stages

Stage 01UnawareNo inventory. No classification. Exposure unknown and unmanaged.
Stage 02InventoriedAI systems identified and documented. Risk tiers not yet assigned.
Stage 03AssessedRisk classification complete. Obligations identified per system.
Stage 04ControlledDocumentation, oversight, and monitoring mechanisms in place.
Stage 05CompliantAll obligations met. Audit-ready. Board-reportable. Deadline secure.
Proof, not promises

Watched at the source.
Proven by hash.

Every Monday, Klarr sweeps EUR-Lex and retsinformation.dk at the source. When the law moves, you know. When it doesn’t, nothing moves your deadlines.

4 regimes · 5 watched sources · EUR-Lex SPARQL + national document hashes · weekly

Cordero Management’s own Klarr readiness seal, rendered live from production

We run Klarr on Klarr. Our own attestation, rendered live from production, resolved by SHA-256 hash.

Green is earned, never decorative: past its review date this badge turns amber and says so, ours included. Verify it →

04

Engagement & pricing

What you are replacing

Knowing where you stand is normally one consulting engagement per regulation — weeks each, and the report decays the day it lands. Klarr maps all four regimes at once, in days; the roadmap is yours to execute with anyone. The comparison is not with other software. It is with the alternative.

Cost of the alternative
Consultant as-is assessment — per regulation1–3 weeks at €1,500–2,500/day, per regime. Four regimes: do the maths.
€10,000–40,000+
Legal review — per system, per cycleRepeated for every high-risk system, every annual update.
€3,000–6,000
Consultant on retainer — to keep watchTwo days a month at the same day rates, just to stay current.
€3,000–5,000/mo
Internal coordination overheadInventory, evidence-chasing, board prep — across four regimes now.
€1,200–2,400/mo
Klarr Readiness AssessmentAll four regimes, sealed report, prioritised roadmap, architecture verdict. Scoped precisely to your estate.
from €4,900
Klarr PlatformThe posture maintained and provable continuously — instead of a standing consultant.
€299–499/mo

From €4,900 is the floor, not a teaser: a short call scopes your estate and you have the exact number before you commit to anything.

Based on EU market consulting day rates. Your costs will vary. The direction will not.

Start with the assessment — complete in itself. The platform keeps the posture current afterwards, and is optional.

Readiness Assessment
From €4,900
single engagement · exact quote after a short scoping call

The as-is, the roadmap, the verdict — all four regimes. Complete in itself.

  • Guided multi-regime assessment (days, not months)
  • Every determination cited to the operative article or Danish paragraph
  • Gap register prioritised by cross-regime leverage
  • Sealed, hash-verifiable readiness report
  • Architecture verdict: reference / sovereign runtime / air-gapped
  • Board-ready presentation of findings
Platform
€299/mo
Starter · billed monthly

The posture, maintained: evidence, watch, attestations that stay current.

Professional — €499/mo. For estates with high-risk systems: unlimited systems, multi-entity, priority regulatory alerts.

  • Continuous readiness across all four regimes
  • Thirteen-control evidence base
  • Live watch: EUR-Lex + Danish law, weekly
  • Verifiable attestations (the Klarr Seal)
  • Snapshot-over-snapshot progress for the board
  • Regulatory alerts when the law moves
Design Partnership
Custom
scoped with you, per engagement

Government and regulated finance: tailored scope, executive workshops, a direct line.

  • Tailored regime scope and depth
  • On-site assessment and executive briefings
  • Legal review integration
  • Sector add-ons (clinical, financial, HR AI)
  • SLA-backed advisory
  • Early access to new regime modules

Turn European regulation from a liability into a competitive advantage.

A short call scopes your estate — you have the exact quote before you commit to anything.

Klarr is a compliance intelligence platform, not a law firm and not a notified body. Nothing on this platform constitutes legal advice. Output from Klarr should be reviewed with qualified legal counsel before reliance in regulatory, contractual, or enforcement contexts. Cordero Management ApS accepts no liability for decisions made based solely on platform output.