Empower every team involved in governance, risk, and compliance with AI that delivers verified, cited answers in seconds.

Sorena AI | GRC AI Platform for Governance, Risk, and Compliance

Accelerate regulatory research with AI-powered search and analysis. Every answer is source-linked and cited from trusted regulatory documents.

AI Research Copilot | Intelligent Compliance Research | Sorena AI

Turn any source document into a structured assessment. Import regulations, control frameworks, questionnaires, or audit templates.

Assessment Autopilot | Automate Any Compliance Assessment | Sorena AI

Benchmarks | AI Research Performance | Sorena AI

Navigate EU ESG and sustainability regulations with AI-powered research.

ESG Compliance Software | CSRD, DPP, PPWR | Sorena AI

Explore Sorena AI solutions for GRC automation: trusted data, AI assistants, research copilots, assessment workflows, and autonomous compliance operations.

GRC AI Solutions | Sorena AI

Connect Sorena to your AI model provider and the tools where your compliance knowledge lives.

Integrations | Connect Your AI and Data Stack | Sorena AI

Your Single Source of Truth for compliance: regulations, standards, CVE/CWE/CAPEC security data, and internal documents.

SSOT | Single Source of Truth for Compliance | Sorena AI

Advanced AU Cyber Security Act Compliance Decision Map for Australia Cyber Security Act 2024 implementation: scope testing, smart device security standards.

AU Cyber Security Act Compliance Decision Map: Scope, 72-Hour Reporting, Smart Device Rules | Sorena AI

Practical Australia Cyber Security Act 2024 compliance hub covering commencement dates, smart device security standards.

Australia Cyber Security Act 2024 Compliance Hub | Timeline, Smart Device Rules, and 72 Hour Reporting | Sorena AI

Grounded Brazil LGPD compliance hub covering Articles 3, 4, 7, 11, 18, 19, 33, 41, 48, and 52, plus ANPD guidance on roles, legitimate interest.

Brazil LGPD Compliance Hub: Scope, Rights, Incident Rule, Transfers, and ANPD Enforcement | Sorena AI

California CCPA compliance hub for scope thresholds, notice at collection, privacy policy disclosures, consumer rights, do not sell or share controls.

CCPA Timeline and Decision Flow | California Privacy Compliance | Sorena AI

CPRA compliance hub for sensitive personal information, correction rights, service provider and contractor rules, risk assessments, cybersecurity audits.

CPRA Timeline and Decision Flow | California Privacy Rights Act Guide | Sorena AI

ETSI EN 303 645 implementation guide for consumer IoT security: baseline requirements, secure update mechanisms, vulnerability disclosure policy (CVD).

ETSI EN 303 645 Consumer IoT Security Standard (Provision Map + Evidence Guide) | Sorena AI

ETSI EN 319 401 V3.1.1 implementation guide for Trust Service Providers: REQ-5 risk assessment, REQ-6 policies and practice statements.

ETSI EN 319 401 V3.1.1 Trust Service Provider Policy Requirements and eIDAS Mapping | Sorena AI

ETSI EN 319 411-1 V1.5.1 implementation guide for Trust Service Providers issuing certificates: CP vs CPS, policy OIDs, repository duties.

ETSI EN 319 411-1 V1.5.1 Certificate Issuance Standard (CP/CPS, Identity Validation, Revocation) | Sorena AI

ETSI EN 319 411-2 V2.6.1 implementation guide for EU qualified certificates: qualified policy OIDs, identity verification, QSCD boundaries.

ETSI EN 319 411-2 V2.6.1 EU Qualified Certificates (QCP, QEVCP, QNCP, QSCD, eIDAS) | Sorena AI

A practical hub for ETSI cybersecurity standards using the current ETSI editions: EN 303 645 V3.1.3 and TS 103 701 V2.1.1 for consumer IoT.

ETSI Standards Hub (EN 303 645 V3.1.3, TS 103 701, EN 319 401, EN 319 411) | Sorena AI

Practical EU Accessibility Act compliance hub for Directive (EU) 2019/882.

EU Accessibility Act Compliance Hub - 28 June 2025 Scope, EN 301 549, Evidence, and Procurement | Sorena AI

Advanced EU AI Act Compliance Decision Map for Regulation (EU) 2024/1689 implementation: scope and role tests, prohibited practices, high-risk classification.

EU AI Act Compliance Decision Map: Scope, Risk Class, GPAI, and Evidence Workflow | Sorena AI

Use this EU AI Act hub to work from the actual phased dates in Regulation (EU) 2024/1689, classify prohibited practices, high risk systems.

EU AI Act Timeline, Decision Flow, and Compliance Guides | Sorena AI

Use this Batteries Regulation hub to classify battery categories, map the exact dates in Regulation (EU) 2023/1542.

EU Batteries Regulation Timeline, Decision Flow, and Compliance Guides | Sorena AI

Advanced EU CRA Conformity Route Map for Regulation (EU) 2024/2847 implementation: scope testing for products with digital elements.

EU CRA Conformity Route Map: Scope, Classification, CE Path, and Reporting | Sorena AI

Use this CSDDD hub to confirm scope under Directive (EU) 2024/1760, apply the 2025 timing amendment correctly.

EU CSDDD Timeline, Scope Decision Flow, and Implementation Guides | Sorena AI

Use this CSRD hub to confirm scope, apply the stop the clock amendment correctly, build an ESRS reporting model, and prepare double materiality.

EU CSRD Timeline, Reporting Decision Flow, and ESRS Guides | Sorena AI

Practical Cyber Resilience Act guidance for products with digital elements: scope, Annex I requirements, support period, Article 14 reporting.

EU Cyber Resilience Act, CRA Compliance, CE Marking and Reporting | Sorena AI

Execution-oriented EU Data Act hub: key dates (applies 12 Sep 2025; connected-product design duty for products placed after 12 Sep 2026.

EU Data Act (Regulation (EU) 2023/2854): IoT Data Access, B2B Sharing & Cloud Switching | Sorena AI

Advanced EU Data Act Scope Decision Map for Regulation (EU) 2023/2854 implementation: scope and role determination.

EU Data Act Scope Decision Map: Role Logic, Data Sharing, and Switching Readiness | Sorena AI

A practical EU Deforestation Regulation (EUDR) hub with key dates, a decision flow, and grounded guidance on scope, operator and trader roles.

EU Deforestation Regulation (EUDR) Guide: Key Dates, Due Diligence Statement, Geolocation, Traceability | Sorena AI

A practical EU Digital Product Passport (DPP) artifact grounded in ESPR (Regulation (EU) 2024/1781): key milestones, current implementation status.

EU Digital Product Passport (DPP) Timeline and Compliance Decision Flow | Sorena AI

A practical EU Digital Services Act (DSA) compliance hub for Regulation (EU) 2022/2065: classify your service type (hosting/platform/marketplace/search).

EU Digital Services Act (DSA) Compliance Hub | Decision Flow + Timeline + Templates | Sorena AI

A practical EU Digital Markets Act (DMA) artifact with key dates, the current gatekeeper landscape, and a gatekeeper decision flow: CPS scope.

EU DMA Timeline and Gatekeeper Decision Flow (Articles 5-7) | Sorena AI

Advanced EU DORA Compliance Decision Map for Regulation (EU) 2022/2554 execution: determine scope and proportionality, operationalise ICT risk controls.

EU DORA Compliance Decision Map: Scope, TLPT, Incident Reporting, and ICT Third-Party Controls | Sorena AI

A practical EU DORA compliance hub for Regulation (EU) 2022/2554: confirm scope and proportionality, then implement ICT risk management controls.

EU DORA Compliance Hub | Decision Flow + Timeline + Templates | Sorena AI

A practical eIDAS hub for trust services, electronic signatures, electronic attestations of attributes, electronic archiving, electronic ledgers.

EU eIDAS & eIDAS 2.0 (EUDI Wallet) Hub | Trust Services, Signatures, QTSP, Wallet Readiness | Sorena AI

A practical EMC Directive hub: confirm scope for apparatus and fixed installations, choose Annex II or Annex III conformity assessment.

EU EMC Directive (2014/30/EU) Compliance Hub | Scope, Testing, Technical File, CE Marking | Sorena AI

A practical compliance hub for the Energy Efficiency Directive, Directive (EU) 2023/1791: determine the Article 11 route.

EU Energy Efficiency Directive (EED) (EU) 2023/1791 Compliance Hub | Audits, ISO 50001, Public Sector, Data Centres | Sorena AI

A practical compliance hub for the EU ePrivacy Directive.

EU ePrivacy Directive (2002/58/EC) Compliance Hub | Cookies, Consent, Marketing Rules, Communications Metadata | Sorena AI

A practical compliance hub for the EU Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781.

EU ESPR (Regulation (EU) 2024/1781) Compliance Hub | Ecodesign Requirements + Digital Product Passport (DPP) | Sorena AI

A practical GDPR compliance hub for Regulation (EU) 2016/679: run Article 2 to 3 scope analysis, choose and document lawful bases.

EU GDPR (Regulation (EU) 2016/679) Compliance Hub | Scope, Legal Bases, DSAR, DPIA, Breach, Transfers, Vendor Contracts | Sorena AI

A practical EU GPSR compliance hub for Regulation (EU) 2023/988: confirm scope and covered products.

EU General Product Safety Regulation (GPSR) (Regulation (EU) 2023/988) Compliance Hub | Scope, Economic Operators, Safety Gate, Recalls, Online Marketplaces | Sorena AI

A practical EU green claims hub for marketing and sustainability teams: classify what counts as a green claim.

EU Green Claims Directive (Proposal) Compliance Hub | Greenwashing Risk, Substantiation, Verification, Labels, and Evidence Packs | Sorena AI

A practical EU Low Voltage Directive artifact covering Directive 2014/35/EU as applied since 20 April 2016.

EU Low Voltage Directive (LVD) 2014/35/EU - Timeline and Decision Flow (CE Marking, Safety, Technical File) | Sorena AI

A practical EU Machinery Regulation artifact grounded in Regulation (EU) 2023/1230 and its corrigendum: entry into force on 19 July 2023.

EU Machinery Regulation (EU) 2023/1230 | Timeline, Annex I Route, Article 25 Modules, and Technical File | Sorena AI

A practical EU Market Surveillance Regulation artifact grounded in Regulation (EU) 2019/1020 and current Commission materials.

EU Market Surveillance Regulation (EU) 2019/1020 | Timeline, Article 4, Customs Controls, and Enforcement Flow | Sorena AI

A practical EU MDR artifact for Regulation (EU) 2017/745: confirm medical device or Annex XVI scope, identify economic operator role.

EU Medical Device Regulation (MDR) 2017/745 - Timeline and Decision Flow (Scope, Classification, Clinical Evaluation, PMS, UDI/EUDAMED) | Sorena AI

Advanced EU NIS2 Compliance Decision Map for Directive (EU) 2022/2555 execution: determine applicability across Annex I/II sectors.

EU NIS2 Compliance Decision Map: Scope, Essential vs Important, Article 21 Controls, and Incident Reporting | Sorena AI

A practical EU NIS2 Directive artifact grounded in Directive (EU) 2022/2555, the Article 3 and Article 4 Commission guidelines.

EU NIS2 Directive (EU) 2022/2555 | Timeline and Compliance Decision Flow | Scope, Essential vs Important, Article 21 Controls, 24h and 72h Incident Reporting | Sorena AI

A practical PPWR hub for Regulation (EU) 2025/40 on packaging and packaging waste.

EU Packaging and Packaging Waste Regulation (PPWR) | Regulation (EU) 2025/40 | Timeline, Decision Flow, Recyclability Grades, Recycled Content, Labelling, Reuse Targets | Sorena AI

A practical EU Radio Equipment Directive (RED) hub for Directive 2014/53/EU: confirm scope and Annex I exclusions, map essential requirements for safety, EMC.

EU Radio Equipment Directive (RED) 2014/53/EU | CE Marking, Cybersecurity (EU) 2022/30, Harmonised Standards | Sorena AI

A practical EU RoHS hub for Directive 2011/65/EU (including amendments such as (EU) 2015/863 phthalates): confirm EEE scope.

EU RoHS Directive (2011/65/EU) | Restricted Substances, Exemptions, CE Technical Documentation (EN IEC 63000) | Sorena AI

A practical EU Taxonomy artifact for Regulation (EU) 2020/852.

EU Taxonomy Regulation (EU) 2020/852: Timeline, Article 8 Scope, Eligibility and Alignment Decision Flow | Sorena AI

Practical FIPS 140-3 guidance for CMVP cryptographic module validation: security levels, module boundary, approved mode, transition timing, documentation.

FIPS 140-3 (CMVP Cryptographic Module Validation, Approved Mode, Transition) | Sorena AI

A practical hub for FIPS cryptographic algorithms used in products and FIPS 140-3 validations: AES, secure hash, digital signatures.

FIPS Crypto Algorithms (AES, SHA, Signatures, PQC) | Sorena AI

A practical hub for FIPS standards and NIST validation programs: FIPS 140-3 cryptographic module requirements, CMVP guidance.

FIPS Standards Hub (FIPS 140-3, CMVP, FIPS Crypto) | Sorena AI

Browse Sorena AI GRC artifacts, compliance decision maps, timelines, checklists, and implementation guides for EU, UK, US, and global standards.

GRC Artifacts and Compliance Guides | Sorena AI

Practical ISO 22301 guidance for a business continuity management system: BCMS scope, leadership, business impact analysis, risk assessment.

ISO 22301 Business Continuity Management System Guide | Sorena AI

Choose the right ISO standard with grounded implementation context: ISO 27001 for ISMS governance, ISO 27005 for risk method, ISO 27017 and 27018 for cloud.

ISO Standards Hub (Cybersecurity, Privacy, Resilience) | Sorena AI

Practical ISO/IEC 27001:2022 guidance for implementing an information security management system: scope, risk assessment, risk treatment.

ISO/IEC 27001:2022 ISMS Guide | Sorena AI

Practical ISO/IEC 27005:2022 guidance for information security risk management: context, criteria, assessment, treatment, risk communication, monitoring.

ISO/IEC 27005:2022 Risk Management Guide | Sorena AI

Practical ISO/IEC 27017 guidance for cloud security controls based on ISO/IEC 27002: shared responsibility model, cloud-specific implementation guidance.

ISO/IEC 27017:2015 (Cloud Security Controls) | Sorena AI

Practical ISO/IEC 27018 guidance for public cloud PII processors.

ISO/IEC 27018 (Public Cloud PII Processor Privacy Controls) | Sorena AI

Practical ISO/IEC 27035 guidance for incident management across the full series: Part 1 principles and process, Part 2 planning and preparation.

ISO/IEC 27035 (Information Security Incident Management) | Sorena AI

Practical ISO/IEC 27036 guidance for securing supplier relationships across the full series: overview and concepts (27036-1), requirements (27036-2).

ISO/IEC 27036 (Supplier Relationships Security) | Sorena AI

Practical ISO/IEC 42001 guidance to build an AI Management System that matches the standard as written: context and interested parties, role determination.

ISO/IEC 42001 (AI Management System) | Sorena AI

Practical NIST CSF 2.0 guidance grounded to NIST CSWP 29: GOVERN, the CSF Core, Organizational Profiles, Tiers, informative references.

NIST Cybersecurity Framework (CSF) 2.0 | Sorena AI

Practical NIST frameworks guidance grounded to the current set used in this repo: CSF 2.0, RMF context, SP 800-53 Rev. 5 Update 1, SP 800-61r3, SP 800-161 Rev.

NIST Frameworks Hub (CSF, RMF, SP 800 Series) | Sorena AI

Practical NIST SP 800-161 Rev. 1 Update 1 guidance for cybersecurity supply chain risk management: multilevel enterprise, mission, and operational model.

NIST SP 800-161 Rev. 1 (C-SCRM) | Sorena AI

Grounded NIST SP 800-218 SSDF guidance covering PO, PS, PW, and RV practices, secure toolchains, release integrity, provenance and SBOM handling.

NIST SP 800-218 SSDF v1.1 | Secure Software Development Hub | Sorena AI

Grounded NIST SP 800-53 Rev. 5 guidance covering the integrated security and privacy control catalog, the SR supply chain family, SP 800-53A assessments.

NIST SP 800-53 Rev. 5 | Security and Privacy Controls Hub | Sorena AI

Grounded NIST SP 800-61r3 guidance covering the April 2025 CSF 2.0 community profile, incident management, incident analysis, response communications.

NIST SP 800-61r3 | Incident Response and Recovery Hub | Sorena AI

Use Sorena AI Regulatory Universal Timeline to review 38 source timelines and 1297 dated compliance events in one view.

Regulatory Universal Timeline - 38 Source Timelines and 1297 Compliance Events | Sorena AI

Grounded Singapore PDPA compliance hub covering DPO and accountability duties, business contact information, data intermediary role limits.

Singapore PDPA Compliance Hub - DPO, Data Intermediaries, Breach Timelines, DNC, and Transfers | Sorena AI

UK GDPR compliance hub for Article 30 records, one month rights handling, 72 hour breach reporting, IDTA and UK Addendum transfers.

UK GDPR Timeline and Decision Flow | UK GDPR Compliance Guide | Sorena AI

Grounded UK Online Safety Act hub covering regulated user-to-user and search services, illegal content duties, child access and child risk assessments.

UK Online Safety Act Compliance Hub: Scope, Illegal Harms, Child Safety, and Ofcom Readiness | Sorena AI

Grounded UK PSTI hub covering relevant connectable product scope, the three mandatory security requirements, manufacturer importer distributor duties.

UK PSTI Act Compliance Hub: Scope, Security Requirements, Statements, and OPSS Readiness | Sorena AI

Learn about Sorena AI's journey in revolutionizing legal and cybersecurity compliance through AI innovation.

About Us | Sorena AI | Modern Governance, Risk, Compliance

Contact Sorena AI to request a demo, discuss GRC automation, or ask how our AI platform supports compliance, legal, security, and risk teams.

Contact Sorena AI | GRC AI Platform Demo

Copyright notice and takedown policy for Sorena AI.

DMCA Policy | Sorena AI

How Sorena AI handles personal data, privacy requests, and service providers.

Privacy Policy | Sorena AI

Terms and conditions for using Sorena AI services.

Terms of Use | Sorena AI

Search Sorena AI compliance artifacts, regulatory timelines, decision maps, solution pages, and company information.

Search Sorena AI

Search results

Start with a topic, regulation, or product area