The problem
Regulatory obligations change over time, while their relationships to policies, procedures, controls, and evidence are often maintained in disconnected spreadsheets.
What EKOS does
EKOS versions supported regulatory content, preserves stable requirement identities, records change classification and review state, and evaluates requirement mappings backed by reviewed graph relationships.
- Framework subscriptions and stable requirement identities
- Versioned supported regulatory sources
- Change classification with confidence and review state
- Requirement mappings with excerpts and provenance
- Distinct mapped, gap, review, and change states
How it works
Supported regulatory content enters the same ingestion, versioning, search, and graph pipeline as internal documents.
A stable requirement registry preserves citation identities, so a control or section keeps its identity when a source is republished.
Change analysis classifies an update as substantive, structural, or editorial and records the old and new obligations, dates, confidence, and review state.
Requirement mappings to internal documents carry excerpts, confidence, and provenance, and count toward coverage only when approved or accepted under explicit policy.
Requirements without a qualifying mapping appear as explicit gaps instead of disappearing into a blended score.
Business outcome
Compliance teams can inspect a regulatory event, its requirement context, the mapped internal artifacts, and the gaps that still need attention in one workspace.
Proof and human control
Coverage is shown requirement by requirement and counts only qualifying approved or policy-auto-accepted relationships, with unmapped requirements displayed as distinct gaps.
Example in practice
A supported regulatory source records a changed retention section. An analyst reviews the old and new obligations and evaluates approved mappings to internal policies before opening the related work.
Scope today
This capability is in preview. Supported analyses are not a universal monitoring service, and documented coverage is not a legal conclusion, certification, or proof of operating effectiveness.