A compliance officer opens a spreadsheet at 4pm on the last Friday of the quarter. The evidence tracker has three versions, two owners and one auditor waiting on Monday. Someone suggests buying a GRC platform. Someone else says a free tool will do. Both are partly right, and both can
Who NIS2 applies to, the 10 Article 21 security measures, the 24 hour, 72 hour and one month reporting clock, fines, and a realistic implementation timeline.
Risk registers, controls management, and vendor tracking are moving from static spreadsheets to connected systems. Here is what's live today on RegentComply, what's on the roadmap, and why it matters for GRC teams now.
HREDD is the engine of the EU CSDDD. After the 2026 Omnibus, here is what supply chain due diligence now requires, who is in scope, and how to evidence it.
DORA has applied to almost every EU financial entity since 17 January 2025. The first registers of information were due to the European Supervisory Authorities by 30 April 2025. Neither of those dates moved because a compliance team was still waiting on a procurement sign-off. Regulators publish deadlines. They
A control you tested once and never checked again is not a control. It is a memory. Regulators know this, which is why almost every framework is built around cadence rather than one-time proof. Access reviews, policy attestations, vendor reassessments, and evidence refreshes all have to happen again, and
The regulatory grey zone for crypto in the United States is closing. In its 2026 Unified Regulatory Agenda, the SEC placed three crypto-focused rulemakings at the Proposed Rule Stage, each carrying a target date of July 2026. If your firm issues, custodies, or trades digital assets, these proposals will
An auditor-grade GDPR compliance checklist for SaaS companies and startups: who is in scope, lawful bases, data subject rights, international transfers, breach rules, and a 10-step plan.
A fractional compliance officer's problem is not knowledge. It is surface area. One person now carries the regulatory obligations of six, eight, sometimes ten organisations at once — each with a different framework, a different maturity level, a different regulator asking different questions on a different timeline. The skill
Email was never designed to be a system of record. Here's why evidence-by-email fails under audit pressure — and what a control-to-evidence register looks like instead.
Ninety-three controls. Four themes. Ten management clauses. That is what ISO/IEC 27001:2022 actually asks of you — and none of it is optional if certification is the goal. Most organizations that fail their Stage 1 audit don't fail because their security is weak. They fail because
A freelance compliance consultant juggling five clients is, in practice, running five parallel control environments out of one laptop. Each client has its own framework, its own evidence folder, its own version of "the tracker," and its own habit of emailing you a renamed copy of last quarter&
DORA
What DORA requires, who is in scope, the incident reporting deadlines, the register of information and a 16-step checklist for EU financial entities in 2026.
MiCA
The MiCA transitional period ended on 1 July 2026. An article-by-article checklist for CASPs: authorisation, capital, custody, market abuse, passporting and penalties.
News
This is regentcomply.ai, a brand new site by Kevin that's just getting started. Things will be up and running here shortly, but you can subscribe in the meantime if you'd like to stay up to date and receive emails when new content is published!