The GRC problem in 2026

A European company in the financial sector must simultaneously comply with ENS (if it works with the Spanish public administration), NIS2 (European cybersecurity directive), DORA (digital operational resilience for the financial sector), ISO 27001 (if it seeks certification), GDPR (data protection) and, potentially, the EU AI Act (if it uses AI systems). That means hundreds of controls, many overlapping across frameworks.

The compliance department of an average company has between 1 and 5 people. Keeping documentation up to date, preparing audits, tracking findings, mapping controls across frameworks and generating evidence is work that consumes thousands of hours per year. Most of it goes to bureaucratic tasks, not to improving actual security.

AI does not replace the CISO or the compliance team. What it does is eliminate mechanical work: automatically mapping controls across frameworks, identifying compliance gaps, generating policy drafts and preparing audit documentation. The human team reviews, adjusts and makes decisions.

Regulatory frameworks: ENS, NIS2, DORA, ISO 27001

ENS (Esquema Nacional de Seguridad)

Mandatory for every Spanish public sector entity and for companies providing them technological services. Three levels (basic, medium, high) with increasing controls. ENS High requires 75 security measures organized in 3 frameworks (organizational, operational, protection).

What AI automates in ENS:

• Automatic system categorization based on dimension valuation (availability, integrity, confidentiality, authenticity, traceability).
• Selection of applicable security measures by level.
• Generation of the Statement of Applicability (SOA).
• Compliance plan tracking.

NIS2 (Network and Information Security Directive 2)

European directive in force since October 2024, with national transposition in each member state. Applies to essential and important entities in 18 sectors (energy, transport, banking, health, water, digital, public administration, space, food, chemicals, manufacturing, postal, waste, research). Penalties can reach 10M EUR or 2% of global turnover.

Key obligations AI can automate:

• Risk analysis and information system security policies.
• Incident management (including 24-hour notification to CSIRT/competent authority).
• Business continuity and crisis management.
• Supply chain security.
• Cybersecurity training for senior management.

DORA (Digital Operational Resilience Act)

Specific to the European financial sector. In force since January 2025. Focuses on digital operational resilience: ICT risk management, resilience testing (including threat-led penetration testing), ICT third-party risk management, threat intelligence sharing.

ISO 27001:2022

The international standard for information security management systems (ISMS). 93 controls in 4 categories (organizational, people, physical, technological). ISO 27001 certification has become a de facto requirement for selling B2B services to large enterprises.

Control mapping with AI

The biggest headache in GRC is that each framework has its own controls, but many overlap. The "access control policy" control appears in ENS (mp.ac), NIS2 (Art. 21.2), DORA (Art. 9) and ISO 27001 (A.5.15, A.8.3). Without mapping, the team documents the same thing 4 times.

Automated mapping with LLMs

An LLM can compare controls from different frameworks and determine whether they are equivalent, partially overlapping or independent:

# Control mapping between frameworks with LLM
CONTROL_MAPPING_PROMPT = """
You are a GRC expert with deep knowledge of ENS, NIS2, DORA and ISO 27001.

Given the following control from {framework_source}:
Control ID: {control_id}
Title: {control_title}
Description: {control_description}

Identify all equivalent or partially equivalent controls in
{framework_target}. For each mapping, indicate:
- Target control ID
- Target control title
- Degree of equivalence: "complete" (covers the same), "partial" (overlap),
  "complementary" (related but different)
- Key differences between both controls
- Evidence that serves both controls

JSON format:
{
  "mappings": [
    {
      "source": {"framework": "ENS", "id": "mp.ac.1", "title": "..."},
      "target": {"framework": "ISO27001", "id": "A.5.15", "title": "..."},
      "equivalence": "complete|partial|complementary",
      "differences": "...",
      "shared_evidence": ["..."]
    }
  ]
}
"""

Unified Control Framework (UCF)

The result of mapping is a unified framework owned by the organization: a catalog of controls where each control has cross-references to all applicable frameworks. This way, when evidence is documented, it covers multiple frameworks simultaneously.

Example of a unified control:

Control UCF-AC-001: Access control policy
├── ENS:       mp.ac.1 (Access control)
├── NIS2:      Art. 21.2.d (Supply chain security)
├── DORA:      Art. 9.4 (Access rights management)
├── ISO 27001: A.5.15 (Access control), A.8.3 (Access restriction)
├── GDPR:      Art. 32 (Security of processing)
├── Shared evidence:
│   ├── Access control policy (document)
│   ├── Roles and permissions matrix (IAM export)
│   ├── Access review log (last quarter)
│   └── User provisioning/deprovisioning procedure
└── Status: Compliant (last review: 2026-05-15)

Automated gap analysis

Gap analysis compares what the framework requires with what the organization has implemented. Traditionally it is a weeks-long manual process: review each control, speak with the responsible parties, verify evidence.

Gap analysis with AI

An AI system can automate much of the process:

1. Automated control inventory. Scan the infrastructure to verify: MFA enabled? Encryption at rest active? Centralized logs? Scheduled backups? Patching up to date? This can be automated with APIs from the systems themselves (AWS Config, Azure Policy, Supabase management API).
2. Comparison with framework requirements. The LLM compares the collected evidence with each control's requirements and determines: compliant, partially compliant, non-compliant.
3. Gap prioritization. Not all gaps are equal. AI prioritizes by risk (what happens if this control fails?), remediation effort (how much does it cost to implement?) and regulatory impact (is it a critical control for certification?).
4. Remediation plan. For each gap, the LLM suggests concrete actions, estimated timelines and owners.

# Automated gap analysis
def run_gap_analysis(organization, framework):
    controls = framework.get_controls()
    results = []

    for control in controls:
        # 1. Collect automated evidence
        auto_evidence = collect_automated_evidence(control, organization)

        # 2. Search existing documentation
        docs = search_documentation(control, organization.doc_repository)

        # 3. LLM evaluates compliance
        assessment = llm.assess_compliance(
            control=control,
            evidence=auto_evidence,
            documentation=docs,
            organization_context=organization.profile
        )

        results.append({
            "control_id": control.id,
            "status": assessment.status,  # compliant | partial | non_compliant
            "confidence": assessment.confidence,
            "gaps": assessment.gaps,
            "remediation": assessment.remediation_plan,
            "effort_estimate": assessment.effort_hours,
            "risk_if_unaddressed": assessment.risk_level
        })

    return sorted(results, key=lambda r: r["risk_if_unaddressed"], reverse=True)

Audit preparation with AI

Preparing an audit (internal or certification) consumes between 2 and 6 weeks of the compliance team's time. Most of it goes to: collecting evidence, organizing documentation, preparing interviews and anticipating findings.

Preparation automation

Evidence collection. An AI agent can automatically traverse systems and collect the evidence the auditor will ask for: firewall configuration exports, access review logs, training records, security committee minutes, patching metrics, business continuity test results.

Documentation organization. The LLM generates a documentation index aligned with the framework structure, where each control has its folder with the corresponding evidence, labeled and dated.

Audit simulation. An LLM can act as an auditor and ask the typical questions an auditor would ask for each control. This lets the team rehearse answers and detect weaknesses before the actual audit.

Finding anticipation. Based on the gap analysis, AI identifies the points where the auditor will likely find non-conformities and suggests preventive actions.

Policy and procedure generation

Each framework requires a set of documented policies. ISO 27001 requires at least 15 mandatory policies. ENS High adds more. Writing a security policy from scratch takes between 8 and 40 hours depending on complexity.

LLMs as policy drafters

A well-configured LLM can generate policy drafts that cover 80% of the final content. The human analyst reviews, adjusts to the organization's specific context and approves.

POLICY_GENERATION_PROMPT = """
Generate a {policy_type} policy for {organization_name}.

Organization context:
- Sector: {sector}
- Size: {employee_count} employees
- Applicable frameworks: {frameworks}
- ENS level: {ens_level}
- Specific requirements: {special_requirements}

The policy must include:
1. Purpose and scope
2. Regulatory references (specific articles from each applicable framework)
3. Definitions and terms
4. Roles and responsibilities
5. Specific guidelines (minimum 8)
6. Exceptions and exception approval process
7. Sanctions for non-compliance
8. Review and update (frequency, responsible)
9. Version history

Format: professional, clear and direct language, no ambiguities.
Tone: normative (using "shall", "must", not "should" or "may").
Length: 3-6 pages.
"""

Policies LLMs generate well

• Access control and identity management policy.
• Information classification policy.
• Acceptable use of assets policy.
• Security incident management policy.
• Backup and recovery policy.
• Secure development policy.
• Vendor management policy.
• Vulnerability management procedure.

Continuous compliance monitoring

Compliance is not a project done once a year before the audit. It is a continuous process. AI enables the shift from point-in-time audits to continuous monitoring.

Automated compliance indicators

• MFA coverage: percentage of users with MFA active. If it drops below 100%, alert.
• Patching: percentage of assets with critical patches applied within 72 hours.
• Logs: percentage of assets sending logs to the SIEM. If a server stops sending, alert.
• Backups: percentage of successful backups in the last 30 days.
• Training: percentage of employees with security training completed in the last year.
• Access reviews: number of accounts without access review in more than 90 days.

A dashboard with these indicators, updated in real time, lets the CISO see compliance status at a glance instead of waiting for the next quarterly report.

GRC tools with AI

• Vanta: compliance automation for SOC 2, ISO 27001, HIPAA. Good for startups and SaaS. Direct integration with AWS, Azure, GitHub. From 4K USD/year.
• Drata: similar to Vanta, with more enterprise focus. Support for European frameworks (ENS, NIS2). From 6K USD/year.
• Tugboat Logic (OneTrust): GRC with AI to suggest controls and generate policies. Acquired by OneTrust.
• Hyperproof: GRC platform with multi-framework mapping. Good for organizations with 4+ simultaneous frameworks.
• PILAR (CCN): official tool from Spain's CCN for ENS risk analysis. Free for the Spanish public sector. No native AI, but its export can feed an LLM.
• Custom (FastAPI + LLM): for organizations with sovereignty requirements, build a custom GRC module with a self-hosted LLM that processes internal documentation.

Ejercicio practico

Puntos clave