Provenly
A Greek compliance management platform for NIS2, the AI Act, GDPR, CRA, ESG/VSME and DORA. Every obligation becomes a per-company requirement with a control, an owner, evidence and a deadline. Designed for groups with many legal entities and for the advisors who support them.
One platform, every regulatory framework.
What it does
Every obligation of every regulation, from Greek Law 5160/2024 for NIS2 to the AI Act and GDPR, becomes a per-company requirement with a control, an owner, evidence and a deadline. Management sees at any moment what is covered, what is pending and who owns it, across all frameworks at once.
An incident is assessed once for NIS2, AI Act and GDPR, with each authority's clock running separately. Coverage is measured only from approved evidence, not from statements.
The problem it solves
Obligations come from many sources and overlap. The work lives in spreadsheets that go stale the moment they are closed, and when the audit comes the evidence cannot be found. Management carries the responsibility without having the picture.
Provenly keeps one source of truth for the whole group: which provision, which company, which control, which file, which date. The advisor works inside the same platform as the client, with their own role and time-limited access.
What it includes
Regulation library
Versions, provisions, obligations, accent-insensitive search.
Scope and requirements
A questionnaire per legal entity, a requirements register.
Controls and coverage
One control evidences many obligations; coverage is measured automatically.
Evidence
Files, links, attestations, four-eyes approval, sealed packages.
Tasks and approvals
Recurring tasks, reminders, approval flows.
Incidents
Status, deadlines, national authority forms, one assessment for NIS2, AI Act and GDPR.
Inventory and risk
Assets, AI systems, 5x5 matrix, suppliers.
NIS2 specifics
Registration, security officer, vulnerabilities, self-assessment, security policy.
AI Act
Classification of every AI system with an obligation timeline, deployer plan (Article 26), FRIA (Article 50), public-sector AI project declaration (Law 5321/2026, Article 21).
Six frameworks, one core
The same mechanism (obligation, control, evidence, coverage) applies to every regulatory framework. You switch on the ones that concern you, and one control covers obligations in more than one.
NIS2
Greek Law 5160/2024 and its ministerial decisions, provision by provision.
AI Act
System classification, deployer and provider obligations, FRIA, Article 4 through Credenz.
GDPR
Beyond breaches: records of processing, DPIA, data subject requests.
CRA
For manufacturers and software houses with products containing digital elements.
ESG / VSME
Sustainability data for the value chain, using the VSME standard for SMEs.
DORA
For banks, insurers and their ICT providers.
Why you can trust it
- Every organisation in an isolated data space, with roles and time-limited access for externals.
- A full audit trail: who changed what and when, per requirement and per piece of evidence.
- Sealed evidence packages that verify independently of the platform.
- Periodic penetration testing by independent third parties and a path to ISO/IEC 27001 for the operator.
- Imports Credenz's sealed training evidence, so Article 4 is covered from the same register.
See it in practice
In a 45-minute demo we walk through the register, the controls, the evidence and an incident end to end, with your frameworks and your group structure. Onboarding a new organisation takes a few days.
Let us find out where you stand.
A 30-minute conversation on where your organisation stands against the EU AI Act and what is worth doing first. You leave with a clear picture, not a sales pitch.