# NIS2, GDPR and AI Act compliance status > How NetSenX supports NIS2 Articles 21 and 23, GDPR and the EU AI Act. SOC 2 Type I and ISO/IEC 42001 are in preparation, not attested. Source page: https://netsenx.com/en/compliance Compliance status Compliance is part of the product, not an extra. NetSenX is preparing for a SOC 2 Type I report, ISO/IEC 42001 for AI management and ISO/IEC 27001 for information security. None of them is awarded yet; this page states where each one stands, next to the regulations NetSenX supports today: NIS2, GDPR, the Cyber Resilience Act and the EU AI Act. Request the evidence pack Book a CISO briefing ### Three standards, each with its own external audit Standards in preparation SOC 2 reports on how we operate controls, ISO/IEC 27001 on how we manage information security, ISO/IEC 42001 on how we govern AI. Each will be audited by an independent body; together they give a buyer's legal, security and AI reviewers evidence each can accept on its own terms. What this gives you Read details Type I In preparation — not attested yet · no audit date set An independent attestation that security, availability and confidentiality controls are designed as described: the trust report most SaaS procurement teams ask for. AI management system In preparation — no certificate yet · no audit date set Governance, risk, transparency and lifecycle controls for every AI component in NetSenX, under the international standard for AI management systems. Information security management Planned — no certificate yet · no audit date set An information security management system covering assets, access, cryptography, suppliers, incidents, business continuity and compliance. ### The order of work Certification roadmap None of these certifications is awarded yet and no audit is booked, so we show the order of the work, not dates. A date appears here only once an audit is booked with an independent auditor. Procurement teams can request our evidence pack at any time. Certification milestones #### SOC 2 Type I audit Step 1 · in preparation By an independent audit firm. Trust Services Criteria: security, availability, confidentiality. #### ISO/IEC 42001 certification audit Step 2 · in preparation By an accredited certification body. The AI management system covers every AI component. #### ISO/IEC 27001:2022 certification audit Step 3 · planned By an accredited certification body. Planned scope: product, infrastructure and supplier chain. #### SOC 2 operating-effectiveness report Step 4 · planned Only after the controls have run through an observation period. #### All three in place Goal SOC 2, ISO/IEC 42001 and ISO/IEC 27001:2022. None is awarded today. ### What each standard gives you Three standards, three governance regimes, three audit bodies. Each is useful on its own; together they answer most of the questions a procurement team asks before approving a deployment. What this gives your team AICPA Trust Services Criteria In preparation — Type I · no audit date set SOC 2 answers the standard SaaS-procurement question: are this vendor's controls actually in place as described? A Type I report covers the design of the controls at a point in time. We are preparing for it; no audit date is set yet. Independent attestation of security controls (Trust Services Criteria: security) A report from an independent CPA firm you can hand to procurement and InfoSec, once issued A fixed scope you can compare with other vendors' reports A scope statement that names exactly which systems the report covers AI management system In preparation — no certificate yet · no audit date set ISO/IEC 42001:2023 is the first international standard for AI management systems. It gives a CISO an auditable answer to the question "how do you govern the AI inside your security product?". We are building NetSenX's AI management system to it. Documented governance for every AI component in NetSenX An AI risk register with named owners, reviewed on a fixed schedule Lifecycle controls: introduction, monitoring, retirement A direct evidence chain to the EU AI Act Article 50 transparency duties Information security management system Planned — no certificate yet · no audit date set ISO/IEC 27001 is a common requirement in EU procurement. The 2022 revision reorganised the Annex A controls into four themes: organisational, people, physical and technological. The planned scope covers the product, the infrastructure and the supplier chain. A Statement of Applicability covering the Annex A controls Asset, access, cryptography, supplier, incident, continuity and compliance controls Internal audit, management review and continual-improvement evidence A baseline many EU procurement processes ask for ### Built for the EU regulatory stack, by people who read the regulations. EU regulations The Cyber Resilience Act, NIS2, GDPR and the AI Act decide much of what an EU buyer must check before deploying a security product. We treat each one as part of the product, with the evidence to show for it. #### Cyber Resilience Act (CRA) Article 13 manufacturer obligations · Article 14 reporting The release pipeline generates a CycloneDX Software Bill of Materials (SBOM) for every published release. A coordinated vulnerability disclosure policy is published, with a 90-day coordinated disclosure window. Releases and SBOMs are signed with Sigstore cosign; the signatures sit in the public Rekor transparency log and can be verified independently. The vulnerability and incident notification process is designed around the reporting duties of Regulation (EU) 2024/2847, Article 14. Read the disclosure policy #### NIS2 Directive Article 21 risk-management measures · Article 23 reporting Evidence is organised by the Article 21 measure families: risk analysis, incident handling, business continuity, supply chain, secure development, cryptography, multi-factor authentication, training and more. Written for essential and important entities: you keep the regulatory duty, NetSenX supplies the detection and the paper trail. The incident workflow tracks the Article 23 deadlines — 24-hour early warning, 72-hour notification, one-month final report — and prepares each report for you to submit. Auditors see the same records your board sees; there is no separate audit-only version. NIS2 network monitoring #### GDPR by design Data minimisation, EU residency, a reachable DPO Sensitive fields such as integration credentials are encrypted with AES-256-GCM at the application layer before they reach storage. Collection is minimal by default: detection works mainly on flow metadata plus a few protocol fields read on the monitored host, and encrypted connections are never decrypted. Customer data is stored in the EU: the database in Ireland (AWS eu-west-1), the API in Frankfurt and Paris. A few named sub-processors (payments, transactional e-mail) operate in the USA under EU Standard Contractual Clauses. The DPO is reachable at dpo@netsenx.com, and a data processing agreement under GDPR Article 28 is published for procurement. Read the data processing agreement #### EU AI Act Article 50 transparency · ISO/IEC 42001 AI management system in preparation A public Article 50 transparency disclosure lists every AI component and its governance controls. The risk classification is documented: we assess NetSenX as a limited-risk system and apply several high-risk-grade practices voluntarily. An AI management system is being built to ISO/IEC 42001; no certificate is awarded and no audit date is set. An explanation on every alert and an audit log of who did what are part of the product, not a support request. Read the AI transparency disclosure ### The concrete things, not the slogans. Security controls A trust posture is the sum of the controls that survive an auditor's questions. Here are ours. #### AES-256-GCM field-level encryption Sensitive fields are encrypted at the application layer before they reach storage. FIPS 197 / NIST SP 800-38D #### Signed releases Release artefacts and their SBOMs are signed with Sigstore cosign (keyless, identity-bound), and each signature is recorded in the public Rekor transparency log, where anyone can verify it. Sigstore · Rekor #### Append-only audit log Administrative actions, AI-influenced alerts and data access are written to an append-only audit log, available on every plan, Free included. Tamper-evident, hash-chained #### EU data residency Customer data is stored in the EU: the database in Ireland (AWS eu-west-1), the API in Frankfurt and Paris. Every sub-processor, with its location and transfer safeguard, is listed in the data processing agreement. Database: AWS eu-west-1 #### Coordinated vulnerability disclosure Researchers report to security@netsenx.com. We acknowledge within 2 business days, decide on triage within 5, and coordinate public disclosure within 90 days. Published disclosure policy #### security.txt published A standards-compliant security.txt at /.well-known/security.txt with contact, policy, preferred-language and expiry fields. RFC 9116 ### Beta programme open Design partners We do not display customer logos we have no right to display. When design partners agree to be named, they will appear here, with their explicit consent. Join the beta programme Beta partner ### Need an evidence pack for your auditor? For your auditor Before any certification completes, we maintain an evidence pack mapped to SOC 2, ISO/IEC 42001, ISO/IEC 27001, CRA, NIS2, GDPR and AI Act controls. Request it under NDA and we send it to you directly. Request the evidence pack Book a demo Who builds NetSenX The Spanish company that builds and operates NetSenX, from Alicante. ISO/IEC 42001 lead implementer on our team A personal credential for implementing an AI management system. TriStiX S.L. itself holds no ISO/IEC 42001 certificate; its AI management system is in preparation. Company research on arXiv TriStiX S.L. research preprint arXiv:2603.28558v1 — multi-valued logic for compliance applications Built in-house The detection engine, the agent, the dashboard and this site are written and reviewed by TriStiX S.L.; there is no white-labelled third-party engine EU company TriStiX S.L. — Av. Maisonnave 41, 3º, 03003 Alicante, España · NIF B-26925016 EU mid-market security teams see the same pattern repeat: the detection stack gets louder every quarter, the budget tighter every year, and the alert backlog grows faster than any small team can work through it. Vendors call this coverage. The teams living with it call it an alert factory. NetSenX exists because more alerts do not buy more security. The false-positive bound comes from split-conformal prediction, a published statistical method, applied to benign traffic your own analysts have labelled: it is derived, not tuned. How tight it is on your network depends on how much labelled traffic has been calibrated, which is why the product shows the bound your data supports and says plainly when it does not support one yet. The rest of NetSenX makes that operational: an AI Analyst Core that writes the analyst notes, an audit log that survives the auditor, and an AI management system being built to ISO/IEC 42001 so that it survives the regulator. EU mid-market security teams deserve network detection they can afford and explain. That is the company. What we are building next SOC 2, ISO/IEC 42001 and ISO/IEC 27001 — in preparation; dates follow once audits are booked. An EIC Accelerator application in Q4 2026 to scale the EU mid-market go-to-market. First engineering and customer-success hires, in Alicante and remote across the EU. TriStiX S.L. research preprint on arXiv