Vailor: the sovereign AI-native GRC alternative to Archer

One organisation is usually in scope of several frameworks at once: ISO/IEC 27001 to certify its management system, the NIS2 directive as transposed into national law, the DORA regulation for financial entities, plus the contractual requirements its customers impose and its own internal policies. Handling each framework in its own silo means writing the same controls several times over. A multi-framework approach keeps one control base, links every control to the requirements it satisfies, and collects each piece of evidence once for all the frameworks that call for it. In Vailor, NIS2 and ReCyF, DORA, NIST CSF 2.0 and the ANSSI hygiene guide are available; ISO/IEC 27001 is planned, and other frameworks can be added by the Vailor team.

The rule that survives contact with reality: one owner per control, not one owner per framework. Each framework has a sponsor, accountable for the demonstration made to an auditor or a supervisory authority, while the control itself stays with a single operational team. Where two requirements overlap, the stricter one settles the design. In Vailor a control carries its evidence and the actions that move it forward, and the per framework reading is a view over that same base, so the security committee and the business units work from identical figures.

Getting the platform available is rarely the constraint. The time goes into the material: settling the scope, inventorying assets and processes, linking controls to each framework's requirements, and naming the people accountable. Hence the sequence we recommend: start on one framework and one perimeter, produce something usable, then extend. Working in stages gives regular checkpoints and stops a programme from drifting without anyone noticing.

Contributors outside the security team experience GRC as extra work, phrased in somebody else's vocabulary. Two levers work: cut down what they are asked to produce, and make the purpose visible to them. In Vailor, the business starts its pre-assessment by answering simple questions, then the AI reads the project documents and prefills the risk analysis, so the contributor reviews and corrects instead of facing a blank form. When the AI relies on the documents, it quotes the passage, checked word for word, and every decision is recorded, which is what makes a business owner willing to sign it off in committee.

The order that keeps risk down: move first what carries value and history, namely the risk register, the control base with its owners and statuses, the open action plans, and the evidence covering the current audit cycle. Superseded versions and closed threads belong in an archive export rather than in the new platform. In practice we rebuild the control to requirement mapping first, then import, then reconcile on a perimeter the teams already know well. Running one reporting cycle in parallel lets a committee compare figures before the switch.

Frameworks move. The 2022 edition of ISO/IEC 27001 restructured Annex A into 93 controls across four themes, and the national laws transposing NIS2 land at different speeds across member states. On a multi-framework base, a new version is first an impact analysis: which requirements shift, which controls are affected, which evidence still holds. Because Vailor maintains each control in one place, that impact is read against the base instead of being redone framework by framework, and the decision history stays attached to the control.