Obligations instead of statute names
What is assessed is the individual obligation at clause level, not the statute as a whole. Every assessment hangs off a catalog control and can be cross-linked with measures and ISMS controls.
ISMS & Risk
Legal Register
Which rules apply to us, and who takes care of which clause?
ISO 27001 and most management systems require a register of binding obligations. In practice this is often a spreadsheet of statute names that nobody touches again. The legal register goes one level deeper: it maintains not just the norm but the individual obligation at clause level, assesses its relevance to your organisation, assigns an owner and a review cycle, and links it through the OSCAL catalogs to the measures and controls that satisfy it. When the version of a norm changes, the register reports it on its own.
ISO 27001DSGVONIS2EU AI Act
Features
Your benefits
What applies to us, and what does not
A compliance profile describes the organisation, and a rule-based applicability check derives from it which norms are relevant at all. Non-applicability is thereby documented too.
The register reports on its own
An internal source watcher monitors the references and raises an alert on legal changes. Review cycles remind you in time instead of surfacing during the audit.
State law is carried along
Alongside federal and EU law, the 16 German state data protection acts are included and automatically narrowed via the state assignment.
Capabilities
Capabilities in detail
- Register of binding obligations from laws and regulations
- Official orders, contracts and voluntary commitments as sources
- Obligations at clause level on top of the OSCAL catalogs
- Relevance assessment per entry with justification
- Owners and review cycle per obligation
- Assessments per catalog control with a measures crosswalk
- Crosswalk into the ISMS instead of a separate parallel list
- Compliance profile of the organisation
- Rule-based applicability check per norm
- Version monitoring with alerts on legal changes
- Internal source watcher for the stored references
- Review cycle notifications and dashboard widgets
- State assignment and the 16 German state data protection acts
- Editorial catalogs for BDSG, TDDDG and the EU AI Act
- AI document check: obligation coverage in policies and the DMS
- Linking obligations to assets
Result
A solid answer to the audit question about binding obligations, including the justification for why a norm does not apply.
Experience Legal Register live
Schedule a no-obligation demo – we will show you the module with your own use cases.