Release Notes

From this release, insAIght shows you which parts of your documents satisfy the requirements of your frameworks, such as ISO 27001, NIS2 or DORA. That also changes when a requirement is Covered. Check your frameworks after the update, because a requirement that was Covered before can now be a Gap.

Requirements are checked against your documents

Each requirement now has checks. A check is one thing a document should show to prove the requirement, for example "The policy is reviewed yearly".

When you add a document to a requirement, agents read it and mark each check:

• Found, with the quote and its page
• Not found, with the reason

A requirement is Covered when the agents have found a passage for each of its checks, in documents you haven't marked Needs improvement. Until then it is a Gap, and the requirement shows which check is missing.

The checks come from the insAIght library and are written for every organization that has to meet the framework. Adjust them to your organization: use your own terms, add what your policies promise, and switch off what doesn't apply.

If your organization works with controls, a requirement without checks is Covered when every linked control is Implemented.

The help walks you through it in eight steps, with one example: Prove compliance.

Two agents read each document

• The first agent looks in the document for a passage that meets each check.
• The second agent reviews every passage the first one found, and overrules it when the passage doesn't really meet the check.

You have the final word on each document. Looks good accepts it. Needs improvement sends it back, and can turn your note into a task for whoever maintains the document. A document counts toward the status until you send it back, so review what the agents found.

Also new:

• Advice suggests up to three ways to make the evidence stronger, once the documents are read. It doesn't change the status.
• Deep scan reads each page as an image, for scanned documents without text.
• The Agents list in the top bar shows which agent is working on which document.

How checks work has the full rule.

Documents keep their versions

To replace a document with a newer copy, click New version on the existing document, rather than uploading it as a separate document.

• The new version keeps all the links of the previous one, and Versions shows the history.
• The agents read the new version again, and it waits for its own review.
• If you upload a document with the same name as an existing one, insAIght asks whether it is a newer version.
• Connectors that run on a schedule now add each run as a new version of the same document, so only the latest run counts.

File versions has the details.

insAIght now features an audit portal

Conducting certification and surveillance audits just got easier. From Team settings, an organization admin can now invite someone with the new "Auditor" role: they sign in and land directly in the Audit Portal, where they can access the audits assigned to them and nothing else in the workspace. Setting up an audit is just as easy: pick an audit type (Internal, Stage 1, Stage 2, Surveillance, Recertification, Special, or Attestation), assign the auditor, and the audit environment shows up on both sides immediately.

Every verdict freezes exactly what was reviewed

When the auditor records a verdict on a requirement in the Audit Portal (Conform, Minor or Major nonconformity, Not applicable, etc.), the system takes a permanent snapshot of everything the auditor was looking at: the requirement text, the linked controls and their owners, and every piece of evidence attached. If the organization edits a control, swaps an owner, or uploads new evidence afterwards, the requirement doesn't hide that: it shows a live "changes since snapshot" indicator with the old and new values side by side, plus a Snapshot button that reopens exactly what the auditor saw at the time.

From draft conclusion to a printable report

Writing up an audit's conclusion is now a proper draft: a rich-text editor that autosaves as you type, with live readiness stats showing how many requirements are assessed, and the verdict breakdown, so it's clear where things stand. Closing an audit is a deliberate, final action: every verdict, comment, and piece of reviewed evidence is then permanently locked, and the audit records who closed it, when, and their conclusion. It is then possible to generate a full printable report straight from the Audit Portal. This is an executive summary with a verdict chart, a results table, and a detailed section per requirement with the auditor's comments and evidence, which is ready to save as a PDF.

The Projects Tab becomes a workspace to track the implementation of your compliance programme

The Projects Tab has been rebuilt to function as a home base for coordinating your work. A project can now link almost anything (requirements, controls, tasks, objectives, risks, documents, processing activities, assets, and third parties) through a new "+ Link" menu. Each linked item shows its live status right there in the project. Tasks can be created directly inside a project and the task quick-view now lets you edit the assignee and due date inline, not just from the Projects pages. Notifications are more targeted too: mentioning someone notifies only them, and replying to a thread notifies just its participants. Whoever posts a project update now states a completion percentage directly, and a new "Projects" column has been added to other Tabs so you can see at a glance which project a requirement, control, task, risk, document, asset, or third party belongs to.

From gap to covered, faster

Linking a compliance objective to a requirement on a framework page now shows exactly which requirements that link reaches ("this also covers Article 44, Article 45(1), and 37 more"). With one click, user can accept all links at once. Alternatively, users can open a visual map showing each individual link between an objective and requirements, and choose to either link or unlink each one individually. A new Breakdown page lets you review and bulk-accept the proposed controls for every objective in a framework, instead of opening each objective individually. An objective's status (Planned, In progress, or Covered) is now computed automatically from the real state of its controls and tasks, rather than relying on a manual toggle that could fall out of sync with the actual work. And attaching evidence to a control now tells you its downstream effect immediately, for example "this moved Article 33 to Covered."

Playbooks can now target objectives

Playbook questions can now be scoped to a specific objective, in addition to the already existing control and framework targets. Framework names typed directly into a question ("GDPR," "ISO 27001") are now matched to the exact framework your organization has adopted whenever possible, instead of relying purely on fuzzy text matching, so a plain-language mention scopes a coverage scan just as precisely as inserting a formal framework chip.

See exactly what's inside the AI supply chain

explAIn's public catalog now features dedicated pages for AI models, platforms, and vendors, each linked to every application built on top of it. Every application now carries a composite transparency score — weighted across application, model, vendor, and infrastructure — featuring an explanation over the methodology used to reach that score. Vendors can now claim their own listing and verify it with a work email.

Know which of your suppliers are covered by ChainShield

Anove now has a supply-chain scan: ChainShield. Every third party you track now carries a ChainShield mark showing whether that supplier appears in the scan: a scanned shield if it does, a locked one if it doesn't yet, with a short preview of what ChainShield actually watches for. Third parties matched to the AI catalog also get a proper vendor card that links straight to their public ExplAIn profile — on the third-party page, in the properties sidebar, and on business-process diagrams.

A more honest view of your compliance workspace

Filters across Controls, Risks, Assets, Third Parties, Business Processes, Documents, Evidence, and Assessments now live in the page URL, so a filtered view can be bookmarked or shared, and every list states its count plainly as "N of M" instead of guessing. "My Work" is now a visible, removable filter chip rather than a hidden toggle. Framework pages also show whether you're actually improving — gaps closed, gaps opened, and requirements newly covered over the last 30 days — instead of just a bare coverage percentage.

Console: one view across every entity in your group

For organizations that oversee multiple entities such as holding companies and corporate groups, insAIght now ships a dedicated Console portal. The overview shows how much of the group's compliance work is covered, which entities are progressing, and which have stalled — each backed by a real trend chart rather than a bare percentage. Entities can be compared side-by-side in a matrix, browsed on a jurisdiction map, or ranked by what needs a decision next. A new Risk view rolls up who owns which risk across the group, and Programmes let a group run its own coordinated compliance work — a NIS2 roll-out, for example — as a shared project with a running thread that flags when an entity has gone quiet. A board-ready report renders from the same data, and ⌘/Ctrl+Shift+K opens a command palette to jump straight to any entity.

Onboarding recommends what actually applies to you

The onboarding wizard's framework recommendations now check your jurisdiction and your real industry sector together, using the same classification system (NACE) that EU financial regulation applies. A Dutch professional-services firm is no longer pre-selected for Saudi or aviation-specific regulations that don't apply, while a bank now correctly picks up DORA and PSD2 from the start.

Push evidence into insAIght without setting up a connector

A new public Ingest API lets you push evidence as JSON events or files directly into insAIght. They can be filed under your objectives and controls, with no connector required. Manage it from the new Developers page in your organization settings: create and revoke API keys, see when each was last used, and copy a ready-to-run example straight from the built-in documentation. Every push is recorded in an events ledger you can filter and review.

Choose exactly which folders sync from Google Drive

The Google Drive connector now asks you to pick specific folders to sync instead of granting access to your whole Drive. Selected folders appear as a clear list with a live file count, and setup won't save until at least one folder is chosen.