Every mandate asks for the same thing from a different angle
BCBS 239 wants risk data aggregation you can prove. Model risk guidance wants a documented inventory and validated logic. DORA wants an accurate ICT register. The AI Act wants logging and human oversight. Each one is a request for governed definitions and end-to-end lineage. Build it once and stop rebuilding it per examination.
Trusted to govern the data behind the world's most regulated decisions.
Supervisors have stopped accepting remediation programmes as evidence
The ECB has named risk data aggregation and reporting a supervisory priority through 2027, and thematic reviews keep landing on the same two findings: governance arrangements and risk data architecture. What examiners now want is demonstrated, sustained control, which means the evidence has to be a byproduct of how the data is managed rather than a project run ahead of the visit.
In combined OCC and Federal Reserve penalties against one global bank across 2020 and 2024, the second tranche specifically for insufficient progress remediating data quality management deficiencies.
Less time assembling evidence when the audit trail is produced by the work rather than reconstructed for the examiner.
One governed model and lineage graph serving BCBS 239, model risk, DORA, and AI Act obligations.
Policy as code
Encode the control, then let it run
Express data quality, completeness, and ownership requirements as SHACL constraints that validate continuously. A control that runs on every change produces a different kind of evidence than a control that is attested to quarterly.
- Constraints, not checklists. Requirements expressed as machine-readable rules the platform enforces.
- Continuous validation. Every change is checked when it lands, with the failing asset and owner named.
- Control coverage view. Which requirements are enforced automatically and which still rely on attestation.
Risk data lineage
Trace a reported number to its source
BCBS 239 principles on accuracy and integrity come down to whether you can follow a figure from the regulatory report back through every aggregation and transformation to the originating system. Held as a graph, that trace is a query rather than a documentation exercise.
- Source to submission. The full path connected as one graph, including manual adjustments.
- Aggregation logic visible. How a figure was rolled up, not just where it came from.
- Impact analysis. Which reports and submissions depend on a definition before you change it.
Model and AI inventory
One inventory covering models, agents, and their data
Models, the LLM-based tools now in scope alongside them, their owners, their validation status, and the governed data domains each reaches are all held as connected data. An inventory request becomes a query, and the gaps are visible before someone else finds them.
- Models and agents together. One inventory, whether the system is a scorecard or an assistant.
- Validation status tracked. Owner, last review, next review, and outstanding findings per model.
- Data dependency mapped. Which governed domains and definitions each model consumes.
Audit & examination readiness
Answer an examiner in minutes
Every change, approval, and validation result is captured as it happens. When an examiner asks who changed a definition, when, and on whose authority, the answer is an export. This is the difference between a control environment and a control narrative.
- Automatic evidence. The trail is produced by the work, not assembled afterwards.
- Who, what, when. Full change history on every governed definition, rule, and mapping.
- Point-in-time reconstruction. Show the state of the model and the data as it stood on any past date.