How Regurai measures framework coverage.
Regurai maps framework requirements to governance controls and supporting evidence, so coverage, gaps and the actions required are visible in one place.
Coverage is an indicator of mapping strength, not a compliance verdict.
Coverage shows the proportion of framework requirements held in Regurai that are mapped to governance controls and supporting evidence, weighted by the strength of that mapping: a fully covered requirement counts in full, a partially covered requirement counts as half, and a gap counts as none. Applicability, implementation and any assertion of compliance or certification remain the responsibility of the organisation.
Understand which requirements apply, how they map, and what evidence supports them.
Regurai represents these frameworks and regulatory themes so requirements can be mapped to controls and evidence.
EU AI Act
Supports alignment by connecting AI systems to purpose, risk classification, oversight and evidence.
ISO/IEC 42001
Supports an AI management system approach: ownership, lifecycle, review and continual improvement.
ISO/IEC 23894
Helps structure AI risk management activity and record how risk was identified and treated.
NIST AI RMF
Maps controls to the govern, map, measure and manage functions with supporting evidence.
DORA
Connects important services to their technology, data and third-party dependencies.
UK regulatory expectations
Helps demonstrate coverage where firms must evidence governance, oversight and accountability.
Model Risk Management
Maps model inventory, ownership, validation and lifecycle evidence to control requirements.
Operational Resilience
Provides evidence of dependency mapping, tolerance setting and continuity considerations.
Consumer Duty
Supports alignment by connecting customer outcomes to the processes and AI that influence them.
Data Governance
Maps ownership, quality, classification and permitted use to the requirements that depend on them.
Four coverage states, each with a defined meaning.
Covered
Mapped Regurai controls address the requirement across its aspects. Coverage of the mapping — not confirmation that the control operates effectively in your organisation.
Partially covered
One or more mapped controls address some, but not all, aspects of the requirement. Further mapping or evidence is required.
Gap — not yet covered
No control is currently mapped to the requirement, so no coverage can be evidenced. Treated as a gap requiring action.
Waived / not applicable
The requirement has been recorded as not applicable or formally waived, with the decision retained in the change history.
A framework is only useful once it reaches an owner.
Regurai turns regulatory and governance frameworks into connected requirements, controls, evidence, gaps and actions.
- Framework
- Requirement
- Control
- Evidence
- Gap
- Action
- Owner
- Assurance
Seven steps, in the order the platform performs them.
Framework ingestion
A framework is registered with its short code, full name, jurisdiction, version and official source reference. Frameworks can be added by an administrator; nothing is inferred automatically.
Requirement normalisation
Each framework is broken into individually addressable requirements, each with a stable reference code, title, source text, category and named owner.
Control mapping
Governance controls are mapped to requirements. A requirement with no mapped control is a gap; a requirement with a single mapped control is partially covered; a requirement addressed across multiple mapped controls is covered.
Mapping strength
Each requirement is weighted by the strength of its mapping — covered in full, partially covered as one half, a gap as none — and the weighted result is expressed as a coverage percentage. Waived requirements are recorded with their justification and retained in the change history.
Gap identification
Requirements that are not fully covered are surfaced as gaps with the affected category, the responsible owner and a suggested remediation. Suggestions are proposals for human review; they are accepted or rejected by a named person.
Action assignment
An accepted gap becomes an action with an owner and an effort estimate, so that coverage moves from an observation to a piece of work someone is accountable for.
Review and assurance
Attestations run on a defined frequency with a named attester. Every coverage change, mapping, decision and attestation is written to a tamper-evident change history that can be verified on demand.
Mapped against the authoritative source in each jurisdiction.
Referencing a framework does not imply endorsement by, or affiliation with, the issuing body.
International
- ISO/IEC 27001:2022Information security management systemsOfficial source
- ISO/IEC 42001:2023Artificial intelligence management systemOfficial source
European Union
- EU AI Act (2024/1689)Harmonised rules on artificial intelligenceOfficial source
- GDPR (2016/679)General Data Protection RegulationOfficial source
- DORA (2022/2554)Digital Operational Resilience ActOfficial source
United Kingdom
- FCA HandbookFinancial Conduct Authority HandbookOfficial source
- PRA SS1/23Model risk management principles for banksOfficial source
United States
- NIST CSF 2.0Cybersecurity FrameworkOfficial source
- NIST AI RMF 1.0AI Risk Management FrameworkOfficial source
What Regurai provides, and what remains yours.
Regurai provides
- Normalised framework requirements with named owners
- Control mappings and the strength of each mapping
- Gap identification with suggested remediation for human decision
- Actions, attestations and a tamper-evident change history
Your organisation remains responsible for
- Determining which frameworks and requirements apply to it
- Implementing and operating the controls
- The sufficiency and accuracy of the evidence held
- Any assertion of regulatory compliance or certification
Related: AI governance framework, Governance & compliance and Audit & evidence.