We move compliance from declarative to executable — provable and replayable
Declarative compliance — the kind that lives in documents nobody recomputes — no longer protects. Our software, powered by the NELSE technology, replaces it with compliance computed from your facts, for all your regulations, verifiable by a third party and reconstructible over time.
Powered by NELSE
Our software runs on the NELSE technology
NELSE is a normative-engineering deeptech: the law is encoded there as deterministic, sourced, executable rules — not entrusted to an AI that guesses. Our software relies on this technology to compute your compliance, regulation by regulation, show its legal grounds and provide the proof.
NELSE on LinkedInThe declarative model can no longer work
All market compliance rests on the same gesture: declaring. The only recent change is the speed at which declarations are made.
01
Classic declarative
Registers filled by hand, policies written once, spreadsheets. Everything is true the day it is written — then nobody recomputes it. Facing an inspection, every document must be defended from memory.
02
Declarative at machine speed
The market’s recent answer: have generative AI declare for you — “generated” registers, analyses “suggested” by a model that reads doctrine (RAG). Faster, in greater volume — but the same nature: probabilistic, unverifiable, and accompanied by a clause that leaves you the risk.
03
What the times demand
Tighter inspections, the AI Act, health data: compliance must now be demonstrated. Three properties become essential: executable (computed from facts), provable (verifiable by a third party), replayable (reconstructible over time).
What you gain
A file ready to hand over, at any time. Inspection, audit, due diligence: the full file exports in one gesture — and whoever receives it can verify its integrity themselves.
Documents your board understands. Plain-language reports generated from your actual data — what is done, what is missing, who must act.
The certainty that nothing moves behind your back. What is validated cannot be quietly modified; everything is historised, everything can be reconstructed.
One software, all your regulations
Your facts are described once. Every applicable regulation is computed from those same facts, with its legal grounds — and everything stays consistent when one of them changes.
Computed from your facts
Personal data
- GDPR and its French implementing provisions
- CNIL frameworks and reference methodologies (MR-001 to MR-008)
- EDPB guidelines (DPIA criteria)
Health
- Health data hosting (HDS)
Research
- Research involving human subjects (RIPH, Jardé law)
- CPP and ANSM circuits
Artificial intelligence
- AI Act — classification, obligations, AI systems register
Tracked in regulatory watch
NIS2 (network and information security) · EHDS (European Health Data Space)
Added to the computation as their obligations become precise — you are told what concerns you, and no regulation is presented as computed before it is.
French Public Health Code (medical secrecy, patient record, exchange and sharing): assessed by your DPO in each analysis, not computed by the engine.
Your facts entered once
A processing described once feeds every analysis: GDPR, HDS, research, AI. No re-entry, no diverging versions.
No more contradicting spreadsheets
The register, the impact assessment, the AI systems register and the HDS follow-up start from the same facts: what is true in one is true in the others.
One fact changes, everything that depends on it is reviewed
New host, new AI tool, new purpose: every regulation concerned is recomputed, with its grounds shown — and the history remains available.
One file for all your counterparts
CNIL, HDS auditor, supervisory body, ethics committee, counsel: each receives a verifiable file, drawn from the same facts and the same rules.
How does the engagement unfold?
Five steps, from the first conversation to the deliverables. At each step you know what you provide, what we examine and what you receive.
- 01Your organisation
You describe your situation
Your processing activities, tools, providers, projects — in plain facts, with no legal vocabulary. Your existing documents are reused, never re-entered.
- 02The DPO
Your DPO assesses
They complete the facts with you, clarify ambiguous cases, identify what is missing and what must be checked on the ground.
- 03NELSE
The technology qualifies
The legal regime of each processing activity is computed by sourced rules: DPIA required or not, derived obligations, points to assess — with the grounds displayed, replayable identically.
- 04The DPO and your management
Decisions are taken and traced
The DPO issues reasoned opinions and validates the records; your organisation keeps its management decisions. Each decision stays dated and reasoned, and whatever changes afterwards goes back to validation.
- 05Your organisation
You receive verifiable deliverables
An up-to-date register, a control file a third party can verify, a progress report readable by your board, an action plan — and the history of what was decided, by whom and when.
The outsourced DPO subscription includes your teams' access to the tool. For other offers, the precise terms — features used, exports delivered, possible access — are detailed in each proposal.
The product, results first
Two sample deliverables, generated by our tools on sample data (internal prototype being industrialised), to see their structure and content. The deliverables handed over in your engagement are specified in your proposal.
Documents generated on sample data by an internal prototype being industrialised, shown as produced by the tool.
A rules engine, not an AI that guesses
Most compliance software stores what you declare — and, increasingly, has it drafted by a generative AI while disclaiming any responsibility for the output. Our approach is the opposite: the law is encoded as rules, and the computation does the work.
The legal regime, derived — not guessed
You describe the processing through closed facts (sensitive data? vulnerable people? large scale?…). The engine derives the regime — standard, DPIA required, CNIL prior consultation, to be regularised — with the EDPB criteria counted one by one.
Multi-regulatory, in layers
GDPR, CNIL frameworks (health reference methodologies), HDS hosting, AI Act, clinical research (RIPH, MR-001 to 008): rules compose — a health-data processing automatically triggers the layers that apply to it.
Replayable, rule by rule
Every qualification displays the activated rules with their legal ground (article, framework, deliberation): same facts, same rules, same result — demonstrable to you, and to an auditor.
A qualification that does not age
Elsewhere, qualification is a stamp applied once, true on paper forever. Here it follows the record's facts: a fact changes, the regime is reviewed — and the history stays readable, version after version.
Clinical research, qualified too
RIPH categories 1 to 3, reference methodologies MR-001 to MR-008, CPP and ANSM tracks: the engine also qualifies research projects — ground that general-purpose compliance software simply does not cover.
Legal logic lives in the engine — never in the screen
This is the NELSE architecture: the interface displays, the engine computes. No rule is buried in a screen, a form or a spreadsheet — which is what makes the whole testable, versionable, replayable.
What the tool produces for you
The building blocks our tools produce. Each can be shown in a meeting, on sample data; those used in your engagement are specified in your proposal.
Verifiable audit file
Full register (versions included), DPIAs, action plan, breaches, qualifications — delivered in a format designed so a third party can check its integrity without an account and without trusting us.
Reports generated from your data
Periodic progress report with computed vigilance points (DPIAs not opened, records not validated, ongoing breaches) — not a hand-filled template: a document produced from your actual file and reviewed by your DPO.
Public transparency page
“What we do with your data”, in plain language, generated only from records validated by the DPO — never from declarations. Your patients and partners see a compliance that actually exists.
Consolidated multi-site roll-up
CPTS federations, hospital groups, care-home groups: each site keeps its register, governance receives a consolidated view — sums and simple averages of values explainable site by site, never an opaque ranking.
Breaches: the clock is visible
Plain-language declaration by the facility, time-stamped chronology, visible 72-hour countdown (Art. 33), and no closure without a reasoned notification decision.
AI-systems register (AI Act)
Inventory of AI systems, cautious qualification (“to be assessed”, never an automatic classification), staff-training follow-up (Art. 4) — the building block tomorrow's inspections will ask for.
Safeguards that apply without exception
In many tools, rigour is an option to configure. Here it is wired in:
- Nothing modified can be presented as validated: an edited record must go back to the DPO.
- A DPIA opinion does not survive an edited analysis: it must be issued again.
- A breach cannot be closed without a reasoned notification decision.
- History can be consulted, nothing is overwritten.
Three deliberate choices
- No generative AI in decisions. No “AI-generated” records, no probabilistic screening: what engages your liability is computed by sourced rules, then assessed and documented by your DPO — and decided by your organisation.
- No opaque score. No “% compliant” out of a secret weighting: every displayed indicator breaks down into named points, verifiable one by one.
- No promise of guaranteed compliance. Determinism guarantees the reproducibility of the computation, not legal infallibility: rules are sourced, opinions remain your DPO’s and decisions remain your organisation’s.
Every compliance tool rests on choices. Here are the two schools.
Naming no one: these approaches dominate the market, and each has a consequence for you. We systematically made the opposite choice — by design, not by delay.
The market’s choice
A generative AI drafts your register — with a disclaimer waiving any responsibility for the output.
Ours
What engages your liability is not drafted by a probabilistic model: the engine computes from your facts, the rules are displayed, your DPO advises and your organisation decides. The risk is never transferred to you by a clause.
The market’s choice
“Proof”: documents attached inside their platform, viewable if you have an account — and if you trust the tool that produced them.
Ours
Proof that can only be verified at its issuer's is an attachment. Ours leaves the platform: your auditor checks its integrity without an account with us, and without taking our word.
The market’s choice
A language model “grounded in official doctrine”: it reads the texts before answering — and remains probabilistic, even sovereign, even hosted in Europe.
Ours
Citing sources does not make a computation reproducible. Our rules do not invoke the texts: they are derived from them, written, versioned — same facts, same result, on every replay.
The market’s choice
A “compliance score” in percent, from a weighting no one can detail — reassuring as long as nobody asks how it is computed.
Ours
No figure without a breakdown: every indicator reads as named points, verifiable one by one. A documentation progress is not a compliance verdict, and we say so.
The market’s choice
Total flexibility: steps, workflows, fields and rigour rules to configure yourself — the design of compliance is transferred to the client.
Ours
The healthcare-DPO craft is already modelled: nothing to configure, and the safeguards (an edited record goes back to validation, a breach cannot be closed without a reasoned decision) apply to every file, without exception.
The market’s choice
Libraries of hundreds of templates to copy: “80% of your register in minutes” — by imitating a processing that is not yours.
Ours
A copied template describes the facility next door. Here, the regime is computed from your answers, on your situation — a few minutes slower, and it is your register.
NELSE and your support
What is NELSE's role in your support?
NELSE develops the tools our support relies on: the qualification of your processing activities by written, sourced legal rules, the versioned register, impact assessments, the follow-up of breaches and data-subject requests, and the deliverables handed over. The DPO assesses, advises and documents their opinions; your organisation keeps its decisions. The technology makes these analyses executable, provable and replayable.
Does NELSE replace the DPO?
No. The GDPR entrusts the task to a DPO — a human, independent, reachable function. The engine computes a regime from facts and displays its grounds; it issues no opinion and validates no record. Each opinion and each validation of an analysis remains the DPO's reasoned act, dated and traced — and decisions on your processing activities remain your organisation's.
Do my teams get access to the tool?
The outsourced DPO subscription includes your teams' access to the tool: reviewing your compliance, consulting the DPO, reporting an incident. For other offers, deliverables are handed over in formats readable without an account, and any access for your teams is detailed in your proposal.
What can I obtain at the end of the engagement?
Depending on the agreed scope, deliverables may include: your record of processing activities with its versions, the qualifications and their grounds, the impact assessments and the DPO's opinions, the action plan, the breach register and the data-subject request register, the progress report, and a control file designed so that a third party can verify its integrity — without an account with us and without taking our word for it.
Can I ask for a demonstration?
Yes, in a meeting, on sample data: we qualify a processing activity in front of you, rules and grounds displayed, then we show the deliverables. The screens shown are those of a prototype being industrialised; we tell you precisely what is available in your offer.
See it live
An engine that computes can be demonstrated: in a meeting, on sample data, we qualify a processing activity in front of you — regime, rules, grounds. Ten minutes are enough to understand the difference.
Transformez vos obligations en opportunités.
Un premier échange gratuit et sans engagement pour faire le point sur votre conformité et identifier vos priorités.
Response within one business day · No commitment