AspisAI Turns ISO 27001, NIST CSF, GDPR Into Executable Rules
Compliance teams still spend Tuesday mornings copy-pasting evidence into a spreadsheet. A September 2026 arXiv paper proposes something less soul-crushing: AspisAI, a governance framework that treats controls from ISO…
AspisAI Turns ISO 27001, NIST CSF, GDPR Into Executable Rules
Compliance teams still spend Tuesday mornings copy-pasting evidence into a spreadsheet. A September 2026 arXiv paper proposes something less soul-crushing: AspisAI, a governance framework that treats controls from ISO/IEC 27001, NIST CSF 2.0, Cyber Essentials and GDPR as canonical, machine-interpretable objects — and evaluates evidence against condition rules to produce explainable determinations (arXiv:2609.10881).
The result is not another dashboard. It is a compiler for compliance.
What the paper actually claims
In a bounded scope of 26 requirements, AspisAI reports 88.5% mapping coverage across the four standards and 57% exact agreement with NIST’s own cross-standard mapping tables published under NIST CSF 2.0. Pointed at a live open-source project, the framework flagged governance gaps that the OpenSSF Scorecard evaluation surfaced independently — a useful sanity check, since Scorecard is now referenced in ENISA’s supply-chain threat landscape work.
The 57% number is the interesting one. NIST publishes Informative References through OLIR precisely because analysts disagree about how ISO Annex A.5.7 maps to CSF’s DE.CM function. AspisAI codifies the disagreement instead of hiding it — which is what a program actually needs when ANSPDCP asks “show me your reasoning”.
control_id: ISO27001.A.8.16
condition:
all_of:
- evidence.log_source in ["auth", "network", "app"]
- evidence.retention_days >= 180
- evidence.integrity_check == "hmac"
maps_to:
- NIST_CSF_2.0: DE.CM-01
- GDPR: Art.32(1)(d)
- Cyber_Essentials: MON-3
determination: satisfied | partial | gapWhy canonical models beat spreadsheets
Under Directive (EU) 2022/2555 (NIS2) essential and important entities must demonstrate equivalent controls across overlapping regimes. A firm doing GDPR Art. 32, NIS2 Art. 21, and an ISO 27001 surveillance audit in the same quarter is answering the same question three times, in three vocabularies, for three auditors. Canonical control models collapse that redundancy — the pattern we cover in Lexnomia and complement with the detection-side telemetry work in AEGIS.
Where we sit at CAI Technology
Explainability is the load-bearing wall here. A determination the human cannot rebut in front of an auditor is worse than no determination — it becomes a liability the day someone asks how the verdict was produced. AspisAI’s condition-rule surface is auditable. A fine-tuned LLM giving a yes/no compliance verdict is not, and no amount of confidence calibration fixes that.
We build Lexnomia on the same premise: rules the auditor can read, evidence links the auditor can click, determinations the auditor can overturn. The 26-requirement scope in the AspisAI paper is small. The pattern is not — it is the direction NIS2 self-assessments and ISO surveillance audits are converging on whether vendors admit it or not.
If your Q4 stack includes both, come see how we wire it up.