October 2026 · 11 papersThe assurance papers
Eleven papers on operating obligations across more than one jurisdiction, published in full with no form in front of them.
Start with the question you came with
- We are comparing platforms and need questions that actually separate them. The buyer’s exam →
- One group, several regulators, and the same work keeps being done twice. The obligation arithmetic →
- Our evidence is fine at audit and stale three months later. Evidence that holds →
- We are being asked what our AI does, and who is accountable for it. Governing the AI you deploy →
- A regulator has put a date on our cryptography. Cryptography on a clock →
- Procurement wants to know where the data rests, and who can reach it. Sovereign by construction →
- Written for one industry
- Banking and financeCryptography on a clock·The third party you cannot audit
- Government and defenceSovereign by construction
- Groups in more than one countryOne group, many laws
Or take the whole set
Every figure in them is measured from the running product, dated, and held to the catalogue by a test, so anything quoted can be recomputed rather than taken on trust.
Choosing a role hides the papers that do not name it on their cover.
Start here
What this category is, and how to tell one platform from another.
Running a programme across jurisdictions
One group, several regulators, and the arithmetic underneath it.
-
03
One group, many laws
Operating privacy obligations across thirty-four regimes without a services engagement
-
04
Assess once, answer many
The control library underneath fifty-six frameworks, and the provenance of every mapping
-
05
The obligation arithmetic
How much of a multi-jurisdiction compliance programme is the same work counted twice
Evidence, and what a machine may decide
What makes evidence hold, where an agent may act, and how to govern the AI you already run.
-
06
Evidence that holds
Intake, freshness, and the difference between collecting screenshots and knowing a control works
-
07
The agent that cannot assert
Putting machines to work inside a compliance programme without moving the accountability
-
08
Governing the AI you deploy
A register that refuses an unclassified system, an unowned high-risk one, and a prohibited one in production
The questions asked last, and decided first
Third parties, cryptography on a deadline, and where the evidence rests.
-
09
The third party you cannot audit
Materiality, regulatory lead times on the regulator’s own calendar, and screening against the lists an authority publishes
-
10
Cryptography on a clock
An inventory, a dated policy and a harvest-now exposure score, for a deadline that is already in force
-
11
Sovereign by construction
Where the data rests, what executes beside it, and what happens to the record if the vendor disappears
Start with the exam, not with us
Every figure Conscious publishes is measured from the running product and held to it by a test that fails the build when a document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours, the audit record is verifiable by the customer’s own auditor, and the load figures come with the hardware printed beside them. Ask any vendor for the same and compare what comes back.
Put the same questions to us and to the platform you are already paying for. The assessment at consciousgrc.com/assess needs no call and no account, and it prints a record you keep whether or not you ever speak to us.
Run the free assessment