Compliance frameworks

The frameworks compliance teams actually use

Plain-English overviews of the most-used regulatory and compliance frameworks. Each page is curated, kept up to date as the framework changes, and is the SEO surface for Lexradar's top-of-funnel.

7 frameworks tracked. Listed by region.

UK & EU

GDPR

General Data Protection Regulation

The EU regulation on personal data protection, in force since 25 May 2018. Governs how organisations collect, store, and process personal data of EU/UK residents.

Clause mapin force

EU

EU AI Act

The Artificial Intelligence Act

The world's first horizontal regulation on AI. Risk-based: banned practices, high-risk obligations, GPAI rules, and transparency requirements.

Overview onlytransitioning

DORA

Digital Operational Resilience Act

The EU regulation on digital operational resilience for financial services. ICT risk management, incident reporting, and third-party oversight.

Overview onlyin force

US (adopted globally)

NIST CSF

Cybersecurity Framework

The US National Institute of Standards & Technology Cybersecurity Framework — a voluntary, widely-adopted controls catalogue.

Clause mapin force

SOC 2

Service Organization Control 2

The AICPA's Trust Services Criteria, an attestation for service organizations that handle customer data.

Clause mapin force

International

ISO 27001

Information Security Management Systems

The international standard for information security management. ISO 27001 is a certifiable, auditable, risk-based framework.

Clause mapin force

Global (industry-mandated)

PCI DSS

Payment Card Industry Data Security Standard

The card-industry standard for protecting cardholder data. Required for any organisation that stores, processes, or transmits cardholder data.

Clause mapin force

Map every regulatory change to a framework clause

Lexradar turns every regulatory change into a plain-English summary, a 1-page brief, and a clause-level mapping. Free on the Insight tier.

Get started free →