UK DUAA right to complain enforces in -- days · 19 June 2026 EU AI Act high-risk enforces in -- days · 2 August 2026

For Compliance Leaders

Governance that works is governance that is enforced.

Frameworks describe what should happen. Compliance leaders are accountable for what actually happens. Those two things are not the same.

Not another framework. Operational control.

Observer Mode shows how your system behaves

Enforce Mode blocks actions before execution

If an action violates policy, it does not run

Governance gap

The gap you are managing.

The compliance leader's job is to translate regulatory requirements into operational behaviour. Most organisations provide compliance leaders with frameworks, documentation requirements, and audit schedules. They do not provide enforcement mechanisms.

The result: governance posture is declared, not enforced. Controls are described in policy but not active at runtime. When something goes wrong, the compliance leader is asked to explain why the governance programme did not prevent it.

OBEXGATE closes that gap. It converts governance requirements into operational controls that run at the point of decision.

Operational requirement

What you actually need.

→ A map of what is running

You cannot govern what you cannot see. Discovery surfaces registered systems, unregistered agents, and embedded AI operating outside governance scope.

→ An instrument to assess what you have

The EVF assessment evaluates execution viability, governance readiness, evidence quality, drift exposure, and regulatory alignment across your AI inventory.

→ Controls that enforce at runtime

Policy in a document does not prevent a violation. OBEXGATE evaluates every governed action before it executes. If it does not meet requirements, it does not proceed.

Netherlands: Fined a hospital €440,000 Art. 32 GDPR Insufficient technical and organisational measures to ensure information security. The hospital had policies. It did not have controls.

Issued by: Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

Romania: Fined a bank €130,000 Art. 25 (1) GDPR, Art. 5 (1) c) GDPR Insufficient technical and organisational measures to ensure information security.

Issued by: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

→ Evidence that holds under scrutiny

Audit lineage produced continuously, article-mapped, and tamper-evident. Not assembled after the fact.

→ A framework map you did not have to build

88 enforcement engines across 8 jurisdictions, cross-mapped so a single decision is evaluated against all applicable frameworks simultaneously.

Programme change

What changes in your programme.

Manual evidence gathering Continuous audit lineage as a side effect of operation
Periodic attestation Real-time evaluation against active requirements
Framework documentation Article-level enforcement engines
Post-event reconstruction Pre-existing decision provenance
Declared governance posture Verifiable control effectiveness

Observer Mode

Observer Mode, validate before you enforce.

Observer Mode runs the full evaluation engine but surfaces verdicts as alerts rather than blocks. This gives compliance teams the data needed to validate rules, identify gaps, and build confidence before enforcement is activated.

When the team is ready, enforcement activates without redeploy.

Governance dimensions

The six governance dimensions.

→ Assess

Evaluates every governed action against applicable regulatory frameworks before it executes.

→ Enforce

Blocks non-compliant actions at the point of decision. If it does not meet requirements, it does not proceed.

→ Witness

Produces tamper-evident audit lineage as a side effect of operation.

→ Own

Identifies the accountable role for every governed decision.

→ Explain

Records why a decision was made, which frameworks applied, and what the determinative rule was.

→ Sovereign

Supports jurisdiction-bound deployment and data residency requirements.

See where governance would fail today.

Six questions. Personalised regulatory map, deployment cost basis, statutory exposure. Or schedule a 30-minute conversation with the team.