Trust and compliance

Ruairí Feltham is the data protection officer at Harrow Port Authority. His Monday starts with a queue of decisions an AI made overnight that can't take effect until a person looks at them. By ten he's answered a former employee's request for her personal data, with eleven days still in hand. After lunch an external auditor asks for evidence that last quarter's restore test happened. Ruairí builds the pack in Nexus, and before he sends it the pack tells him, in a sentence, the one thing it's missing.

None of that is a separate compliance product bolted on the side. It's the same record Nexus keeps of everything, read through pages built for the people who answer to regulators. This chapter walks through them.

The audit log

Every act in Nexus leaves a line in the audit log. The line records who acted and what they did. It also records when, and whether the act was done or refused. Each record says whether it came from a screen or a script. Looking at the audit log is itself an act, so that gets recorded too.

The log can be narrowed by area or outcome or by the person who acted, and searched by words. In Community it keeps 30 days and exports to a spreadsheet file at any time, and that stays true even though the rest of the compliance pages belong to Enterprise. Enterprise keeps the log for years and can stream it to your own security-monitoring system as it's written.

The audit log

Sealed records anyone can check

An audit log answers "what happened". For decisions that matter, a regulator will also ask whether the record could have been changed afterwards. Nexus answers that with sealed records.

A sealed record holds who decided and on what evidence, under which rules, and it's sealed with a time stamp from outside the installation. Change one character later and the check fails. Anyone can run that check with the open verifier, which comes with every edition and needs no account. It sends nothing anywhere. On an air-gapped site like Harrow, time stamps are witnessed inside the site, and the records still check out later.

The Decision rooms and sealed records add-on takes this further for the big calls. A decision room gathers the question and the evidence, with seats for the people who must be heard and AI seats that argue each side. A named person chairs it, who is never the one who proposed the change. The chair rules with a written reason and signs with a passkey, and the ruling is sealed with the rest of the record.

Second checks and four-eyes approvals

Two different safeguards share the idea of "a second", and it helps to keep them apart. A second check is the extra step at sign-in, such as a passkey after a password, and chapter 1.3, Your organisation, its people, and what stays private, explains how an organisation requires it. Four-eyes approval is about changes: some changes wait for a second person before they happen.

In Enterprise, the organisation's policies decide which changes need a second person. Typical ones are shortening how long records are kept, lowering a budget that's in use, withdrawing a platform from a unit and exporting a team chat channel. A request waits on the Four-eyes approvals page until it has every approval it needs. One person turning it down ends it, with their reason. A request nobody decides in time lapses, and the change isn't made.

Nobody approves their own request. When an emergency needs full access, break-glass gives an administrator a short window with a second person watching, and every step is recorded.

AI decisions waiting for review

Some uses of AI are high-risk under the EU AI Act, and the law expects human oversight of them. In Nexus, a decision made in a high-risk use is held. It waits on the AI decisions page until a person reviews it. The reviewer sees what the AI decided and why, with the sources it read. They can agree with it or change it, and they can overturn it. Each answer needs a reason. All three answers are signed with the reviewer's passkey. Overturning sends the work back to the team, and every answer leaves a receipt in the register of AI uses.

AI decisions waiting for review

The queue shows how long each decision has waited, so a backlog is visible before it becomes a problem.

Personal-data requests

Under the General Data Protection Regulation (GDPR), a person can ask what an organisation holds about them and ask for a copy, or ask for it to be erased, and the organisation normally has a month to answer. Every member of Nexus can export their own data and erase what's theirs, in any edition. Requests from customers or former staff are logged in Enterprise with their due dates.

For each request, Nexus finds the person's records across files and mail, in chat and in the assistant's memory, and shows them in one place. Legal exceptions are applied rather than ignored. Payroll records the law says must be kept for seven years stay, and Nexus shows why. Erasure itself is done with Erase, the one destructive action in Nexus. It needs a written reason and a second person, and it leaves a permanent record that the erasure happened (what was erased and when, and who did it) without keeping any of the content.

The compliance pages

Enterprise has a Compliance area with one page for each body of rules an organisation answers to. The overview lists every pack, with evidence counts and the open gaps written in words with due dates. The packs cover the EU AI Act, the GDPR and ISO 27001, along with the Network and Information Security Directive 2 (NIS2) and the Digital Operational Resilience Act (DORA). There are no scores or grades. "Exit plan missing for the hosted model provider, due 15 November" tells you more than a percentage would.

The EU AI Act page keeps the register of every AI use in the organisation. Each entry records its risk class and the person who oversees it. It also says how affected people are told, and holds the impact assessment and any incidents. The high-risk rules apply from 2 December 2027 for uses such as credit scoring and life and health insurance pricing, as amended by the Digital Omnibus.

The GDPR and data protection page holds the records of processing: purpose, lawful basis, the data involved, retention and transfers. Requests sit beside them with their deadlines. Consent records and breaches have their own lists.

The NIS2 and DORA incidents page keeps the incident register with each reporting clock drawn as a timeline: the early warning within 24 hours, the notice within 72 hours and the final report within a month. A clock starts when an incident is classed, so a late notice shows as late.

NIS2 and DORA incidents

Evidence packs and controls

An auditor rarely wants everything. They want exactly what they asked for. An evidence pack is built from live records for a named examiner and mapped to each control. It's sealed when it's issued. Before you send it, the pack lists what's missing in plain words, such as a restore test that was run but whose result was never attached. Months later, you can check that an older pack still holds. Legal holds work alongside packs: a hold stops deletion of what it covers, an export takes exactly what's held, and releasing it leaves a record.

Evidence packs

One control often answers several rules. "Human oversight of high-risk AI" satisfies an article of the GDPR and one of the AI Act at the same time. The controls page maps each control once to every framework it meets: the GDPR, NIS2, DORA, ISO/IEC 27001 and the EU AI Act. Each control has an owner and the date it was last tested. One piece of evidence then serves several frameworks.

Assessments, such as a quarterly ISO 27001 review, are worked through control by control with answers and evidence. Gaps are found along the way, and a second person signs the result off. The officer who ran it can't sign their own. For each AI system, a technical file gathers what the AI Act asks for (its purpose, data, testing, oversight, risks and logs) and shows how complete it is. Export one before it's complete and every page is marked as a draft.

Suppliers and suspicious sign-ins

The supplier register lists every outside firm that handles your data or runs a service for you. For each one it records what the firm processes, when the contract ends, when it was last reviewed and how you'd get out. A critical function with no way out turns amber, which is exactly what a DORA examiner looks for. A withdrawn supplier keeps its records for seven years.

Suspicious sign-ins are flagged as they happen. Impossible travel is one sign, such as a sign-in from Harrow and then from another continent forty minutes later. New devices and runs of failures are others. Each appears on its own page, with what Nexus already did about it. An officer confirms or clears each one. Allowed and blocked address ranges sit beside it, and Nexus refuses a rule that would lock out the administrator writing it.

What Nexus doesn't do

Nexus keeps the records, maps them to the rules and builds the evidence. It doesn't certify you, and it doesn't give you a compliance score. Certification stays between you and your auditor. The regulatory dates and mappings in Nexus aren't legal advice, and your counsel should read the rules that apply to you.