Every decision counts toward every rule it touches.

The same work, filed four times.

Consider a decision about a critical cloud supplier. Illustratively, that one decision touches DORA Articles 28 and 30, NIS2 Article 21(2)(d), ISO 27001 A.5.19 and A.5.20, and GDPR Article 28.

In many companies, that means four owners and four spreadsheets. Each one restates the same facts in its own format, and each drifts from the others over time.

Rules overlap. Work should too.

Frameworks use different words, but they ask many of the same things. Know your suppliers. Assign responsibility. Assess the risk. Show that you follow up.

So keep one set of controls for every framework and country, and map rules to them. Then a real decision can count as evidence everywhere it applies.

Why this needs care.

A proposed match is not a conclusion. Two requirements can look alike and still differ in scope, which is why the AI proposes the mapping and a person confirms it. And where proof is missing, the control stays open. A missing source is shown as missing, never quietly marked as done.

What a new law should cost.

When a new rule arrives, the first question should be: what here is truly new? Much of it will already be covered by what you do. Only the rest should create new work.

That is the idea behind Programme. Get compliant. Stay compliant. And when you use Third-Party too, a supplier decision also counts toward your duties in Programme, with no second round of paperwork.