Quality and audits
Collect findings, assign actions and show the documents needed for a review. After the review, work with the team on findings without rewriting assignments.
Lead your area. Make time for people.
Process owners
See your tasks and deadlines. Add the result where the reviewer expects it. The leader can help remove an obstacle instead of finding the right recipient each time.
Management and approvers
Check the records behind a summary. Open a document or action before deciding. The approver has a starting point for discussion when the team needs a decision.
Legal and contractual requirements
Determine the applicable scope with a qualified person. Pulsar helps manage the resulting work. A shared reference helps the team resolve questions without reconstructing agreements.
Pulsar GRC maps standard and regulatory requirements supplied by your organization. It helps connect them to controls, evidence and responsibility. It does not supply licensed standard content or replace legal assessment or certification. It also supports KSC/NIS2 readiness within the scope of your organization’s obligations.
How it works
1
Import your own requirements
The organization adds lawful source documents as versions in its separate data area. A new version does not overwrite the previous analysis; changes and mappings require assessment and approval.
2
Build the Coverage Graph
Pulsar GRC maps approved requirements to controls, evidence, and process owners.
3
Monitor Gap Analysis
The coverage dashboard shows gaps, expired evidence, and scheduled reviews for the Organization compliance catalog.
ISO 9001:2026 — Quality Management System
Quality management, risk-based thinking and corrective actions
- Import a lawful copy of final ISO 9001:2026 as a new source version; compare requirements and mappings with the previous analysis, followed by authorized review and approval
- Link risks and opportunities to processes, owners, controls and evidence based on the organization’s assessment
- Corrective actions with cause assessment, owner, due date and effectiveness review before closure
- Internal audit program with calendar, scope, auditor assignment, and checklists generated from mappings
- Management review as a process flow — inputs, outputs, decisions, evidence pack per review
- Evidence package per requirement — select documents, versions and period; the responsible person checks completeness before sharing with the auditor
BRCGS Packaging Materials
Fundamental requirements + Global Standard for Packaging Materials
- Import your BRCGS PM copy — AI support helps extract requirements with standard-section citation, and the Quality/Compliance Manager decides what enters the baseline
- HACCP and packaging-material control plan mapped to production processes with applicability flags
- Supplier approval with registry, criticality and review cycle — the responsible person reviews evidence before approval
- Link batch and material traceability evidence to receipt, production and shipment records supplied by the organization
- Unannounced audit readiness — regularly review gaps, document currency and open actions
- Evidence package per BRCGS requirement — agreed material scope and completeness review before sharing with the auditor
IFS Food v8
Food safety + quality management + food defense
- Import your IFS Food v8 copy — AI support helps extract requirements with section citations, with Quality/Compliance Manager review before commit to the requirement baseline
- HACCP and CCP monitoring integrated with the audit module and the non-conformity register
- Traceability from raw material → process → finished product with evidence chain and versioning
- Recall exercises as TTX workshops handled in Crewshift with timeline, roles, and evidence requirements
- Food defense and food-fraud assessment with a threat register and risk-reduction plans mapped to controls
- Audit-readiness dashboard — status per IFS section, Gap Analysis, CAPA with effectiveness verification
IATF 16949 — Automotive
Automotive quality management + customer-specific requirements
- Import your IATF 16949 copy and customer-specific requirements — AI support helps extract per-customer requirements, followed by Quality/Compliance Manager review
- Core tools evidence — APQP, PPAP, FMEA, MSA, SPC as evidence objects with versioning and sign-off
- Customer-specific deviation register with waiver records, expiry dates and a review plan before expiry
- Supplier quality management with review cycle, criticality, and evidence requirements per supplier
- Layered process audits (LPA) with calendar, findings, and CAPA mapped to process controls
- IATF audit readiness — evidence package per requirement with versions, scope and period
GDPR end-to-end
Art. 12-22, 30, 32, 33-34
- DSAR workflow with full evidence trail (Art. 15, 20)
- Record of Processing Activities — ROPA (Art. 30)
- Lightweight retention: 30-day trash, active evidence deletion protection, relationship checks and deletion records without retaining deleted content in the audit
- Breach assessment and notification preparation workflow (Article 33). The controller evaluates risk, the 72-hour deadline and whether authority notification is required.
- ePrivacy/PKE consent registry with communication separation
NIS2/KSC and DORA
Art. 21/23 NIS2 + DORA financial sector
- Reporting modes: 24h / 72h / 1 month per NIS2
- Mapping NIS2/KSC and DORA requirements supplied by the Organization to controls, owners, and evidence
- Conditional DORA obligations for financial-sector clients
- Mapping of NIS2, DORA, and applicable national obligations after the Organization's legal status and responsibility scope are confirmed
- Incident exercises with complete contractual report packs
EU AI Act
Scope and dates depend on the organization’s role and AI system classification
- AI competency evidence per role
- Document Article 50 transparency duties in workflows using AI
- High-risk use-case classification with mandatory authorized-person oversight
- AI use-case assessment checklist built for the Organization context, with space for classification review, human oversight, and decision rationale
- AI use-case registry and approval trail in the workflow
EU Data Act
Exit by design
- Customer data export and migration procedures
- Exit plan and data transfer checks under the agreed contract terms
- Check export scope, formats and data integrity when moving to another solution
DPA, Sub-processors, SCC/DPF
Transfer registries and monitoring
- Sub-processor registry with transfer documents
- Standard DPA/SCC C2P and DPF status monitoring
- Record provider changes, responsible people and required notifications
Control mapping and evidence collection
Audit preparation support
- Control mapping to Pulsar processes
- Effectiveness monitoring and quarterly gap report with CAPA
- Evidence material prepared for the Organization's audit process
Polish national law
KSC + Whistleblower Protection Act
- Applicable national rules identified after the current legal state and the Organization's obligation scope are confirmed
- Whistleblower Protection Act (PL)
- Mapping national-law requirements based on the Organization documents and obligations
ISO 9001:2026 — source, requirement and evidence update guide
Coverage Graph and compliance traceability matrix
Formal traceability matrix: requirement to control to evidence to owner for the compliance catalog adopted by the Organization. Coverage Graph and Gap Analysis are created from the Organization's data scope, Quality/Compliance Manager decisions, and AI-supported logic.
- Requirement-change reviews with actions, owners and due dates
- Link the same evidence to several requirements within the permitted access scope
- Record decisions and workflow stages; qualified people remain responsible for compliance assessment
KSC/NIS2 scope checker
Check whether your organization may fall within Poland’s KSC Act implementing NIS2. This tool concerns Polish law.
Answer questions about activities, size and company links. Get an initial assessment, deadlines and an evidence checklist. Answers stay in your browser and you can print the result. Your organization must review the final legal classification.
Poland and the European market
In Poland, NIS2-related obligations are implemented through the national KSC law. In other countries, check the local implementation. Using software alone does not establish compliance.