Formalize

What it does

Formalize is a governance, risk, and compliance (GRC) platform that consolidates compliance work for multiple European regulations into one connected system. Its distinctive approach is a shared control and evidence layer: a single control or evidence artifact maps across overlapping frameworks such as NIS2, the Digital Operational Resilience Act (DORA), ISO 27001, and the General Data Protection Regulation (GDPR), so teams document a requirement once and reuse it across audits instead of maintaining separate spreadsheets per regulation.

How it works

The platform ships Compliance Blueprints, prebuilt policies, tasks, controls, and risk scenarios per framework, including 118 controls for DORA and 93 for ISO 27001. Configurable workflows handle evidence collection, approval routing, and reporting. Controls link to assets, systems, and suppliers, risk registers score inherent, residual, and potential risk against tolerances, and incidents update linked risks. Formalize IQ, an AI assistant grounded in the licensed ISO 27001:2022 and ISO 22301:2019 texts, maps each control to its clause and flags drift. Privacy tooling covers processing records and data subject requests, while Whistleblower Software by Formalize handles anonymous case intake.

Credentials and traction

Formalize holds ISO/IEC 27001:2022 certification and an ISAE 3000 Type 2 assurance report. In May 2026 it partnered with UNE, Spain's ISO and IEC representative, to embed official ISO standards in the platform. Formalize was chosen to provide Spain's national whistleblowing channel and is rated 4.9 out of 5 on G2 as of 2026. The platform serves more than 8,000 organizations in over 80 countries, with customers including Arcano Partners, Crypto.com, McDonald's, and Indexa Capital.