Risk areas with their own matrix (add-on)
Set up as many risk areas as you need and decide the scale, the name and icon of each level, and the appetite that applies. Part of Enterprise Risk Management, a paid add-on released in August 2026.
Build one risk register for the whole organisation
GDPR, NIS2, the AI Act, information security: one register, where each risk area keeps its own matrix, scale and appetite. Assess processes, assets and suppliers, plan what has to come down, and count what sits above appetite in one place.
Unlimited users • Free onboarding and support • No commitment
.jpeg)
.jpg)
.jpg)
.jpg)
-1.png)
.jpeg)
.jpg)
One risk register Meridian's risk work moved out of six workbooks and into one register
Maria Holm is group GRC lead at Meridian Nordic, an energy group with two subsidiaries, around 1,200 suppliers, and GDPR, NIS2 and ISO 27001 all live at the same time. Risk used to be assessed in a workbook per framework, each with its own scale and its own owner, and nobody could answer how much sat above appetite in total. Now GDPR, NIS2, AI and information security are risk areas in one register, each with the matrix and appetite that fits it. Processes, assets and suppliers are assessed against concrete scenarios, and what is above appetite is counted in one place.
-
Each risk area keeps its own matrix, scale and appetite, so the GDPR model and the NIS2 model don't have to agree.
-
Processes, assets and suppliers sit in the same register, assessed one at a time or many at once.
-
One overall figure says how many risks in total may exceed appetite before it requires action from management.
-
Nothing gets overwritten: every assessment, decision and plan stays on the entity's own timeline.
One risk register Six workbooks, six versions of the truth
Most organisations already assess risk. The problem is where the assessments live, and what happens when somebody asks a question that spans two of them.
-
Each framework grows its own scale, so nothing adds up across them.
-
Nobody can say how many risks currently sit above appetite, because appetite was never written down as a number.
-
When the person who did the assessment changes job, the reasoning leaves with them.
One risk register One register, a matrix per risk area
A risk area is a domain you assess within: GDPR, NIS2, the AI Act, information security, or one you define yourself. Set up as many as you need, and let each one keep its own model.
-
Per area you decide the scale, for example 1 to 3 or 1 to 6, the name and icon of each level, and the appetite that applies.
-
The matrix maps each combination of consequence and probability to a risk level. It arrives pre-filled with recommended defaults, and any cell can be edited by clicking it.
-
On top of the areas sits one overall appetite: how many risks in total may exceed appetite before management has to act.
One risk register Processes, assets and suppliers, at the scale you actually have
You choose which entities each risk area assesses, and nothing is attached by default. Then you assess them against concrete scenarios, one at a time or many at once.
-
Processes, assets and suppliers, so supply-chain risk sits on the same register as everything else.
-
Scenarios, consequences and security measures come from a catalogue built around GDPR, NIS2 and AI, or you write your own.
-
Bulk works on assessment and on mitigation, which is what makes twenty near-identical systems tractable.
One risk register Nothing gets overwritten
Every assessment adds to the record rather than replacing it, so the register carries its own history. This is the part an auditor asks about, and the part that saves you when the colleague who did the work has moved on.
-
Consequence and probability each need a justification, so there is always something concrete to point at.
-
Each entity and scenario has its own timeline of every assessment, decision and mitigation over time.
-
A risk that has been reassessed without a new action being taken is flagged, so it doesn't quietly sit there.
One risk register Decide what to do, and put a number on it
Once a risk is assessed you decide: accept it as it stands, avoid it by stopping the activity that causes it, or mitigate it with an action plan. Mitigation is the one with a process of its own.
-
A plan carries the actions, the risk level you expect once they are done, an estimated cost and the exposure left after mitigation.
-
Plans run proposed, approved, completed. When one completes, the current risk updates and the previous state is saved to history.
-
Across areas, a management report shows exposure now, exposure once open plans are done and what those plans are expected to cost, and it exports with a comment from the person exporting it.
One risk register Rails, not your risk judgement
We supply the structure, the catalogue and the record. The judgement is yours, and there are two boundaries worth saying out loud before anyone books a demo.
-
The level is calculated from the consequence and probability you state, against a matrix you configured. There is no recommended score and no weighting.
-
The platform documents risk, it does not detect it. It doesn't scan, and it doesn't derive a status from breaches found automatically, so it is not a SIEM.
-
Enterprise Risk Management is a paid add-on and a different product from the risk assessment already in the platform. There is no conversion of existing risk data between the two.
One risk register Frameworks this covers
One register, and the two frameworks it carries most of the weight for.
-
NIS2
Learn about NIS2The risk-management measures behind your services, assessed on the processes, assets and suppliers that deliver them, so supply-chain risk is assessed directly rather than inferred.
-
ISO 27001
Learn about ISO 27001The catalogue starts from GDPR, NIS2 and AI, and the scenarios are written broadly enough that the same work carries into ISO 27001. Bulk assessment suits estates of near-identical systems.
Our Customers
+400
companies
+10.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilities
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
No use cases match that combination yet. Try removing a filter.
