Watch the video
Risk areas and scales
Every area gets its own matrix, its own wording and its own appetite, so GDPR and NIS2 are each assessed on their own terms.
Risk areas and scalesADD-ON
Every framework wants a risk assessment. You only need one system.
GDPR, NIS2, ISO 27001, the AI Act — each one asks you to assess risk, and each one asks in its own language. Enterprise Risk Management gives every area its own scale, its own wording and its own appetite, assesses the processes, assets and suppliers you already have in .legal, and adds the exceedances up into one report management can act on.
.png?width=68&height=52&name=bws_shipping_rgb%20-%20Kopi%20(2).png)
Watch a demo of Enterprise Risk Management👇
GDPR-compliant
Hosted in EU
Free onboarding
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=68&height=52&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png)
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=493&height=57&name=KAUFMANN%20(1).jpg)
Four frameworks, four spreadsheets, no overview
Most organisations don't have a risk problem. They have four risk problems, in four different files, on four different scales. The GDPR assessment was built when GDPR landed. NIS2 got its own sheet because three steps weren't enough. Information security has a fifth. And when management asks how the organisation is doing on risk, somebody spends a week building an answer by hand.
-
One scale can't serve every domain: IT thinks downtime and attack surface, legal thinks data subjects and fines. Forcing both into the same three steps loses whatever made each of them useful.
-
Risk isn't a list, it's attached to things: It sits on a processing activity, on the system behind it, on the supplier hosting it — all of which are already registered somewhere else in your platform.
-
An assessment nobody acts on is a document: The decision lives in an email thread and the action lives in someone's head, so nothing closes and nothing improves.
Risk attaches to what you already registered
You don't build a risk register. You already have one — the processing activities, the assets and systems, and the suppliers that live in .legal today. Enterprise Risk Management assesses those, against scenarios that fit the entity in front of you, and calculates the level from that area's own matrix.
-
Three entity types: Processes, assets and systems, and suppliers. You choose which of them each area covers.
-
Justification is not optional: Consequence and probability both require one, which is what makes the audit trail worth having.
-
Nothing gets overwritten: Every reassessment adds to the record, so you can still see how a risk was rated at the time it was rated.
Our Customers
+400
companies
+10.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Every coloured cell becomes somebody's task
Identifying a risk is the easy part. Enterprise Risk Management starts where it matters — the risks above the appetite you set yourselves — and makes you take a position: accept it, avoid it, or build a plan. Plans carry an owner, an approval and a date, and a completed plan updates the risk on its own.
-
Accepting is a decision, not an oversight: Recorded with its reasoning, so it holds up when someone asks later.
-
Approval happens in the platform: Not in a mail thread nobody can find, and the expected effect is stated before you approve.
-
One measure, many systems: Bulk mitigation applies the same plan across every entity it covers, worded the same way everywhere.
Different scales still add up to one report
If every area runs its own matrix, you can't average across them — and you don't need to. Being over appetite means the same thing everywhere, whatever the scale underneath, so the exceedances add up. Set one global appetite, and the management report reads the whole organisation against it.
-
Exceedances travel, scales don't: No normalising a three step scale against a six step one to make the numbers meet.
-
Money where you use it: Total exposure now, what it would be once the open plans are done, and what those plans cost.
-
A trend, not a snapshot: A breakdown by area shows where the pressure comes from; the trend shows whether it's improving.
Enterprise Risk Management
Our pricing is simple and transparent. You pay a fixed monthly subscription for the add-on, with unlimited usage and unlimited users.
Enterprise Risk Management
EUR 1,000
per month
-
Unlimited risk areas, each with its own scale, matrix and appetite
-
Risk assessment of processes, assets and systems, and suppliers
-
Mitigation plans with owner, approval and deadline
-
Financial risk exposure and mitigation cost
-
Management report across every risk area
-
Risk observations reported without a login
-
Unlimited users
All prices are exclusive of VAT and any taxes. Monthly payments, no commitment.
Intro
How Enterprise Risk Management works
A short look at risk areas, scales and appetite — the piece everything else builds on.
Getting You Started Customer Support
You can always get help from a team member who’s ready to support you and your colleagues.
-
You get a dedicated Customer Success Manager.
-
Personal onboarding to ensure a smooth start.
-
Support available Monday to Friday, 9 AM to 3 PM.
.legal compliance platform Begin with Enterprise Risk Management today
Curious to see it on your own risk work? Book a conversation and we'll walk through your risk areas, your scales and where the add-on would fit.
-
Works alongside your existing frameworks
-
Free onboarding included
-
No commitment
