What a GRC platform does for an SME, and what it leaves to you
A GRC platform (governance, risk and compliance) is the system where a company keeps its security and compliance programme in one place: the risk register, the policies, the controls each framework asks for, the evidence that those controls work, the suppliers and the audit history. For a small or midsize company that has been running ISO 27001 or a first NIS2 assessment from spreadsheets and shared folders, moving to a platform is usually the first real step towards a programme that survives staff changes and audit cycles.
Good GRC software does three things well. It maps one control to several frameworks, so a password policy written for ISO 27001 also counts towards NIS2 or DORA without being rewritten. It assigns every control, risk and document an owner and a review date, so nothing silently expires. And it keeps an audit trail of who approved what and when, which is what an auditor or a supervisor asks to see first.
What a GRC platform does not do on its own is operate the controls it records. The platform can show that a vulnerability management procedure exists and that someone uploaded last quarter's scan report; it does not run the scan, read the results or patch the server. The same applies to access reviews, backups, endpoint protection and incident response. Our article on what a compliance platform licence misses covers that gap in detail. It is also the most useful lens for comparing Formalize, Copla and Qalea, because each one draws the line between software and operated work in a different place.
Formalize: regulatory breadth for European SMEs
What it does well
Formalize is a Danish company headquartered in Copenhagen, with offices that include Madrid, according to its October 2025 funding announcement. It started in whistleblowing software, and its whistleblowing product is still linked from its platform. Today it presents itself as a connected GRC platform with modules for risk management, policy management, third party management, data governance, business continuity and resilience, and audits planned and run on the existing controls and evidence.
Its strongest argument is regulatory breadth. Formalize publishes workflows for DORA (including the register of information), NIS2, the AI Act, GDPR, ISO 27001, ISO 22301, Germany's BSI IT-Grundschutz, Belgium's CyFun, Italy's Modello 231 and Spain's ENS through the Magerit methodology. For Spain specifically, Formalize announced a licence agreement with UNE, the Spanish standards body, that makes it an official collaborator of ISO, and describes itself as the first GRC provider in Spain to reach that status. Its site is available in eight languages, Spanish included, and it reports more than 8,000 companies as customers.
Who it is built for
Formalize fits a company that needs to cover many regulations from one place and has the people to run the programme internally: a compliance or legal function, a data protection officer, an IT team that owns the technical controls. The breadth is particularly relevant for groups with entities in several EU countries, where national frameworks such as IT-Grundschutz, CyFun or Modello 231 sit alongside ISO 27001 and GDPR, and for companies that also need a whistleblowing channel under the EU Whistleblower Directive.
Its published pages describe software rather than operated security. They do not describe advisory hours, endpoint detection and response, a SIEM or a team that reviews alerts. A buyer that needs those functions would cover them with its own staff or another provider, and should ask during the demo how the platform imports evidence from those tools.
Copla: GRC software with CISO support, built around financial services
What it does well
Copla is a regtech company founded in 2023 and based in Vilnius, Lithuania, which raised a €6 million Series A in February 2026. Its GRC software is organised in modules for compliance management, risk management, third party risk management, document management, an ISMS and a dedicated register of information for DORA. It also covers incident management, DORA incident reporting, business impact analysis and awareness training, with an AI assistant that drafts risks and policies for human review.
What sets Copla apart from a pure software vendor is the layer of human and technical services on top. It sells CISO as a service as an optional extra on any plan, managed vulnerability scanning and penetration testing. Its framework list includes DORA, NIS2, ISO 27001, SOC 2, PCI DSS, Cyber Essentials, the Cyber Resilience Act, the UK FCA's PS26/2 and GDPR, and it states that more than 50 frameworks are available, with controls mapped once and reused across them.
Who it is built for
Copla's own pages speak to governance, risk and compliance teams at financial organisations of every size, and its stated ambition is to be the compliance execution layer for regulated finance in Europe. Its customer references are banks, payment companies and crypto firms. For a fintech, an insurer or a payment institution preparing for DORA supervision, the dedicated register of information and DORA incident reporting are directly relevant, and the CISO hours help a small team that does not yet have a senior security lead.
Its published pages do not list Spain's ENS among its frameworks. Its continuous monitoring refers to compliance evidence staying current, not to a team watching systems for attacks, and the pages do not describe endpoint detection and response or a SOC. A Spanish company selling to the public sector would need to confirm ENS coverage directly, and any company would need to plan who handles security alerts.
Qalea: a compliance platform joined to operated security
What it does well
Qalea is a Barcelona company that combines a compliance platform with security work its own team operates. The platform holds the processes side: ISO 27001, ENS, SOC 2, ISO 42001, NIS2 and DORA run on one set of controls and evidence, so a company adding a second framework reuses what it already has instead of starting again. Policies, the risk register, the asset inventory, supplier reviews and audit preparation sit in the same place, with Qalea's team guiding the work alongside the client.
Around that platform, Qalea covers people and infrastructure. On the people side, that means security awareness training, phishing simulations, endpoint protection on laptops, device management and a password manager. On the infrastructure side, it means visibility of the external and internal attack surface, cloud configuration and application code, with recurrent vulnerability scanning and findings prioritised by real risk. A monitoring layer of endpoint detection and response, a SIEM and a SOC reviews alerts and responds to incidents. When a company already holds certifications or uses another platform, Qalea migrates that existing work onto its platform.
Who it is built for
Qalea is built for SMEs and midsize companies that need a certification or a regulatory programme and also want the security behind it to be operated, not only documented. Many of its clients have their own security team, and Qalea works alongside it on compliance, monitoring, the attack surface and awareness. For Spanish companies, ENS is part of the same programme as ISO 27001, which matters for suppliers to the public sector.
Qalea covers fewer national frameworks than Formalize, and it is not a whistleblowing tool. It is not a certification body either: the certification audit is still carried out by an independent, accredited body, as it would be with any of the three platforms.
How the three compare, side by side
The summary below sets out what each company publishes, checked on 10 November 2026. It reflects the vendors' own pages, not independent tests, and every vendor adds features regularly, so it is worth confirming each point during a demo.
- Frameworks: Formalize lists the widest range of European regulations and national schemes, ENS included. Copla lists more than 50 frameworks with a financial services emphasis, without ENS. Qalea covers ISO 27001, ENS, SOC 2, ISO 42001, NIS2 and DORA on one set of controls.
- Human support: Formalize describes software. Copla sells CISO hours as an optional extra. Qalea's team guides the programme as part of the platform.
- Technical security: Formalize does not describe operated security. Copla offers managed vulnerability scanning and penetration testing. Qalea covers endpoint protection, the attack surface, recurrent scanning and a monitoring layer with a SOC.
- Built for: Formalize, SMEs covering many regulations across countries. Copla, regulated financial entities. Qalea, SMEs and midsize companies that want certification and operated security together.
Frameworks covered
On paper Formalize covers the most ground, and it is the only one of the three that also offers whistleblowing. Its national frameworks are its distinctive feature: a group with a German subsidiary that follows IT-Grundschutz and a Belgian one that follows CyFun can keep both in the same system as its ISO 27001 programme. Copla's breadth points in a different direction, towards financial regulation, with PCI DSS, the FCA's PS26/2 and a detailed DORA module.
The number of frameworks matters less than how controls are shared between them. All three describe mapping one control to several frameworks. The practical test is to take one control, such as access reviews, and ask the vendor to show where the same evidence appears for ISO 27001, NIS2 and, if relevant, ENS or DORA, and what happens to each framework when that evidence expires.
Who runs the controls between audits
This is where the three differ most. With Formalize, the company's own team runs the controls and records them in the platform. With Copla, the company's team runs them, with the option of CISO hours for guidance and the scanning and penetration tests Copla performs. With Qalea, part of the operation is done by Qalea's team: monitoring endpoints and alerts, scanning the attack surface, running phishing simulations, and preparing evidence with the client for each review.
None of these models is wrong. A company with a strong internal security team may prefer software that stays out of its way. A company with one IT manager and an approaching audit usually finds that the hard part is not the documentation but keeping the controls alive in March, July and October, between audits. Our article on continuous compliance monitoring explains what that work involves.
Technical security included
Formalize's published offering does not include technical security work; the platform records controls that other tools or teams perform. Copla includes two technical services: managed vulnerability scanning and penetration testing, which give a regular view of weaknesses and a deeper test at a point in time. Neither describes detection and response, meaning a team that reviews alerts from endpoints and systems and acts on them.
Qalea's offer includes endpoint detection and response on laptops, a SIEM and a SOC, together with attack surface visibility and recurrent vulnerability scanning. That is the difference between knowing a weakness exists and having someone respond when it is used. For frameworks such as NIS2, which asks for incident handling as a measure in its own right, the distinction is relevant to what a supervisor will ask to see.
The Spanish regulatory context
For Spanish companies, the Esquema Nacional de Seguridad, regulated by Royal Decree 311/2022, is often the deciding framework. It applies to the public sector and to private companies that provide services or solutions to it, and tenders increasingly require it at a specific category. Our guide on whether ENS applies to your company and at which level covers how to tell.
Formalize supports ENS through Magerit, the risk analysis methodology published by the Spanish administration, and its agreement with UNE gives it a local footing. Copla does not list ENS. Qalea runs ENS on the same controls as ISO 27001, and its monitoring and scanning produce evidence for ENS operational measures. The overview of compliance platforms for Spain places these options among the other vendors active in the Spanish market.
NIS2 Article 21 and the DORA register of information
NIS2 Article 21
Article 21(2) of the NIS2 Directive lists ten minimum cybersecurity measures, from risk analysis and incident handling to supply chain security, cyber hygiene and training, access control, and multifactor authentication. Article 20 makes the management body responsible for approving those measures and overseeing them. A GRC platform helps with the first half of that obligation: documenting the measures, assigning owners and showing management approval. Our article on the ten measures in Article 21 goes through each one.
The second half is showing that the measures operate. Formalize and Copla both publish NIS2 programmes that structure the documentation and evidence. Copla's vulnerability scanning and penetration tests add evidence for the vulnerability handling and effectiveness points. Qalea's monitoring layer, phishing simulations and device management operate several of the measures directly, so the evidence comes from the work itself rather than from a separate upload.
The DORA register of information
Article 28(3) of DORA requires financial entities to maintain and update a register of information covering all contractual arrangements for ICT services with third party providers, and to make it available to the competent authority. The templates are fixed by Implementing Regulation (EU) 2024/2956, with linked tables for the entity, its providers, the arrangements and the functions they support. Keeping those tables consistent is tedious in a spreadsheet, which is why both Formalize and Copla publish dedicated register tooling.
For a financial entity, the register is one part of a wider supplier risk process that also includes due diligence, concentration risk and exit plans. Our article on third party risk management under DORA and NIS2 sets out the full set of obligations. When comparing platforms, ask to see the register export in the official format and how it stays aligned with the supplier reviews kept elsewhere in the platform.
Questions to ask any GRC vendor before signing
Demos tend to show dashboards. These questions bring out how the platform behaves in the months between audits, which is where most programmes fail:
- Who operates each control between audits: our team, yours, or a tool, and what evidence does each produce?
- Which frameworks are covered with their full control catalogue today, and which are planned? If ENS is relevant, at which category?
- How is evidence collected: through integrations, manual uploads or work your team performs, and what happens when evidence expires?
- What happens before a surveillance audit: who prepares the sample, and who attends the audit?
- Who reviews and responds to security alerts from endpoints and systems, and is that included or contracted separately?
- Can our existing policies, risks and evidence be imported from spreadsheets or another platform, and who does the migration?
The answers will differ between Formalize, Copla and Qalea, because they are built on different ideas of how much of the work the vendor should carry. Writing the answers side by side, alongside the internal hours each model would still require, gives a clearer basis for the decision than any feature list. If the internal side of that decision is still open, our guide on when a company needs a vCISO helps size the security leadership the programme needs.
More comparisons and guides on running a programme day to day are collected in our compliance operations section.
