V3Q
Contact us

V3Qtor AG/Systems/ShieldOS

ShieldOS. The compliance operating system.

Evidence as a by-product of the work. ShieldOS maps every control an industrial enterprise carries, from ISO 27001 and NIS2 to ATEX certificates and FDA e-signatures, to the place in the operation where the evidence already appears, and keeps the audit pack ready on any day of the year.

Book a margin reviewSee the control board

Runs on-premise or in a sovereign cloud. Built for plants, hospitals, insurers and research organisations.

What it is

One board. Every control. Evidence that captures itself.

Most compliance work is a project before the audit: collecting what already happened. ShieldOS turns it around. The checklist a technician speaks into, the signature on a batch record, the OCR read of a certificate, the directory export at month end: each one is the evidence for a control, filed where the auditor will look for it.

  • 1
    Control library mapped to frameworksISO 27001:2022, ISO 9001, ISO 22301, ISO 27018, NIS2 Article 21, ATEX and IECEx, FDA 21 CFR Part 11, GDPR, and the EU AI Act obligations as they phase in.
  • 2
    Evidence from the operation, not from a requestVoice checklists, so the technician keeps both hands on the equipment; digital signatures, photos, sensor logs, system exports. Captured once, attached to every control that needs it.
  • 3
    Certificate lifecycleCertificates read by OCR, expiry tracked, renewals started six months out, customer portal showing the current state. Zero expired certificates is a number ShieldOS reports daily.
  • 4
    Audit packs on demandSurveillance audit, customer audit, regulator request: the pack is a filter on the board.
  • 5
    Risk register and supplier securityNIS2 asks for supply-chain security and incident handling; the register and the supplier assessments live on the same board as the controls.

ShieldOS Control board

Plant Nord · Q42 due
Controls in scope214ISO 27001 · 9001 · 22301 · NIS2 · ATEX
Evidence captured this month1,96298% automatic
Open findings0Last audit: zero
Certificates expiring ≤ 6 months2Renewals started
ControlsCertificatesAudit packsRisk registerSuppliers
ControlFrameworkEvidence sourceCoverageStatus
Access reviews, OT networkISO 27001 A.5.18 · NIS2 Art. 21Directory export, monthly
✓Current
Ex-equipment inspection, Zone 1ATEX 2014/34/EU · IEC 60079-17Voice checklist, signed
✓Current
Business continuity test, line 3ISO 22301 8.5Test record, semi-annual
Due 14 Nov
Supplier security assessmentNIS2 Art. 21(2)(d)Questionnaire, annual
41 of 50
IECEx certificate, compressor K-7IECEx 02OCR, renewal workflow
Expires Apr
Electronic signatures, batch recordsFDA 21 CFR Part 11Signature log
✓Current
Illustrative board. Controls and evidence sources are typical for an industrial plant.Audit pack: ISO 27001 surveillance, ready

The cost of being wrong

Compliance is a cost line, not a cost centre.

Three numbers that put a price on findings, expired certificates and missing controls.

2%of turnover

NIS2 fines for essential entities reach €10 million or 2% of worldwide annual turnover, whichever is higher; important entities €7 million or 1.4%1.

Directive (EU) 2022/2555, Art. 34

$187,500per hour

What an hour of unplanned downtime costs in heavy industry2. A stopped shipment on an expired Ex certificate costs the same hour.

Senseye, 2021

30%of GenAI projects

Gartner's expected abandonment rate after proof of concept, with insufficient risk controls among the four reasons3. Governance comes first.

Gartner, 2024

The regulatory calendar

What applies, when it applies, and what it costs to get wrong.

The frameworks an industrial enterprise typically carries, with the dates and penalty ceilings as published. ShieldOS maps each one to the evidence that already appears in the operation.

FrameworkWhat it asks forKey datePenalty ceilingEvidence ShieldOS captures
NIS2Directive (EU) 2022/2555Cyber-risk management, supply-chain security and incident reporting for essential and important entities. Early warning within 24 hours of a significant incident.Transposition deadline 17 October 2024€10 million or 2% of worldwide turnover, whichever is higher1Access reviews, incident timeline, supplier assessments
EU AI ActRegulation (EU) 2024/1689Risk-based obligations for AI systems. High-risk systems need data governance, technical documentation, automatic logging and human oversight (Articles 10 to 15).In force 1 August 2024; most high-risk obligations apply from 2 August 2026€35 million or 7% for prohibited practices; €15 million or 3% for other obligations4Model inventory, run logs, evaluation records
GDPRRegulation (EU) 2016/679Processing of personal data: lawful basis, records of processing, data-protection impact assessments, breach notification within 72 hours.In force 25 May 2018€20 million or 4% of worldwide turnover5Records of processing, DPIAs, access logs
ISO/IEC 27001:2022Information security managementAnnex A lists 93 controls in four themes: organisational, people, physical and technological. Each needs operating evidence behind it.Transition from the 2013 edition ended 31 October 2025Loss of certification; customer and tender consequences6Control evidence per Annex A, internal audit, management review
ISO 9001:2015Quality managementProcess approach, risk-based thinking, nonconformity and corrective action. Surveillance audits yearly, recertification every three years.Current edition since 2015Loss of certificationNonconformances, 8D records, calibration records
ATEX and IEC 60079-17Directive 2014/34/EU; Ex installationsEquipment for explosive atmospheres and the periodic inspection of Ex installations. Inspection intervals must not exceed three years.Periodic inspection, at most every 3 yearsEquipment out of service; liability on the operator7Inspection checklists, certificate expiry, Ex register
FDA 21 CFR Part 11Electronic records and signaturesAudit trails, system validation and signature manifestations for records kept electronically in regulated life-science operations.In force 20 August 1997Warning letters, consent decrees, import alerts8Signature log, audit trail per record

Coverage

The frameworks, sector by sector.

Every one of them asks for operating evidence, and every one of them maps to the same board. Dates and ceilings as published; the calendar above carries the sources.

Every sector

The frameworks almost every client carries, regardless of sector.

  • ISO 9001:2015Quality managementNonconformities, corrective action, internal audits, management review. Surveillance yearly, recertification every three years.Certification
  • ISO 14001:2015Environmental managementEnvironmental aspects, legal register, objectives and audits.Certification
  • ISO 45001:2018Occupational health and safetyHazard register, incident investigation, worker consultation, legal compliance evaluation.Certification
  • ISO 50001:2018Energy managementEnergy review, baselines and performance indicators, with the data behind every improvement claim.Certification
  • ISO/IEC 27701:2019Privacy information managementExtends ISO 27001 with controls for PII controllers and processors.Certification
  • SOC 2AICPA Trust Services CriteriaSecurity, availability, confidentiality, processing integrity, privacy. A Type II report covers a period, so the evidence has to exist every day of it.Annual report
  • Swiss Data Protection Act (revDSG)In force 1 September 2023Records of processing, impact assessments, breach notification. Fines up to CHF 250,000, levied on the responsible individual.CHF 250,000
  • CSRD and ESRSDirective (EU) 2022/2464Sustainability reporting with limited assurance. First reports for financial year 2024 for large listed companies; the later waves were postponed by two years in 2025.From FY 2024
  • Cyber Resilience ActRegulation (EU) 2024/2847Security requirements for products with digital elements. Reporting obligations from 11 September 2026, full application from 11 December 2027.From 11 Dec 2027

Manufacturing

Plants carry the product, process and site frameworks on top of the cross-sector ones.

  • IATF 16949:2016Automotive quality managementISO 9001 plus the automotive requirements: PPAP, FMEA, control plans, customer-specific requirements.Certification
  • TISAXVDA ISA assessmentInformation security for automotive suppliers, assessed against the VDA ISA catalogue.Every 3 years
  • IEC 62443Industrial automation and control systemsZones and conduits, security levels, patch and access management on the OT network.Standard series
  • Machinery RegulationRegulation (EU) 2023/1230Replaces the Machinery Directive. Applies from 20 January 2027; covers safety functions including self-evolving behaviour.From 20 Jan 2027
  • REACHRegulation (EC) 1907/2006Registration and authorisation of chemicals; substances of very high concern communicated down the supply chain.Ongoing
  • RoHSDirective 2011/65/EURestricted substances in electrical and electronic equipment; technical documentation per product.Ongoing
  • CBAMRegulation (EU) 2023/956Carbon border adjustment on imported steel, aluminium, cement, fertilisers, electricity and hydrogen. Definitive period from 1 January 2026.From 1 Jan 2026

Healthcare and life sciences

Device, drug and patient-data frameworks, in Switzerland, the EU and the US.

  • MDRRegulation (EU) 2017/745Medical devices: technical documentation, UDI, post-market surveillance, vigilance. Applied from 26 May 2021.Since 26 May 2021
  • IVDRRegulation (EU) 2017/746In vitro diagnostics; applied from 26 May 2022 with staggered transition periods by risk class.Since 26 May 2022
  • ISO 13485:2016Medical device quality managementDesign controls, risk management, traceability, complaint handling.Certification
  • EU GMP Annex 11Computerised systemsValidation, audit trails, electronic signatures and data integrity for GMP systems.Guideline
  • EU GMP Annex 1 (2022)Sterile productsContamination control strategy, environmental monitoring; applies since 25 August 2023.Since 25 Aug 2023
  • ICH E6(R3) GCPGood clinical practiceRisk-based quality management, data governance and oversight of trials; effective in the EU from 23 July 2025.Since 23 July 2025
  • Clinical Trials RegulationRegulation (EU) 536/2014Submissions and reporting through CTIS; the transition from the old directive ended on 31 January 2025.Since 31 Jan 2025
  • Swiss EPDGElectronic patient record act, in force 15 April 2017Certified communities, patient access rights, access logs.Switzerland
  • HIPAAUS Privacy and Security RulesSafeguards for protected health information; tiered civil penalties per violation category with annual caps.United States

Hospitality and food

Food safety is the compliance line a hotel is inspected on; payments and working time follow.

  • HACCPCodex Alimentarius; Regulation (EC) 852/2004 Art. 5; Swiss Food Act and Hygiene OrdinanceHazard analysis, critical control points, monitoring records and corrective actions for every kitchen. In Switzerland a self-control duty for every food business.Mandatory
  • ISO 22000:2018 and FSSC 22000Food safety managementHACCP inside a management system; FSSC 22000 is recognised by GFSI and asked for by retail and catering buyers.Certification
  • Food informationRegulation (EU) 1169/2011Allergen declaration on menus, buffets and labels; applied from 13 December 2014.Since 13 Dec 2014
  • PCI DSS 4.0Payment card industryCard data at the front desk, in restaurants and online. Version 4.0 fully mandatory since 31 March 2025; annual validation.Annual validation
  • Swiss Labour Act (ArG)Working-time recordsHours, breaks and overtime recorded per employee; rosters and records inspected by the canton.Cantonal inspection
  • VKF fire safety regulationsSwitzerland, 2015 editionFire protection concept, escape routes, inspections of installations; cantonal enforcement.Cantonal enforcement

Financial services and insurance

Regulators ask for the same thing an auditor does: the record behind the number, reproducible.

  • DORARegulation (EU) 2022/2554ICT risk management, incident reporting, third-party register and resilience testing. Applies since 17 January 2025.Since 17 Jan 2025
  • FINMA Circular 2023/1Operational risks and resilienceICT and cyber risk, critical data, business continuity for Swiss banks and insurers. In force since 1 January 2024.Since 1 Jan 2024
  • FINMA Circular 2018/3OutsourcingInventory of outsourced functions, risk analysis, audit rights, exit planning.Switzerland
  • Solvency IIDirective 2009/138/ECOwn funds, ORSA, quantitative reporting templates; the model behind every figure documented.Quarterly and annual
  • IFRS 17Insurance contractsMeasurement and disclosure of insurance contracts; effective since 1 January 2023.Since 1 Jan 2023
  • Basel III final (CRR3)Regulation (EU) 2024/1623Revised capital requirements and the output floor; applies in the EU since 1 January 2025.Since 1 Jan 2025
  • MiFID IIDirective 2014/65/EUSuitability, record-keeping, transaction reporting; applied from 3 January 2018.Since 3 Jan 2018
  • Anti-money launderingSwiss AMLA; EU AMLR, Regulation (EU) 2024/1624Customer due diligence, transaction monitoring, suspicious-activity reporting. The EU regulation applies from 10 July 2027.EU from 10 July 2027

Logistics, energy and utilities

Customs, dangerous goods and critical infrastructure, each with its own inspector.

  • AEOUnion Customs Code, Regulation (EU) 952/2013Authorised Economic Operator status: customs compliance, record-keeping, security of the supply chain.Authorisation
  • ADRDangerous goods by road, 2025 editionClassification, packaging, driver training, transport documents and the safety adviser.Biennial editions
  • GDP for medicinal productsEU Guidelines 2013/C 343/01Temperature control, qualification of carriers, deviation handling in pharmaceutical distribution.Guideline
  • ISO 28000:2022Supply chain security managementThreat assessment, security controls and incident handling along the chain.Certification
  • ISO 55001:2014Asset managementAsset register, criticality, lifecycle decisions with the evidence behind them.Certification
  • EU Network Code on CybersecurityRegulation (EU) 2024/1366Cross-border risk assessments and minimum controls for electricity entities; in force since 13 June 2024.Since 13 June 2024
  • Swiss ICT minimum standardFederal Office for National Economic SupplyBaseline cyber controls for critical infrastructure; binding for electricity grid operators under the Electricity Supply Ordinance since 2024.Switzerland

Public sector

Federal and cantonal bodies carry their own security and procurement law.

  • Swiss Information Security Act (ISG)In force 1 January 2024Classification, protection needs and ICT security for federal bodies and operators of critical infrastructure.Since 1 Jan 2024
  • Swiss EMBAGIn force 1 January 2024Electronic means in government: open source by default, open government data, interfaces and standards.Since 1 Jan 2024
  • Public procurement (BöB / IVöB)Revised law in force 2021Tender documentation, award criteria and records that survive an appeal.Switzerland
  • eCH standardsSwiss e-government standardsInteroperability of records and interfaces between administrations.Standards

How an engagement runs

From the first control to the first audit without a finding.

Map

Every framework in scope, every control, every place in the operation where its evidence already appears.

Output: control map, evidence gap list

Capture

Checklists, signatures, OCR and exports connected so that evidence files itself. Forward-deployed engineers sit with the quality and IT teams.

Output: 80% of evidence automatic

Certify

Certificate lifecycle live, renewals in flight, customer portal open.

Output: zero certificates past expiry

Prove

Internal audit run from the board; findings closed; audit pack generated for the surveillance audit.

Output: audit pack in one day

Run

The board becomes the operating rhythm: weekly review of due controls, monthly risk register, quarterly supplier assessments.

Output: findings at zero, held

Where ShieldOS runs

In every sector we work in.

Manufacturing

ATEX and IECEx certificates, 8D records, SPC evidence, NIS2 controls on the OT network.

 Healthcare

Clinical audit trails, 21 CFR Part 11 signatures, GDPR records of processing, decision logs for AI-assisted care.

 Financial services

Decision audit trails, model-risk evidence, SOX and MiFID II evidence packs.

 Hospitality

HACCP and hygiene records, allergen declarations, PCI DSS evidence, working-time records per employee.

Talk to us about your next audit.

Tell us which audit is coming and what it took last time. We will go through the controls with your quality and IT leads, say which ones already produce their own evidence, and give you a view of what it would take to have the pack ready on any day.

Book a margin review
Notes and sources
  1. 1Directive (EU) 2022/2555 (NIS2), Article 34: administrative fines for essential entities of up to €10 million or 2% of total worldwide annual turnover, whichever is higher; important entities up to €7 million or 1.4%. Source
  2. 2Senseye, The True Cost of Downtime, 2021. Fortune Global 500 manufacturing and industrial firms: about 3.3 million hours of unplanned downtime a year, roughly $864 billion, about 8% of revenue; automotive $1.34 million per hour, heavy industry $187,500, FMCG $23,600. Source
  3. 3Gartner, August 2024: at least 30% of generative AI projects will be abandoned after proof of concept by the end of 2025, citing data quality, risk controls, cost and unclear business value. Source
  4. 4Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal 12 July 2024. Entry into force 1 August 2024; prohibitions apply from 2 February 2025, general-purpose AI obligations from 2 August 2025, most high-risk obligations from 2 August 2026. Article 99: fines up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for other obligations. Source
  5. 5Regulation (EU) 2016/679 (General Data Protection Regulation), applicable from 25 May 2018. Article 83: administrative fines up to €20 million or 4% of worldwide annual turnover, whichever is higher. Source
  6. 6ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection. Annex A contains 93 controls grouped into organisational, people, physical and technological themes. IAF transition period for certificates against the 2013 edition ended 31 October 2025. Source
  7. 7IEC 60079-17, Explosive atmospheres, Part 17: Electrical installations inspection and maintenance. Periodic inspections at intervals not exceeding three years, with grade and frequency set by the installation’s risk assessment. ATEX equipment directive 2014/34/EU. Source
  8. 8FDA, 21 CFR Part 11, Electronic Records; Electronic Signatures, final rule published 20 March 1997, effective 20 August 1997. Requirements for audit trails, validation and signature manifestations. Source