REGULATIONS AND FRAMEWORKS
Understand what ScaleQuality helps your organization record, review and demonstrate — and what is still being developed.
Editorial scope reviewed on September 9, 2026. Confirm the applicable legal version and scope for each assessment. Features described correspond to the current product version.
The administrative workflows and exports below are implemented and tested. Full validation against each reference is a separate step, depending on applicable obligations and the organization’s evidence.
Declare scope, owners and obligations. Record evidence references and submit work for review by another administrator.
For LGPD and GDPR: record processing activities, track data subject requests and document impact assessments. The organization declares the information and external actions.
Export records and revisions in the complete dossier, with a manifest and verifiable signature. File integrity does not prove the truth of declarations or compliance with a requirement.
The 23 benchmark references and Brazilian CFM Resolution No. 2,454/2026. Each card separates implemented capabilities from required expansion. Documentation explains scope; it does not declare full compliance.
24 references
Privacy · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceSecurity · Assessment program
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Amending law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceResilience · Regulation
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceArtificial intelligence · Regulation
Technical AI evidence available
The technical pack evaluates available signals of AI usage, code durability and security, and reviews of agent actions, with evaluation history. Missing data is not treated as evidence of compliance.
Capabilities and evidence for this referenceConsult official sourceResilience · Supervisory framework
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Regulation
Inventory, requests and impact available
Declared processing inventory, administrative tracking of data subject requests and impact assessments with independent review, history and export.
Capabilities and evidence for this referenceConsult official sourceHealthcare · Law and rules
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceHealthcare · Professional resolution
Technical pack and healthcare guide available
CFM-2454 pack with technical evaluations and manual controls, declared initiative risk classification and Annex III documentation. Results and exceptions form part of the evidence trail.
Capabilities and evidence for this referenceConsult official sourceConsent · Industry framework
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Management standard
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Law
Inventory, requests and impact available
Declared processing inventory, administrative tracking of data subject requests and impact assessments with independent review, history and export.
Capabilities and evidence for this referenceConsult official sourceSupply chain · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceResilience · Directive
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePayments · Industry standard
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Law
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceTransfers · Court decision and guidance
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceAssurance · Attestation framework
Technical controls available
The technical pack evaluates identified code and dependency risks, diagnosis freshness, gates, test coverage, readiness and change reviews, using collected data. Evaluations are recorded.
Capabilities and evidence for this referenceConsult official sourcePrivacy · Jurisdiction family
Management foundation available
Record applicability, owners and declared obligations, with evidence references and internal review. Catalog inclusion does not provide a complete requirements package.
Capabilities and evidence for this referenceConsult official sourceYour organization determines applicability, validates information, carries out measures and obtains the necessary external opinions and assessments. Internal review or risk acceptance does not constitute certification or turn a control into compliance.
ScaleQuality security and postureSee the evidence and healthcare AI documentation for the scope and limitations of existing technical packs.
