# Reglyze

> Reglyze is an AI-first NIS2 compliance platform for European SMEs and MSPs. It auto-scopes your NIS2 obligations, drafts your policies and procedures, answers inbound vendor security questionnaires, runs gap assessments against the NIS2 Article 21 controls, and generates incident-notification reports in national CSIRT formats (ANSSI, ACN, BSI/CERT-Bund, CNCS) — so a small company gets compliant in hours, not months.

Reglyze is a self-serve SaaS with transparent, published EUR pricing (no "contact sales" wall for SMEs). It is built for the EU market — English, French, Italian, German and Portuguese — with national-transposition awareness baked in (DL 125/2025 in Portugal, D.Lgs 138/2024 in Italy, NIS2UmsuCG / BSIG 2025 in Germany, the Loi Résilience in France). The product is multi-tenant so Managed Service Providers can run NIS2 compliance for many client organisations from one console, and is itself hosted in the EU (Germany).

## What Reglyze does

- AI auto-scoping — determine whether and how NIS2 applies to a company from public data, in minutes.
- Conversational gap assessment — score your posture against the NIS2 Article 21(2) controls, adapted to your sector and country.
- Document generation — draft information-security policies, business-continuity plans, supplier-security clauses and the other Article 21 evidence with AI.
- Vendor questionnaire auto-response — upload an inbound RFP or security questionnaire and get a draft answer per question, cited to your own evidence (the headline time-saver).
- Incident reporting — produce 24h / 72h / 1-month notifications in the format your national CSIRT expects (ANSSI, ACN, BSI/CERT-Bund, CNCS).
- Supply-chain / vendor risk register — track third-party suppliers, send questionnaires and score residual risk (NIS2 Article 21(2)(d)).
- Multi-framework crosswalks — map your NIS2 work onto ISO 27001, NIST CSF 2.0 and DORA.
- Article 20 management-body training — train and keep a record for the board, as the directive requires.

## Pricing (one graduated per-organisation curve, billed annually, EUR)

Reglyze has a single pricing axis: the number of organisations you commit to. The price per organisation per year decreases with volume through graduated brackets — like income-tax bands, every organisation is billed at the rate of the bracket it falls into.

- Free — €0. Run the full AI-guided NIS2 assessment and see your score and gaps on screen, no card required. Downloading the report and generating documents are paid.
- Standard — from €490/organisation/year for the first organisations, stepping down with volume to a floor of €190/organisation/year at scale. One organisation is €490/year; 5 organisations €2,450/year; 10 organisations €4,500/year; 25 organisations €9,150/year.
- Enterprise — sales-quoted. Self-serve checkout covers up to 50 organisations; above that, contact sales (from €10,000/year) for larger estates and custom needs.

The AI-guided scoping and gap assessment are free: any organisation can run the full assessment and see its score and gaps on screen without paying. A paid plan adds the deliverables and ongoing management — downloadable reports (PDF, Excel, auditor pack), document and policy generation, incident reporting and vendor risk — with no feature tiers across paid plans. Managed Service Providers run many client organisations from one multi-tenant console at the same per-organisation curve.

## Why Reglyze (differentiators)

- AI is the core, not a bolt-on: scoping, drafting, questionnaire answering and gap analysis are all AI-assisted, which is how an SME gets compliant in hours rather than the months a consultant takes.
- EU-native and honest about pricing: published EUR prices, EU data residency (hosted in Germany), and per-country legal awareness for FR / IT / DE / PT — not a US SOC 2-first tool retrofitted for NIS2.
- Built for MSPs: one multi-tenant console, per-client isolation, and a single graduated per-organisation price that gets cheaper as a reseller adds clients.

## Product

- [Reglyze homepage](https://reglyze.com/en): what Reglyze is and who it is for
- [Coverage & roadmap](https://reglyze.com/en/coverage): every European cyber framework Reglyze covers + roadmap — NIS2 and its 7 national transpositions (ReCyF, Misure ACN, IT-Grundschutz, CyFun, QNRCS, KSC, ENS), the Cyber Resilience Act, and cross-frameworks (ISO 27001, NIST CSF, DORA, IEC 62443)
- [Pricing](https://reglyze.com/en#pricing): the graduated per-organisation pricing curve and the cost calculator
- [NIS2 staff & board training](https://reglyze.com/en/nis2-training): Article 20 management-body and staff-awareness courses
- [Reglyze for MSPs](https://reglyze.com/en/nis2-msp): multi-tenant NIS2 compliance for managed service providers
- [Trust & security](https://reglyze.com/en/trust): how Reglyze itself is secured and hosted
- [Reglyze's own NIS2 compliance](https://reglyze.com/en/compliance): the evidence base Reglyze generated for itself using its own AI

## Compare NIS2 to other frameworks

- [NIS2 vs ISO 27001](https://reglyze.com/en/nis2-vs-iso-27001)
- [NIS2 vs NIST CSF 2.0](https://reglyze.com/en/nis2-vs-nist-csf)
- [NIS2 vs DORA](https://reglyze.com/en/nis2-vs-dora)

## Reglyze vs alternatives

- [Reglyze vs Drata](https://reglyze.com/en/reglyze-vs-drata)
- [Reglyze vs Sprinto](https://reglyze.com/en/reglyze-vs-sprinto)
- [Reglyze vs DataGuard](https://reglyze.com/en/reglyze-vs-dataguard)
- [Reglyze vs Bastione](https://reglyze.com/en/reglyze-vs-bastione)

## Guides & free tools

- [Best NIS2 compliance software](https://reglyze.com/en/best-nis2-compliance-software): how to choose a NIS2 tool, with a comparison matrix
- [NIS2 fines explained](https://reglyze.com/en/nis2-fines): how penalties are calculated under Article 34, by country
- [Free NIS2 scope checker](https://reglyze.com/en/tools/nis2-scope-checker): find out if NIS2 applies to you
- [Free NIS2 fine calculator](https://reglyze.com/en/tools/nis2-fine-calculator): estimate your maximum exposure
- [Free security questionnaire answer tool](https://reglyze.com/en/tools/questionnaire-answer): paste up to 5 questions from a vendor security questionnaire you received and get an AI-drafted answer for each in seconds; the full product grounds every answer in your own evidence and exports it

## MCP server (for AI agents)

Reglyze exposes a free public MCP (Model Context Protocol) server at https://api.reglyze.com/mcp (Streamable HTTP). Public tools (no auth): `scope_check` (does NIS2 apply to an organization, essential/important classification with the national transposition law), `transposition_status` (NIS2 transposition state for every EU/EEA country), `incident_deadline_formats` (per-country 24h/72h/1-month notification deadlines, authority and national severity vocabulary). Account tools (with a Reglyze API token, created under Settings → API tokens): `compliance_status`, `documents_list`, `open_tasks`, `incidents_list` — read your own organization's compliance data. Connect from Claude, Cursor or any MCP client.

- [MCP server documentation](https://reglyze.com/en/mcp): connection instructions per client + tool reference

## EU Cyber Resilience Act (CRA)

- [Cyber Resilience Act compliance](https://reglyze.com/en/cra): self-assess your product's CRA conformity, generate the Annex VII technical file and EU Declaration of Conformity — most products self-certify under Module A
- [Free CRA scope checker](https://reglyze.com/en/tools/cra-scope-checker): check in 4 questions whether your product is in scope of Regulation (EU) 2024/2847, its Annex III/IV classification, and your conformity route

## NIS2 by country

- [NIS2 compliance in Austria (Cybersicherheitsbehoerde)](https://reglyze.com/en/eu/austria)
- [NIS2 compliance in Belgium (CCB)](https://reglyze.com/en/eu/belgium)
- [NIS2 compliance in Germany (BSI)](https://reglyze.com/en/eu/germany)
- [NIS2 compliance in Italy (ACN)](https://reglyze.com/en/eu/italy)
- [NIS2 compliance in France (ANSSI)](https://reglyze.com/en/eu/france)
- [NIS2 compliance in Netherlands (NCSC-NL)](https://reglyze.com/en/eu/netherlands)
- [NIS2 compliance in Spain (INCIBE)](https://reglyze.com/en/eu/spain)
- [NIS2 compliance in Portugal (CNCS)](https://reglyze.com/en/eu/portugal)
- [NIS2 compliance in Poland (MC)](https://reglyze.com/en/eu/poland)
- [NIS2 compliance in Croatia (ZSIS / NCSC-HR)](https://reglyze.com/en/eu/croatia)
- [NIS2 compliance in Slovenia (URSIV)](https://reglyze.com/en/eu/slovenia)

## Localized markets

- [Reglyze for Portugal](https://reglyze.com/pt): RJC (DL 125/2025), CNCS, MyCiber registration, QNRCS
- [Reglyze for Italy](https://reglyze.com/it): ACN, D.Lgs 138/2024, Misure ACN, CSIRT Italia

## Original research

- [NIS2 transpositions: what actually diverges, read in the official gazettes](https://reglyze.com/en/articles/nis2-transposition-divergences): Training scope widened in three countries out of three. Poland invented a high-risk supplier regime NIS2 does not contain. Croatia turned a soft recommendation into 72 hours. Read article by article in the official gazettes. Published 2026-08-11. Also authored in: https://reglyze.com/fr/articles/nis2-transposition-divergences, https://reglyze.com/de/articles/nis2-transposition-divergences, https://reglyze.com/es/articles/nis2-transposition-divergences, https://reglyze.com/pl/articles/nis2-transposition-divergences, https://reglyze.com/hr/articles/nis2-transposition-divergences

## Optional

- [NIS2 Article 20 management training](https://reglyze.com/en/nis2-article-20-training)
- [NIS2 staff awareness training](https://reglyze.com/en/nis2-staff-awareness-training)
- [NIS2 training records](https://reglyze.com/en/nis2-training-records)